Function at 0x1801e20d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2670]
mov eax, 0x2770
call fcn.18029a6b0
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x27b0], rbx
mov rax, qword [0x1804610b0]
xor rax, rsp
mov qword [rbp + 0x2660], rax
mov qword [rsp + 0x60], r8
mov r14, rdx
xor r13d, r13d
mov qword [rdx], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r13w
lea r8d, [r13 + 0xc]
lea rdx, str.Kernel32.dll
lea rcx, [rsp + 0x68]
call fcn.180033930
nop
call fcn.1801ef580
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1801ef620
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.1800338a0
test rbx, rbx
je 0x1801e2624
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801e2624
call rax
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
je 0x1801e2624
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r13w
lea r8d, [r13 + 9]
lea rdx, str.Psapi.dll
lea rcx, [rsp + 0x68]
call fcn.180033930
nop
call fcn.1801ef580
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1801ef620
mov rdi, rax
lea rcx, [rsp + 0x68]
call fcn.1800338a0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r13w
lea r8d, [r13 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x58]
call fcn.180033930
nop
call fcn.1801ef580
mov rcx, rax
lea rdx, [rbp - 0x58]
call fcn.1801ef620
mov rbx, rax
lea rcx, [rbp - 0x58]
call fcn.1800338a0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x180397e60]
movdqu xmmword [rbp - 0x28], xmm1
mov word [rbp - 0x38], r13w
lea r8d, [r13 + 0xc]
lea rdx, str.Wtsapi32.dll
lea rcx, [rbp - 0x38]
call fcn.180033930
nop
call fcn.1801ef580
mov rcx, rax
lea rdx, [rbp - 0x38]
call fcn.1801ef620
mov rsi, rax
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
call fcn.1800338a0
test rdi, rdi
je 0x1801e2624
test rbx, rbx
je 0x1801e2624
test rsi, rsi
je 0x1801e2624
lea rdx, str.EnumProcesses
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetModuleFileNameExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x78], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, str.OpenProcessToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rbp - 0x70], rax
lea rdx, str.GetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x68], rax
test rsi, rsi
je 0x1801e2624
test r15, r15
jne 0x1801e2330
test rdi, rdi
je 0x1801e2624
test r12, r12
je 0x1801e2624
test rax, rax
je 0x1801e2624
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x10]
call fcn.18029c350
mov dword [rbp - 4], r13d
lea r8, [rbp - 4]
mov edx, 0x2000
lea rcx, [rbp + 0x10]
call rsi
test eax, eax
je 0x1801e2624
mov r12d, dword [rbp - 4]
shr r12d, 2
mov eax, 0x800
cmp r12d, eax
cmovae r12d, eax
mov dword [rbp - 8], r13d
mov dword [rbp + 4], r13d
test r12d, r12d
je 0x1801e261b
lea r15, [rbp + 0x10]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x209
lea rcx, [rbp + 0x2450]
call fcn.18029c350
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2340]
call fcn.18029c350
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2230]
call fcn.18029c350
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2010]
call fcn.18029c350
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2120]
call fcn.18029c350
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1801e2438
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1801e25ed
test rdi, rdi
je 0x1801e2453
mov r8d, 0x208
lea rdx, [rbp + 0x2450]
mov rcx, rbx
call rdi
test eax, eax
jne 0x1801e247c
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x1801e25ca
mov r9d, 0x208
lea r8, [rbp + 0x2450]
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
je 0x1801e25ca
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0x2120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2230]
mov r8d, 0x104
lea rdx, [rbp + 0x2340]
lea rcx, [rbp + 0x2450]
call fcn.1802b7200
lea rdx, [rbp + 0x2010]
lea rcx, str.explorer
call fcn.1802b6e6c
test eax, eax
jne 0x1801e25ca
lea rdx, [rbp + 0x2120]
lea rcx, str..exe
call fcn.1802b6e6c
test eax, eax
jne 0x1801e25ca
mov r8, r14
mov edx, 0x2000e
mov rcx, rbx
call qword [rbp - 0x70]
test eax, eax
je 0x1801e25ca
mov rcx, qword [r14]
test rcx, rcx
je 0x1801e25df
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 8]
lea edx, [r9 + 8]
call qword [rbp - 0x68]
test eax, eax
je 0x1801e25ca
mov eax, dword [rsp + 0x58]
cmp dword [rbp - 8], eax
je 0x1801e2608
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x1801e25c5
test rax, rax
je 0x1801e25c5
xor eax, eax
mov qword [rbp - 0x10], rax
mov dword [rbp], eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 8
mov edx, dword [rbp - 8]
xor ecx, ecx
call rsi
test eax, eax
je 0x1801e25c5
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1801e25c5
cmp dword [rbp], 4
jne 0x1801e25c3
cmp dword [rcx], 0
je 0x1801e25fe
call rdi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [r14]
test rcx, rcx
je 0x1801e25df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], 0
test rbx, rbx
je 0x1801e25ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
add r15, 4
cmp r13d, r12d
jae 0x1801e261b
jmp 0x1801e23a0
call rdi
mov qword [rbp - 0x10], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rbp - 8]
mov dword [rcx], eax
cmp qword [r14], 0
setne al
jmp 0x1801e2626
xor al, al
mov rcx, qword [rbp + 0x2660]
xor rcx, rsp
call fcn.1802994c0
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret