Function at 0x140006420
Capabilities:
Check if file exists
Enumerate processes
Get file attributes
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
mov rbx, rdx
mov ecx, dword [rdx + 4]
call fcn.1400050d0
test eax, eax
jne 0x140006475
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x14000668c
mov eax, dword [rbx + 4]
lea r9, str.ulEventType___d__SessionId___u__Memory_could_not_be_allocated_for_this_session.
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x60004007
mov dword [rsp + 0x20], edi
call fcn.140006a40
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
sub edi, 1
je 0x14000659a
sub edi, 1
je 0x14000652d
sub edi, 3
je 0x1400064e0
cmp edi, 1
jne 0x14000668c
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x1400064b4
mov r9d, dword [rbx + 4]
lea r8, str.WTS_SESSION_LOGOFF:_session_id__u
lea edx, [rdi + 3]
call fcn.140006ca0
mov edx, dword [rbx + 4]
mov rcx, qword [0x14008ed98]
call fcn.140003740
mov ecx, dword [rbx + 4]
mov rax, qword [0x14008ede8]
and dword [rax + rcx*4], 0xfffffffd
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400043d0
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x140006501
mov r9d, dword [rbx + 4]
lea r8, str.WTS_SESSION_LOGON:_session_id__u
mov edx, 4
call fcn.140006ca0
mov ecx, dword [rbx + 4]
xor r8d, r8d
mov rax, qword [0x14008ede8]
mov edx, 0x100
or dword [rax + rcx*4], 2
mov rcx, qword [0x14008ed98]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140002f90
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x14000654e
mov r9d, dword [rbx + 4]
lea r8, str.WTS_CONSOLE_DISCONNECT:_session_id__u
mov edx, 4
call fcn.140006ca0
mov rcx, qword [0x14008ed98]
mov edx, 0xffffffff
call fcn.140003b20
mov eax, dword [rbx + 4]
mov rcx, qword [0x14008ede8]
test byte [rcx + rax*4], 2
jne 0x140006584
mov rcx, qword [0x14008ed98]
mov edx, eax
call fcn.140003740
mov rcx, qword [0x14008ede8]
mov eax, dword [rbx + 4]
and dword [rcx + rax*4], 0xfffffffe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400043d0
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x1400065bb
mov r9d, dword [rbx + 4]
lea r8, str.WTS_CONSOLE_CONNECT:_session_id__u
mov edx, 4
call fcn.140006ca0
mov edx, dword [rbx + 4]
mov rcx, qword [0x14008ed98]
call fcn.140003b20
mov eax, dword [0x14008edf4]
mov edi, 1
cmp eax, 4
cmove eax, edi
mov dword [0x14008edf4], eax
mov edx, dword [rbx + 4]
mov rax, qword [0x14008ede8]
mov ecx, dword [rax + rdx*4]
dec ecx
cmp ecx, edi
jbe 0x140006664
mov rcx, qword [0x14008ed98]
call fcn.140003780
test eax, eax
jne 0x140006636
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x14000668c
mov eax, dword [rbx + 4]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov r8d, edi
mov dword [rsp + 0x20], eax
mov edx, 0x60004003
call fcn.140006a40
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rbx + 4]
call fcn.140004f40
test eax, eax
je 0x14000668c
mov ecx, dword [rbx + 4]
mov rax, qword [0x14008ede8]
or dword [rax + rcx*4], edi
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x14000668c
lea r8, str.Client_started_for_session_id__u
jmp 0x14000667e
mov ecx, edx
call fcn.140004040
mov rcx, qword [0x14008ed90]
test rcx, rcx
je 0x14000668c
lea r8, str.Client_already_started_for_session_id__u
mov r9d, dword [rbx + 4]
mov edx, 4
call fcn.140006ca0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret