Function at 0x1400e8030
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x30]
mov rbx, rcx
test eax, eax
jne 0x1400e84bd
cmp qword [rcx + 8], 0
mov qword [rsp + 0x40], rbp
lea rbp, [rcx + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
jne 0x1400e8098
cmp qword [rcx + 0x10], 0
lea rdi, [rcx + 0x10]
jne 0x1400e8098
cmp qword [rcx + 0x18], 0
lea r14, [rcx + 0x18]
jne 0x1400e8098
cmp qword [rcx + 0x20], 0
lea rsi, [rcx + 0x20]
jne 0x1400e8098
cmp qword [rcx + 0x28], 0
lea r15, [rcx + 0x28]
je 0x1400e8125
mov qword [rsp + 0x58], r12
xor r12d, r12d
test rbp, rbp
je 0x1400e80b8
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400e80b8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbp], r12
lea rdi, [rbx + 0x10]
test rdi, rdi
je 0x1400e80d2
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e80d2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rdi], r12
lea r14, [rbx + 0x18]
test r14, r14
je 0x1400e80ec
mov rcx, qword [r14]
test rcx, rcx
je 0x1400e80ec
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r14], r12
lea rsi, [rbx + 0x20]
test rsi, rsi
je 0x1400e8106
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400e8106
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsi], r12
lea r15, [rbx + 0x28]
test r15, r15
je 0x1400e8120
mov rcx, qword [r15]
test rcx, rcx
je 0x1400e8120
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r15], r12
mov r12, qword [rsp + 0x58]
lea r8, str.kernel32.dll
mov rdx, r14
call fcn.1400e7d20
lea r8, str._advapi32.dll
mov rdx, rbp
call fcn.1400e7d20
lea r8, str.wtsapi32.dll
mov rdx, rdi
call fcn.1400e7d20
lea r8, str.user32.dll
mov rdx, rsi
call fcn.1400e7d20
lea r8, str.psapi.dll
mov rdx, r15
call fcn.1400e7d20
mov rcx, qword [r14]
test rcx, rcx
je 0x1400e81ba
lea rdx, str.RegisterServiceProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14]
lea rdx, [0x140351cb0]
mov qword [rbx + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14]
lea rdx, str.WTSGetActiveConsoleSessionId
mov qword [rbx + 0xe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc8], rax
mov rcx, qword [rbp]
mov r14, qword [rsp + 0x28]
test rcx, rcx
je 0x1400e832d
lea rdx, [0x140351ce8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351d08]
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351c60]
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351c78]
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351c88]
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.CreateServiceW
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351d88]
mov qword [rbx + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.ControlService
mov qword [rbx + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.DeleteService
mov qword [rbx + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.ChangeServiceConfigW
mov qword [rbx + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.CreateProcessAsUserW
mov qword [rbx + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351d40]
mov qword [rbx + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.LookupPrivilegeValueW
mov qword [rbx + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.AdjustTokenPrivileges
mov qword [rbx + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, str.QueryServiceStatus
mov qword [rbx + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp]
lea rdx, [0x140351e48]
mov qword [rbx + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x140], rax
mov rcx, qword [rsi]
mov rbp, qword [rsp + 0x40]
test rcx, rcx
je 0x1400e83c5
lea rdx, str.OpenDesktopW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.GetUserObjectInformationW
mov qword [rbx + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.GetProcessWindowStation
mov qword [rbx + 0xf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.SetProcessWindowStation
mov qword [rbx + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.CloseWindowStation
mov qword [rbx + 0x108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi]
lea rdx, str.OpenWindowStationW
mov qword [rbx + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x118], rax
mov rcx, qword [r15]
mov rsi, qword [rsp + 0x48]
test rcx, rcx
je 0x1400e8414
lea rdx, str.EnumProcesses
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r15]
lea rdx, [0x140351ef8]
mov qword [rbx + 0x120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r15]
lea rdx, str.GetModuleBaseNameW
mov qword [rbx + 0x128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x130], rax
mov rcx, qword [rdi]
mov r15, qword [rsp + 0x20]
test rcx, rcx
je 0x1400e84ac
lea rdx, str.WTSQueryUserToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.WTSQuerySessionInformation
mov qword [rbx + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, [0x140351ea8]
mov qword [rbx + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, str.WTSEnumerateSessionsExW
mov qword [rbx + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, [0x140351ed8]
mov qword [rbx + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi]
lea rdx, [0x140351f40]
mov qword [rbx + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd8], rax
mov rdi, qword [rsp + 0x50]
mov eax, 1
mov dword [rbx + 0x30], 1
add rsp, 0x30
pop rbx
ret