Function at 0x140037160
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x58
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
xor esi, esi
test rcx, rcx
mov rbx, rcx
je 0x140037189
mov eax, dword [0x1401f2e98]
mov dword [rcx], eax
mov eax, dword [0x1401f2e9c]
test al, 1
je 0x1400371a5
and eax, 2
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
or eax, 1
mov qword [rsp + 0x50], r12
mov ecx, 0x8000
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov dword [0x1401f2e9c], eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
mov r12d, eax
bts ecx, 0xf
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [0x1401c2df0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbp, rax
je 0x1400372d4
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r13, rax
je 0x1400372d4
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x1400372d4
lea rdx, str.RegOpenKeyA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401f2e80], rax
je 0x1400372d4
lea rdx, str.RegQueryValueExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401f2e88], rax
je 0x1400372d4
lea rdx, str.RegCloseKey
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1401f2e90], rax
je 0x1400372d4
call fcn.140035280
mov r14d, 1
test eax, eax
je 0x140037312
lea rdx, str.ProcessIdToSessionId
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x140037427
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1401f2e98]
mov ecx, eax
call rdi
test eax, eax
je 0x140037427
cmp dword [0x1401f2e98], esi
jne 0x140037427
test rbx, rbx
je 0x1400372df
mov dword [rbx], 0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x140037394
lea rdx, str.WTSQuerySessionInformationA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbp, rax
je 0x140037394
lea rdx, str.WTSFreeMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x140037394
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8d, [rcx + 4]
mov edx, 0xffffffff
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x140037394
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
mov dword [0x1401f2e98], eax
cmp dword [rcx], esi
cmovne esi, r14d
call rdi
test esi, esi
jne 0x140037427
lea rcx, str.wfapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x1400372d4
lea rdx, str.WFQuerySessionInformationA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbp, rax
je 0x1400372d4
lea rdx, str.WFFreeMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x1400372d4
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8d, [rcx + 4]
mov edx, 0xffffffff
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x1400372d4
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
mov dword [0x1401f2e98], eax
cmp dword [rcx], 0
cmovne esi, r14d
call rdi
test esi, esi
je 0x1400372d4
lea rdx, str.GetSystemMetrics
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003744b
mov ecx, 0x1000
call rax
test eax, eax
je 0x1400372d4
test rbx, rbx
je 0x140037458
mov ecx, dword [0x1401f2e98]
mov dword [rbx], ecx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or dword [0x1401f2e9c], 2
mov eax, r14d
jmp 0x1400372ea