Function at 0x18001f710
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2670]
mov eax, 0x2770
call fcn.1800befa0
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x27b0], rbx
mov rax, qword [0x180126050]
xor rax, rsp
mov qword [rbp + 0x2660], rax
mov qword [rsp + 0x60], r8
mov r14, rdx
xor r13d, r13d
mov qword [rdx], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x1800e68a0]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r13w
lea rdx, str.Kernel32.dll
lea rcx, [rsp + 0x68]
call fcn.1800034c0
nop
call fcn.180025300
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1800253e0
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.180003440
test rbx, rbx
je 0x18001fc57
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001fc57
call rax
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
je 0x18001fc57
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x1800e68a0]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r13w
lea rdx, str.Psapi.dll
lea rcx, [rsp + 0x68]
call fcn.1800034c0
nop
call fcn.180025300
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1800253e0
mov rdi, rax
lea rcx, [rsp + 0x68]
call fcn.180003440
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x1800e68a0]
movdqu xmmword [rbp - 0x48], xmm1
mov word [rbp - 0x58], r13w
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x58]
call fcn.1800034c0
nop
call fcn.180025300
mov rcx, rax
lea rdx, [rbp - 0x58]
call fcn.1800253e0
mov rbx, rax
lea rcx, [rbp - 0x58]
call fcn.180003440
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x1800e68a0]
movdqu xmmword [rbp - 0x28], xmm1
mov word [rbp - 0x38], r13w
lea rdx, str.Wtsapi32.dll
lea rcx, [rbp - 0x38]
call fcn.1800034c0
nop
call fcn.180025300
mov rcx, rax
lea rdx, [rbp - 0x38]
call fcn.1800253e0
mov rsi, rax
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x38]
call fcn.180003440
test rdi, rdi
je 0x18001fc57
test rbx, rbx
je 0x18001fc57
test rsi, rsi
je 0x18001fc57
lea rdx, str.EnumProcesses
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetModuleFileNameExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x78], rax
lea rdx, str.GetProcessImageFileNameA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, str.OpenProcessToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rbp - 0x70], rax
lea rdx, str.GetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x68], rax
test rsi, rsi
je 0x18001fc57
test r15, r15
jne 0x18001f960
test rdi, rdi
je 0x18001fc57
test r12, r12
je 0x18001fc57
test rax, rax
je 0x18001fc57
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 4], r13d
lea r8, [rbp - 4]
mov edx, 0x2000
lea rcx, [rbp + 0x10]
call rsi
test eax, eax
je 0x18001fc57
mov r12d, dword [rbp - 4]
shr r12d, 2
mov eax, 0x800
cmp r12d, eax
cmovae r12d, eax
mov dword [rbp - 8], r13d
mov dword [rbp + 4], r13d
test r12d, r12d
je 0x18001fc4e
lea r15, [rbp + 0x10]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x209
lea rcx, [rbp + 0x2450]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2340]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2230]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2010]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x2120]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18001fa68
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001fc20
test rdi, rdi
je 0x18001fa83
mov r8d, 0x208
lea rdx, [rbp + 0x2450]
mov rcx, rbx
call rdi
test eax, eax
jne 0x18001faac
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x18001fbfd
mov r9d, 0x208
lea r8, [rbp + 0x2450]
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
je 0x18001fbfd
mov qword [rsp + 0x40], 0x104
lea rax, [rbp + 0x2120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2230]
mov r8d, 0x104
lea rdx, [rbp + 0x2340]
lea rcx, [rbp + 0x2450]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
lea rdx, [rbp + 0x2010]
lea rcx, str.explorer
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x18001fbfd
lea rdx, [rbp + 0x2120]
lea rcx, [0x1800e0c34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x18001fbfd
mov r8, r14
mov edx, 0x2000e
mov rcx, rbx
call qword [rbp - 0x70]
test eax, eax
je 0x18001fbfd
mov rcx, qword [r14]
test rcx, rcx
je 0x18001fc12
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 8]
lea edx, [r9 + 8]
call qword [rbp - 0x68]
test eax, eax
je 0x18001fbfd
mov eax, dword [rsp + 0x58]
cmp dword [rbp - 8], eax
je 0x18001fc3b
lea rdx, str.WTSQuerySessionInformationW
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x18001fbf8
test rax, rax
je 0x18001fbf8
xor eax, eax
mov qword [rbp - 0x10], rax
mov dword [rbp], eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
mov r8d, 8
mov edx, dword [rbp - 8]
xor ecx, ecx
call rsi
test eax, eax
je 0x18001fbf8
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18001fbf8
cmp dword [rbp], 4
jne 0x18001fbf6
cmp dword [rcx], 0
je 0x18001fc31
call rdi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [r14]
test rcx, rcx
je 0x18001fc12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], 0
test rbx, rbx
je 0x18001fc20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13d
add r15, 4
cmp r13d, r12d
jae 0x18001fc4e
jmp 0x18001f9d0
call rdi
mov qword [rbp - 0x10], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rbp - 8]
mov dword [rcx], eax
cmp qword [r14], 0
setne al
jmp 0x18001fc59
xor al, al
mov rcx, qword [rbp + 0x2660]
xor rcx, rsp
call fcn.1800bd270
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret