Function at 0x18000d9b0
Capabilities:
Hide graphical window
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x90
call fcn.18000d180
lea rcx, str.C:WindowsSystem32ConsoleLogon.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x18000d9e9
xor r9d, r9d
lea r8, str.FAILED_TO_LOAD
lea rdx, str.FAILED_TO_LOAD
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.18000c140
call fcn.18000cef0
lea rdx, str.C:Windows_system32LogonUI.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x18000da19
mov byte [0x1800c2d20], 0
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.api_ms_win_core_winrt_string_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x18000da49
xor r9d, r9d
lea r8, str.ur_fucked
lea rdx, str.ur_fucked
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x18000da8e
lea rdx, str.WindowsGetStringRawBuffer
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800c7e58], rax
lea rdx, str.WindowsDeleteString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800c7b48], rax
lea rdx, str.WindowsCreateString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800c7e10], rax
lea rcx, str.api_ms_win_core_debug_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1800a7ff8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800c7a28], rax
call fcn.1800482e0
cmp qword [0x1800c7a28], 0
je 0x18000dad4
lea rdx, [0x18000d760]
lea rcx, [0x1800c7a28]
call fcn.180047ae0
call fcn.180048350
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 0x41
lea rdx, str.48_89_5C_24_10_48_89_6C_24_18_56_57_41_54_41_56_41_57_48_83_EC_40
lea rcx, [rsp + 0x68]
call fcn.18000c040
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000eaa0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x14]
lea rdx, str.ControlBasePaintArea
lea rcx, [rsp + 0x48]
call fcn.18000c040
nop
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1800184c0
mov qword [0x1800c7a20], rax
lea r9, [fcn.180003e10]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x68]
call fcn.18004bff4
call fcn.1800482e0
cmp qword [0x1800c7a20], 0
je 0x18000dbb2
lea rdx, [0x18000d6b0]
lea rcx, [0x1800c7a20]
call fcn.180047ae0
call fcn.180048350
lea rcx, str.ConsoleLogonUI.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1800c7ba8], rax
test rax, rax
jne 0x18000dbea
lea r9d, [rax + 0x10]
lea r8, str.UI_DLL_NOT_FOUND
lea rdx, str.UI_DLL_NOT_FOUND
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.18003d5b0
call fcn.18003b7c0
call fcn.1800415b0
call fcn.1800431e0
call fcn.18003fe20
call fcn.18000c6a0
lea rdx, str.C:Windows_system32LogonUI.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x18000dc2e
mov byte [0x1800c2d20], 0
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x1800c6c90]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800c7ea0], ecx
jle 0x18000dc8d
lea rcx, [0x1800c7ea0]
call fcn.18004b9bc
cmp dword [0x1800c7ea0], 0xffffffff
jne 0x18000dc8d
lea rdx, str.InitUI
mov rcx, qword [0x1800c7ba8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800c7e98], rax
lea rcx, [0x1800c7ea0]
call fcn.18004b950
mov rax, qword [0x1800c7e98]
test rax, rax
je 0x18000dc9b
call rax
add rsp, 0x90
pop rbx
ret