Function at 0x1800157c0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2670]
mov eax, 0x2770
call fcn.180038600
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x27b0], rbx
mov rax, qword [0x18008d0c0]
xor rax, rsp
mov qword [rbp + 0x2660], rax
mov qword [rbp - 0x38], r8
mov r13, rdx
xor r12d, r12d
mov qword [rdx], r12
call fcn.180015560
mov dword [rbp - 0x40], eax
cmp eax, 0xffffffff
je 0x180016134
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
lea rcx, str.Psapi.dll
call fcn.1800429cc
mov r15, rax
movabs rsi, 0x7ffffffffffffffe
movabs r9, 0x7fffffffffffffff
lea r8, [r12 - 1]
mov r14, qword [rsp + 0x78]
cmp rax, r14
ja 0x1800158a4
lea rdi, [rsp + 0x60]
cmp r14, 8
cmovae rdi, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Psapi.dll
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r12w
jmp 0x18001599d
cmp r15, rsi
ja 0x180016166
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x1800158be
mov rbx, rsi
jmp 0x1800158df
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x1800158d4
mov rbx, rsi
jmp 0x1800158df
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r9
jbe 0x1800158f1
mov rdx, r8
jmp 0x1800158fa
cmp rdx, 0x1000
jb 0x180015921
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.18003762c
test rax, rax
je 0x18001616c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015936
test rdx, rdx
je 0x180015933
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
jmp 0x180015936
mov rdi, r12
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Psapi.dll
mov rcx, rdi
call fcn.180039130
mov word [rbx + rdi], r12w
cmp r14, 8
jb 0x180015998
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016172
call fcn.180037624
mov qword [rsp + 0x60], rdi
call fcn.18001b4d0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.18001b570
mov r12, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1800159f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800159ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016178
call fcn.180037624
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
lea rcx, str.Advapi32.dll
call fcn.1800429cc
mov r15, rax
mov r14, qword [rbp - 0x68]
cmp rax, r14
ja 0x180015a6b
lea rdi, [rbp - 0x80]
cmp r14, 8
cmovae rdi, qword [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, str.Advapi32.dll
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
jmp 0x180015b74
cmp r15, rsi
ja 0x18001617e
mov rbx, r15
or rbx, 7
cmp rbx, rsi
jbe 0x180015a85
mov rbx, rsi
jmp 0x180015aa6
mov rcx, r14
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp r14, rax
jbe 0x180015a9b
mov rbx, rsi
jmp 0x180015aa6
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180015ac9
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180015ad9
cmp rdx, 0x1000
jb 0x180015b00
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x180016184
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015b10
test rdx, rdx
je 0x180015b10
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rbx
lea rbx, [r15 + r15]
mov r8, rbx
lea rdx, str.Advapi32.dll
mov rcx, rdi
call fcn.180039130
xor eax, eax
mov word [rbx + rdi], ax
cmp r14, 8
jb 0x180015b70
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015b6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001618a
call fcn.180037624
mov qword [rbp - 0x80], rdi
call fcn.18001b4d0
mov rcx, rax
lea rdx, [rbp - 0x80]
call fcn.18001b570
mov r15, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x180015bc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015bc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016190
call fcn.180037624
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
lea rcx, str.Wtsapi32.dll
call fcn.1800429cc
mov rbx, rax
mov r14, qword [rbp - 0x48]
cmp rax, r14
ja 0x180015c3b
lea rdi, [rbp - 0x60]
cmp r14, 8
cmovae rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rax
add rbx, rbx
mov r8, rbx
lea rdx, str.Wtsapi32.dll
mov rcx, rdi
call fcn.180039130
xor esi, esi
mov word [rbx + rdi], si
jmp 0x180015d3c
cmp rbx, rsi
ja 0x180016196
mov rcx, rbx
or rcx, 7
cmp rcx, rsi
ja 0x180015c6f
mov rdx, r14
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp r14, rax
ja 0x180015c6f
lea rax, [r14 + rdx]
mov rsi, rcx
cmp rcx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180015c92
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x180015ca2
cmp rdx, 0x1000
jb 0x180015cc9
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.18003762c
test rax, rax
je 0x18001619c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015cd9
test rdx, rdx
je 0x180015cd9
mov rcx, rdx
call fcn.18003762c
mov rdi, rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
lea rdx, str.Wtsapi32.dll
mov rcx, rdi
call fcn.180039130
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x180015d38
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015d33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800161a2
call fcn.180037624
mov qword [rbp - 0x60], rdi
call fcn.18001b4d0
mov rcx, rax
lea rdx, [rbp - 0x60]
call fcn.18001b570
mov rbx, rax
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x180015d94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015d8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016160
call fcn.180037624
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
test r12, r12
je 0x180016134
test r15, r15
je 0x180016134
test rbx, rbx
je 0x180016134
lea rdx, str.EnumProcesses
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.GetModuleFileNameExA
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rsp + 0x58], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, str.OpenProcessToken
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rbp - 0x30], rax
lea rdx, str.GetTokenInformation
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x28], rax
test rbx, rbx
je 0x180016134
test rsi, rsi
jne 0x180015e44
test rdi, rdi
je 0x180016134
test r14, r14
je 0x180016134
test rax, rax
je 0x180016134
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x10]
call fcn.1800395c0
xor r14d, r14d
mov dword [rbp - 4], r14d
lea r8, [rbp - 4]
mov edx, 0x2000
lea rcx, [rbp + 0x10]
call rbx
test eax, eax
je 0x180016134
mov r15d, dword [rbp - 4]
shr r15d, 2
mov eax, 0x800
cmp r15d, eax
cmovae r15d, eax
mov dword [rbp - 8], r14d
mov dword [rbp + 4], r14d
mov r12d, r14d
test r15d, r15d
je 0x18001612a
lea r14, [rbp + 0x10]
xor edx, edx
mov r8d, 0x209
lea rcx, [rbp + 0x2450]
call fcn.1800395c0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2340]
call fcn.1800395c0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2230]
call fcn.1800395c0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2010]
call fcn.1800395c0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2120]
call fcn.1800395c0
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x180015f49
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800160ff
test rdi, rdi
je 0x180015f64
mov r8d, 0x208
lea rdx, [rbp + 0x2450]
mov rcx, rbx
call rdi
test eax, eax
jne 0x180015f89
test rsi, rsi
je 0x1800160dc
mov r9d, 0x208
lea r8, [rbp + 0x2450]
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
je 0x1800160dc
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0x2120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2230]
mov r8d, 0x104
lea rdx, [rbp + 0x2340]
lea rcx, [rbp + 0x2450]
call fcn.18004683c
lea rdx, [rbp + 0x2010]
lea rcx, str.explorer
call fcn.1800464a8
test eax, eax
jne 0x1800160dc
lea rdx, [rbp + 0x2120]
lea rcx, str..exe
call fcn.1800464a8
test eax, eax
jne 0x1800160dc
mov r8, r13
mov edx, 0x2000e
mov rcx, rbx
call qword [rbp - 0x30]
test eax, eax
je 0x1800160dc
mov rcx, qword [r13]
test rcx, rcx
je 0x1800160f1
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 8]
lea edx, [r9 + 8]
call qword [rbp - 0x28]
test eax, eax
je 0x1800160dc
mov eax, dword [rbp - 0x40]
cmp dword [rbp - 8], eax
je 0x180016118
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x1800160d2
test rax, rax
je 0x1800160d2
xor eax, eax
mov qword [rbp - 0x10], rax
mov dword [rbp], eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 8
mov edx, dword [rbp - 8]
xor ecx, ecx
call rsi
test eax, eax
je 0x1800160d2
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1800160d2
cmp dword [rbp], 4
jne 0x1800160d0
cmp dword [rcx], 0
je 0x180016110
call rdi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [r13]
test rcx, rcx
je 0x1800160f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [r13], rax
test rbx, rbx
je 0x1800160ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12d
add r14, 4
cmp r12d, r15d
jae 0x18001612a
jmp 0x180015eb1
call rdi
xor eax, eax
mov qword [rbp - 0x10], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
mov eax, dword [rbp - 8]
mov dword [rcx], eax
cmp qword [r13], 0
setne al
jmp 0x180016136
xor al, al
mov rcx, qword [rbp + 0x2660]
xor rcx, rsp
call fcn.180037600
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180042954
int3
call fcn.180001eb0
int3
call fcn.180042954
int3
call fcn.180042954
int3