Function at 0x14006883b
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x308
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x44], 0
mov ecx, 0x21
mov dl, 1
call fcn.140067f9b
mov rsi, rdx
add rdi, rbx
lea rdx, [rsp + 0x108]
mov qword [rdx], rbx
mov qword [rdx + 8], rdi
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rdi, [rsp + 0x78]
mov rcx, rdi
call fcn.140067c5e
mov r8, qword [rdi + 8]
mov qword [rsp + 0x68], r8
cmp qword [rdi], 0
je 0x1400688b2
mov rcx, qword [0x1400a54b0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x44]
xor ebx, ebx
xor edx, edx
mov r8, rsi
call sub.rstrtmgr.dll_RmStartSession
test eax, eax
jne 0x140068ae8
mov ecx, dword [rsp + 0x44]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
lea r8, [rsp + 0x68]
mov edx, 1
xor r9d, r9d
call sub.rstrtmgr.dll_RmRegisterResources
test eax, eax
jne 0x140068adf
lea rdx, [rsp + 0x48]
mov dword [rdx], ebx
lea r8, [rsp + 0x4c]
mov dword [r8], ebx
lea r15, [rsp + 0x74]
mov dword [r15], ebx
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x20], r15
xor r9d, r9d
call sub.rstrtmgr.dll_RmGetList
cmp eax, 0xea
jne 0x140068adf
mov r14d, dword [rsp + 0x48]
mov dword [rsp + 0x4c], r14d
lea rcx, [rsp + 0x108]
mov r8d, 0x200
xor edx, edx
call fcn.1400768f0
lea rcx, [rsp + 0x78]
mov r8d, 0x90
xor edx, edx
call fcn.1400768f0
test r14, r14
je 0x1400689d0
imul rbx, r14, 0x29c
mov al, byte [0x1400a5530]
xor ecx, ecx
mov rdx, rbx
call fcn.1400639e0
test rax, rax
je 0x140068b0d
mov rdi, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
cmp r14d, 2
jb 0x1400689f1
lea r12, [r14 - 1]
mov rbx, rdi
mov rcx, rbx
add rbx, 0x29c
mov r8d, 0x29c
xor edx, edx
call fcn.1400768f0
dec r12
jne 0x1400689a9
lea r12, [r14 - 1]
test r14d, r14d
jne 0x1400689f7
jmp 0x140068a43
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 0
mov edi, 4
xor r12d, r12d
jmp 0x140068a43
xor r12d, r12d
mov rbx, rdi
mov qword [rbx], 0
mov dword [rbx + 8], 0
lea rcx, [rbx + 0xc]
lea rdx, [rsp + 0x108]
mov r8d, 0x200
call fcn.140076250
add rbx, 0x20c
lea rdx, [rsp + 0x78]
mov r8d, 0x90
mov rcx, rbx
call fcn.140076250
inc r12
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x4c]
mov r9, rdi
call sub.rstrtmgr.dll_RmGetList
xor ebx, ebx
test eax, eax
jne 0x140068ac8
cmp dword [rsp + 0x48], 0
je 0x140068ac8
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcessId]
test r12, r12
je 0x140068aae
imul rcx, r12, 0x29c
xor edx, edx
mov r8d, 1
xor r9d, r9d
cmp dword [rdi + rdx], eax
movzx r9d, r9b
cmove r9d, r8d
add rdx, 0x29c
cmp rcx, rdx
jne 0x140068a91
test r9b, 1
jne 0x140068ac6
mov ecx, dword [rsp + 0x44]
mov edx, 1
xor r8d, r8d
call sub.rstrtmgr.dll_RmShutdown
test eax, eax
sete bl
jmp 0x140068ac8
xor ebx, ebx
test r14, r14
je 0x140068adf
mov rcx, qword [0x1400a54b0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [rsp + 0x44]
call sub.rstrtmgr.dll_RmEndSession
mov rcx, qword [0x1400a54b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
add rsp, 0x308
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 4
mov rdx, rbx
call fcn.1400775a0
int3