Function at 0x14001bbd8
Capabilities:
Allocate thread local storage
Create thread
Get logon sessions
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14d, 2
mov dword [rbp + 0x48], r14d
lea esi, [r14 - 1]
test byte [0x1400ab340], sil
jne 0x1400373e2
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsAlloc]
mov dword [0x1400aa9b4], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsAlloc]
mov dword [0x1400aa9c0], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsAlloc]
or ecx, 0xffffffff
mov dword [0x1400aa9b0], eax
cmp dword [0x1400aa9b4], ecx
je 0x140037624
cmp dword [0x1400aa9c0], ecx
je 0x140037624
cmp eax, ecx
je 0x140037624
mov edx, 0x80000000
lea rcx, [0x1400aa9c8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitializeCriticalSectionAndSpinCount]
xor edi, edi
test eax, eax
je 0x140037624
call fcn.140020d44
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDisablePredefinedCacheEx]
lea rax, [rbp - 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CLSID
mov rcx, 0xffffffff80000000
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bcaf
mov rcx, qword [rbp - 8]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov r9d, 4
lea r8, [rbp + 0x48]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
mov rcx, qword [0x1400a92b0]
lea r15, [0x1400a92b0]
lea r12, [0x140093e20]
cmp rcx, r15
je 0x14001bcee
test byte [rcx + 0x44], r14b
jne 0x1400373f4
xor r8d, r8d
lea rdx, [0x1400138a0]
lea rcx, str.SPOOLER
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_RegisterServiceCtrlHandlerExW]
mov qword [0x1400aa9f0], rax
test rax, rax
je 0x14003740b
mov ecx, esi
call fcn.14001bf84
mov dword [0x1400aa9c4], eax
cmp eax, esi
jne 0x14001bf42
call fcn.140020a58
lea r8, str.Spooler_exiting
xor edx, edx
mov ecx, r14d
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_OpenEventW]
mov rbx, rax
test rax, rax
jne 0x140037462
lea r9, str.RouterPreInitEvent
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_CreateEventW]
mov qword [0x1400aada8], rax
test rax, rax
je 0x1400374b4
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x14001bd87
test byte [rcx + 0x44], r14b
jne 0x1400374f0
mov ecx, pe_nt_image_headers64
call fcn.140024914
test rax, rax
je 0x140037507
mov rcx, rax
call fcn.140019430
mov qword [0x1400aa9b8], rax
cmp dword [rax + 0xcc], edi
jl 0x14001bdb6
call fcn.1400193dc
call fcn.14001bb00
call fcn.14001bb74
test al, al
jne 0x14003750f
cmp byte [0x1400a92f6], dil
je 0x14001be8a
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetTickCount]
cmp eax, 0x1d4c0
jae 0x14001bf51
lea rdx, [rbp + 0x58]
mov dword [rbp + 0x40], edi
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x58], rdi
call qword [sym.imp.SspiCli.dll_LsaEnumerateLogonSessions]
test eax, eax
jne 0x14001be77
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x14001be77
cmp byte [0x1400a92f6], dil
mov ebx, edi
je 0x14001be77
cmp ebx, eax
jae 0x14001be77
mov rax, qword [rbp + 0x58]
lea rdx, [rbp - 0x10]
mov ecx, ebx
mov qword [rbp - 0x10], rdi
lea rcx, [rax + rcx*8]
call qword [sym.imp.SspiCli.dll_LsaGetLogonSessionData]
test eax, eax
jne 0x14001be68
mov rdx, qword [rbp - 0x10]
mov eax, dword [rdx + 0x40]
sub eax, r14d
test eax, 0xfffffff7
jne 0x14001be5f
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x14001be58
test byte [rcx + 0x44], r14b
jne 0x140037555
mov byte [0x1400a92f6], dil
mov rcx, rdx
call qword [sym.imp.SspiCli.dll_LsaFreeReturnBuffer]
add ebx, esi
cmp byte [0x1400a92f6], dil
jne 0x14001bf73
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14001be8a
call qword [sym.imp.SspiCli.dll_LsaFreeReturnBuffer]
mov qword [rbp + 0x58], rdi
mov rcx, qword [0x1400aa9f0]
lea rdx, [0x140074380]
mov r8d, esi
call qword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
mov qword [0x1400aadb0], rax
test rax, rax
je 0x14003756f
call fcn.14001c3e0
mov ebx, eax
test eax, eax
jne 0x1400375b0
mov ecx, esi
call fcn.14001bf84
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x14001bedd
test byte [rcx + 0x44], r14b
jne 0x1400375cf
mov r9, qword [0x1400aa9f0]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea r8, [0x140010220]
mov edx, 0x10000
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
test rax, rax
je 0x1400375e6
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x14001bf2d
test byte [rcx + 0x44], r14b
jne 0x1400375fb
test byte [0x1400ab340], sil
jne 0x140037612
mov ecx, r14d
call fcn.14001bf84
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x14001bf67
test byte [rcx + 0x44], r14b
jne 0x14003753e
mov byte [0x1400a92f6], dil
jmp 0x14001be8a
mov eax, dword [rbp + 0x40]
jmp 0x14001be11
lea rdx, [0x140092e98]
call fcn.14003d310
nop
jmp 0x14001bc0d
mov rcx, qword [rcx + 0x38]
mov edx, 0xf
mov r8, r12
call fcn.14003d1bc
nop
jmp 0x14001bcee
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x140037439
test byte [rcx + 0x44], sil
je 0x140037439
mov rcx, qword [rcx + 0x38]
mov edx, 0x10
mov r9d, eax
mov r8, r12
call fcn.14003d1e0
mov edx, ebx
xor ecx, ecx
jmp 0x140037457
mov rcx, qword [rcx + 0x38]
mov edx, 0x18
mov r9d, eax
mov r8, r12
call fcn.14003d1e0
mov edx, ebx
mov ecx, esi
call fcn.14003d520
nop
jmp 0x14001bf42
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x140037485
test byte [rcx + 0x44], r14b
je 0x140037485
mov rcx, qword [rcx + 0x38]
mov edx, 0x11
mov r8, r12
call fcn.14003d1bc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, esi
call fcn.14001bf84
mov dword [0x1400aa9c4], eax
cmp eax, esi
jne 0x14001bf42
mov ecx, 0xbb8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop
jmp 0x14001bd2f
mov rax, qword [0x1400a92b0]
cmp rax, r15
je 0x1400374e7
test byte [rax + 0x44], sil
je 0x1400374e7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
mov edx, 0x12
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x38]
call fcn.14003d1e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_ExitProcess]
mov rcx, qword [rcx + 0x38]
mov edx, 0x13
mov r8, r12
call fcn.14003d1bc
nop
jmp 0x14001bd87
mov rax, rdi
jmp 0x14001bda2
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x140037532
test byte [rcx + 0x44], r14b
je 0x140037532
mov rcx, qword [rcx + 0x38]
mov edx, 0x14
mov r8, r12
call fcn.14003d1bc
mov byte [0x1400a92f6], dil
jmp 0x14001beb1
mov rcx, qword [rcx + 0x38]
mov edx, 0x15
mov r8, r12
call fcn.14003d1bc
nop
jmp 0x14001bf67
mov rcx, qword [rcx + 0x38]
mov edx, 0x16
mov r8, r12
call fcn.14003d1bc
mov rdx, qword [rbp - 0x10]
jmp 0x14001be58
mov rax, qword [0x1400a92b0]
cmp rax, r15
je 0x14001beb1
test byte [rax + 0x44], sil
je 0x14001beb1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x1400a92b0]
mov edx, 0x17
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x38]
call fcn.14003d1e0
nop
jmp 0x14001beb1
mov rcx, qword [0x1400a92b0]
cmp rcx, r15
je 0x140037453
test byte [rcx + 0x44], sil
je 0x140037453
jmp 0x14003743f
mov rcx, qword [rcx + 0x38]
mov edx, 0x19
mov r8, r12
call fcn.14003d1bc
nop
jmp 0x14001bedd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
je 0x14001bf17
mov edx, eax
jmp 0x140037455
mov rcx, qword [rcx + 0x38]
mov edx, 0x1a
mov r8, r12
call fcn.14003d1bc
nop
jmp 0x14001bf2d
lea rdx, [0x140092e08]
call fcn.14003d310
nop
jmp 0x14001bf3a
mov eax, 3
jmp 0x14001bf42