Function at 0x140006fdc
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140035aa0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2900
call fcn.1400010a0
sub rsp, rax
mov rdi, rsp
mov ecx, 0xa40
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2910]
mov qword [rsp + 0x28e0], 0xfffffffffffffffe
mov rax, qword [0x1402840e8]
xor rax, rsp
mov qword [rsp + 0x28f0], rax
mov rax, qword [rsp + 0x2918]
mov qword [rax], 0
mov rcx, qword [rsp + 0x2910]
call fcn.140005817
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xffffffff
jne 0x140035b20
xor al, al
jmp 0x14003638a
lea rdx, [0x1401e4e80]
lea rcx, [rsp + 0x60]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call fcn.1400073ce
lea rdx, [0x1401e4e98]
lea rcx, [rsp + 0x90]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x90]
call fcn.1400073ce
lea rdx, str.Wtsapi32.dll
lea rcx, [rsp + 0xc0]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0xc0]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xc0]
call fcn.1400073ce
cmp qword [rsp + 0x58], 0
jne 0x140035bf4
mov r8d, 0xb9
lea rdx, [0x1401e4ef0]
lea rcx, [0x1401e4ed8]
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x88], 0
jne 0x140035c1a
mov r8d, 0xba
lea rdx, [0x1401e4f90]
lea rcx, [0x1401e5018]
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0xb8], 0
jne 0x140035c40
mov r8d, 0xbb
lea rdx, [0x1401e5050]
lea rcx, str.hWtsapi32___0
call fcn.1400070db
xor eax, eax
cmp qword [rsp + 0x58], 0
je 0x140035c5e
cmp qword [rsp + 0x88], 0
je 0x140035c5e
cmp qword [rsp + 0xb8], 0
jne 0x140035c65
xor al, al
jmp 0x14003638a
lea rdx, str.EnumProcesses
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xe8], rax
lea rdx, str.GetModuleFileNameExA
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xf0], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xf8], rax
lea rdx, [0x1401e5038]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x100], rax
lea rdx, [0x1401e5128]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x108], rax
cmp qword [rsp + 0xe8], 0
je 0x140035d24
cmp qword [rsp + 0xf0], 0
jne 0x140035d0e
cmp qword [rsp + 0xf8], 0
je 0x140035d24
cmp qword [rsp + 0x100], 0
je 0x140035d24
cmp qword [rsp + 0x108], 0
jne 0x140035d67
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
xor al, al
jmp 0x14003638a
mov dword [rsp + 0x110], 0x800
lea rax, [rsp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov dword [rsp + 0x2144], 0
mov dword [rsp + 0x2154], 0
lea r8, [rsp + 0x2144]
mov edx, 0x2000
lea rcx, [rsp + 0x130]
call qword [rsp + 0xe8]
test eax, eax
jne 0x140035de7
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
xor al, al
jmp 0x14003638a
mov eax, dword [rsp + 0x2144]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x2154], eax
cmp dword [rsp + 0x2154], 0x800
jb 0x140035e17
mov dword [rsp + 0x2154], 0x800
mov qword [rsp + 0x2158], 0
lea rax, [rsp + 0x2170]
mov rdi, rax
xor eax, eax
mov ecx, 0x209
rep stosb byte [rdi], al
lea rax, [rsp + 0x23a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x24d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x2600]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x2730]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
mov dword [rsp + 0x2854], 0
mov dword [rsp + 0x2874], 0
mov dword [rsp + 0x2884], 0
jmp 0x140035eba
mov eax, dword [rsp + 0x2884]
inc eax
mov dword [rsp + 0x2884], eax
mov eax, dword [rsp + 0x2154]
cmp dword [rsp + 0x2884], eax
jae 0x140036320
lea rax, [rsp + 0x2170]
mov rdi, rax
xor eax, eax
mov ecx, 0x209
rep stosb byte [rdi], al
lea rax, [rsp + 0x23a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x24d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x2600]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x2730]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x2884]
mov r8d, dword [rsp + rax*4 + 0x130]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2158], rax
cmp qword [rsp + 0x2158], 0
jne 0x140035f85
mov eax, dword [rsp + 0x2884]
mov r8d, dword [rsp + rax*4 + 0x130]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x2158], rax
cmp qword [rsp + 0x2158], 0
je 0x14003631b
mov byte [rsp + 0x2888], 0
cmp qword [rsp + 0xf8], 0
je 0x140035fd0
mov r8d, 0x208
lea rdx, [rsp + 0x2170]
mov rcx, qword [rsp + 0x2158]
call qword [rsp + 0xf8]
test eax, eax
je 0x140035fd0
mov byte [rsp + 0x2888], 1
movzx eax, byte [rsp + 0x2888]
test eax, eax
jne 0x140036012
cmp qword [rsp + 0xf0], 0
je 0x140036012
mov r9d, 0x208
lea r8, [rsp + 0x2170]
xor edx, edx
mov rcx, qword [rsp + 0x2158]
call qword [rsp + 0xf0]
test eax, eax
je 0x140036012
mov byte [rsp + 0x2888], 1
movzx eax, byte [rsp + 0x2888]
test eax, eax
je 0x1400362c8
mov qword [rsp + 0x40], 0x104
lea rax, [rsp + 0x2730]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rsp + 0x2600]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rsp + 0x24d0]
mov r8d, 0x104
lea rdx, [rsp + 0x23a0]
lea rcx, [rsp + 0x2170]
call fcn.140005b7d
lea rdx, [rsp + 0x2600]
lea rcx, str.explorer
call fcn.1400027d4
test eax, eax
jne 0x1400362c8
lea rdx, [rsp + 0x2730]
lea rcx, str..exe
call fcn.1400027d4
test eax, eax
jne 0x1400362c8
mov dword [rsp + 0x288c], 0x2000e
mov r8, qword [rsp + 0x2918]
mov edx, dword [rsp + 0x288c]
mov rcx, qword [rsp + 0x2158]
call qword [rsp + 0x100]
test eax, eax
je 0x1400362c8
mov rax, qword [rsp + 0x2918]
cmp qword [rax], 0
je 0x1400362c8
lea rax, [rsp + 0x2874]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x2854]
mov edx, 0xc
mov rax, qword [rsp + 0x2918]
mov rcx, qword [rax]
call qword [rsp + 0x108]
test eax, eax
je 0x1400362c8
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x2854], eax
jne 0x140036171
mov rcx, qword [rsp + 0x2158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x2158], 0
mov rax, qword [rsp + 0x2920]
mov ecx, dword [rsp + 0x2854]
mov dword [rax], ecx
jmp 0x140036320
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2890], rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2898], rax
cmp qword [rsp + 0x2890], 0
je 0x1400362b0
cmp qword [rsp + 0x2898], 0
je 0x1400362b0
mov qword [rsp + 0x28a8], 0
mov dword [rsp + 0x28c4], 0
lea rax, [rsp + 0x28c4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x28a8]
mov r8d, 8
mov edx, dword [rsp + 0x2854]
xor ecx, ecx
call qword [rsp + 0x2890]
test eax, eax
je 0x1400362b0
cmp qword [rsp + 0x28a8], 0
je 0x1400362b0
mov eax, dword [rsp + 0x28c4]
cmp rax, 4
jne 0x140036295
mov rax, qword [rsp + 0x28a8]
mov eax, dword [rax]
mov dword [rsp + 0x28d4], eax
cmp dword [rsp + 0x28d4], 0
jne 0x140036295
mov rcx, qword [rsp + 0x28a8]
call qword [rsp + 0x2898]
mov qword [rsp + 0x28a8], 0
mov rcx, qword [rsp + 0x2158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x2158], 0
mov rax, qword [rsp + 0x2920]
mov ecx, dword [rsp + 0x2854]
mov dword [rax], ecx
jmp 0x140036320
mov rcx, qword [rsp + 0x28a8]
call qword [rsp + 0x2898]
mov qword [rsp + 0x28a8], 0
mov qword [rsp + 0x2890], 0
mov qword [rsp + 0x2898], 0
mov rax, qword [rsp + 0x2918]
cmp qword [rax], 0
je 0x1400362f6
mov rax, qword [rsp + 0x2918]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x2918]
mov qword [rax], 0
cmp qword [rsp + 0x2158], 0
je 0x14003631b
mov rcx, qword [rsp + 0x2158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x2158], 0
jmp 0x140035eaa
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov rax, qword [rsp + 0x2918]
cmp qword [rax], 0
je 0x140036377
mov dword [rsp + 0x28e8], 1
jmp 0x140036382
mov dword [rsp + 0x28e8], 0
movzx eax, byte [rsp + 0x28e8]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401e9920]
call fcn.14000849f
mov rax, rdi
mov rcx, qword [rsp + 0x28f0]
xor rcx, rsp
call fcn.1400030d0
add rsp, 0x2900
pop rdi
ret