Function at 0x1400071a0
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400f7080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, r8
mov rsi, rcx
test rdx, rdx
jne 0x14000746d
xor r14d, r14d
mov qword [rbp + 0x27], 7
lea r8d, [rdx + 0x24]
mov qword [rbp + 0x1f], r14
lea rdx, str.E0CC6339_7B80_29CF_2B5E_39393179AA8C
mov word [rbp + 0xf], r14w
lea rcx, [rbp + 0xf]
call fcn.140002160
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x19]
call fcn.140009e10
mov rdx, qword [rbp + 0x27]
mov ecx, r14d
mov qword [rbp + 7], rcx
cmp rdx, 8
jb 0x140007261
mov rcx, qword [rbp + 0xf]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007249
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000748f
call fcn.1400a508c
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x140007261
cmp byte [rcx + 0xc], r14b
je 0x140007261
mov al, 1
jmp 0x140007263
xor al, al
mov qword [rsp + 0xc8], rbx
test al, al
jne 0x1400072be
test rcx, rcx
jne 0x1400072b4
lea rdx, [0x1400fa0e0]
mov ecx, 0x10
call fcn.1400a50c0
test rax, rax
je 0x140007298
lea rdx, [rbp - 0x19]
mov rcx, rax
call fcn.140008e80
jmp 0x14000729b
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140009d90
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x1400073e6
cmp byte [rcx + 0xc], r14b
je 0x1400073e6
xor edx, edx
call fcn.140008fe0
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x1400073e6
xor ecx, ecx
lea rax, [rbp - 0x29]
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov edx, 0xffffffff
lea r8d, [rcx + 4]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14000730b
mov rcx, qword [rbp - 0x21]
mov ebx, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test ebx, ebx
je 0x1400073e6
xor edx, edx
mov ecx, 0x180
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov ecx, 0x38
call fcn.1400a4d9c
mov rbx, rax
mov qword [0x1400fba90], rax
lea r8, str._startup
mov rdx, 0xffffffffffffffff
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x18], r14
mov dword [rax + 0x28], r14d
mov byte [rax + 0x2c], r14b
nop dword [rax]
movzx ecx, word [rdi + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400073d2
add rdx, 2
cmp rdx, 9
je 0x140007374
movzx eax, word [rdi + rdx*2]
cmp ax, word [r8 + rdx*2]
je 0x140007350
jmp 0x1400073d2
mov rdx, rsi
mov rcx, rbx
call fcn.140001a60
test al, al
je 0x1400073d2
xor r9d, r9d
lea rcx, [rbp + 0xf]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400073ca
nop dword [rax]
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0xf]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400073a0
mov rcx, rbx
call fcn.140001cb0
mov edx, 0x38
mov qword [0x1400fba90], r14
mov rcx, rbx
call fcn.1400a508c
xor edx, edx
lea rcx, [rbp + 7]
call fcn.140009d90
mov rbx, qword [rbp + 7]
test rbx, rbx
je 0x140007429
cmp byte [rbx + 0xc], r14b
je 0x14000741c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000741c
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000741c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x10
mov rcx, rbx
call fcn.1400a508c
mov rdx, qword [rbp - 1]
mov rbx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x14000746d
mov rcx, qword [rbp - 0x19]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007468
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000748f
call fcn.1400a508c
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400a4a60
mov rsi, qword [rsp + 0xd0]
add rsp, 0xa0
pop r14
pop rdi
pop rbp
ret
call fcn.1400a8f10
int3