Function at 0x14001fcd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
movaps xmmword [rsp + 0x230], xmm6
call qword [sym.imp.user32.dll_GetProcessWindowStation]
cmp rax, 0xffffffffffffffff
je 0x14001fd3d
xor ecx, ecx
lea rsi, [rsp + 0x1d0]
mov dword [rsi + 8], ecx
mov qword [rsi], 0
lea rdx, [rsp + 0x120]
mov dword [rdx], ecx
mov qword [rsp + 0x20], rdx
mov rcx, rax
mov edx, 1
mov r8, rsi
mov r9d, 0xc
call qword [sym.imp.user32.dll_GetUserObjectInformationA]
test byte [rsi + 8], 1
jne 0x14001fd6c
lea rax, [0x1400acf96]
lea rcx, [rsp + 0x1d0]
mov qword [rcx], rax
lea rax, [0x1400197d3]
mov qword [rcx + 8], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
call qword [sym.imp.advapi32.dll_StartServiceCtrlDispatcherA]
jmp 0x140020848
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
call fcn.14001e144
cmp qword [rsi], 0
je 0x140020891
lea rax, [rsp + 0x188]
lea rdx, [rsp + 0x1d0]
mov ecx, 9
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rdx + 0x58]
mov qword [rsp + 0x100], rcx
movups xmm0, xmmword [rdx + 0x48]
movaps xmmword [rsp + 0xf0], xmm0
mov rcx, qword [rax]
call fcn.1400679b9
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], rdx
mov byte [rsp + 0x170], 0
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xa8]
cmp eax, 1
je 0x14001fe30
test eax, eax
jne 0x1400208a5
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rsi, qword [rcx + rax*8]
lea rcx, [rsi + 0x60]
lea rdx, [0x140067986]
call fcn.1400645a7
mov byte [rsi + 0xa8], 1
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0xa6], 2
jne 0x1400208a5
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov byte [r14 + 0xa6], 0
mov ecx, 0x160
add rcx, qword [rsp + 0x188]
call fcn.14006efb6
mov edi, eax
mov ebx, edx
cmp dword [r14 + 0x98], 0
je 0x14001fe9b
mov esi, dword [r14 + 0x9c]
mov ebp, dword [r14 + 0xa0]
jmp 0x14001fea4
call fcn.140068e1b
mov esi, eax
mov ebp, edx
lea rdx, [rsp + 0x1a0]
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 0x60]
mov dword [rcx + 0x38], 1
mov dword [rcx + 0x3c], edi
mov dword [rcx + 0x40], ebx
mov rdx, qword [rdx - 0x18]
call fcn.140067e20
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rdx
mov dword [rsp + 0x118], esi
mov dword [rsp + 0x11c], ebp
xorps xmm6, xmm6
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x120]
lea r14, [rsp + 0xe0]
lea r15, [0x140067986]
xor ebx, ebx
xchg qword [rsp + 0x1a0], rbx
test rbx, rbx
jne 0x1400200c2
xor r8d, r8d
mov qword [rsp + 0x80], r8
mov rax, qword [rsp + 0x1c8]
shr rax, 2
lea rdx, [rsp + 0x58]
mov qword [rdx - 8], r8
movups xmmword [rdx - 0x18], xmm6
lea rcx, [rsp + 0x1a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
movups xmmword [rdx], xmm6
mov byte [rdx + 0x10], 0
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x73]
mov dword [rdx + 0x14], ecx
mov dword [rdx + 0x11], eax
call fcn.14006cd2c
test rax, rax
je 0x1400208a5
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rdx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xe0], rax
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xa8]
cmp eax, 1
je 0x14001fff7
mov bpl, 2
test eax, eax
jne 0x140020021
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov r12, qword [rcx + rax*8]
lea rcx, [r12 + 0x60]
mov rdx, r15
call fcn.1400645a7
mov byte [r12 + 0xa8], 1
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov bpl, byte [rax + 0xa4]
mov r12b, byte [rax + 0xa5]
mov word [rax + 0xa4], 0x8001
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.14006f970
test al, al
je 0x140020048
mov rcx, rdi
mov rdx, r14
call fcn.1400208a9
mov r13d, eax
inc r13b
jmp 0x14002004b
xor r13d, r13d
cmp bpl, 2
je 0x14002005b
mov ecx, ebp
mov edx, r12d
call fcn.140068cb2
cmp r13b, 2
jne 0x14002006b
call fcn.14006cdd9
jmp 0x14001ffa5
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
call qword [rax + 0x18]
mov rcx, rsi
call fcn.14006fc55
test r13b, r13b
jne 0x140020567
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400200a1
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x18]
cmp qword [rsp + 0x80], 0
je 0x14001ff19
lea rcx, [rsp + 0x80]
call fcn.1400043ad
jmp 0x14001ff19
mov rax, qword [rsp + 0x188]
lock inc qword [rax]
jle 0x1400208a5
xorps xmm0, xmm0
lea rcx, [rsp + 0xa8]
movups xmmword [rcx], xmm0
mov qword [rsp + 0x80], rax
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 8
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0xb8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rcx
cmp qword [rsp + 0x38], rax
jne 0x14002088a
mov qword [rsp + 0x38], 0xffffffffffffffff
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1400208a5
mov qword [rsp + 0x38], 0
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], rsi
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xa8]
cmp eax, 1
je 0x140020230
test eax, eax
jne 0x140020898
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0x60]
lea rdx, [0x140067986]
call fcn.1400645a7
mov byte [rdi + 0xa8], 1
lea rdi, [rsp + 0x40]
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x90]
mov qword [rsp + 0x78], rcx
mov qword [rax + 0x90], rsi
mov rax, qword [rdi - 0x10]
lea rcx, [rax + 0x10]
mov byte [rax + 0xc0], 1
lea rdx, [0x1400b5810]
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xe8], rcx
lea rcx, [rsp + 0x70]
mov qword [rcx], r14
lea r14, [0x140067986]
xor ecx, ecx
xchg byte [rax + 0xc0], cl
test cl, cl
je 0x1400203c5
cmp qword [rsp + 0x38], 0
jne 0x14002088a
mov qword [rsp + 0x38], 0xffffffffffffffff
cmp qword [rsp + 0x40], 0
je 0x1400202cf
mov rcx, rdi
call fcn.1400045d1
mov rax, qword [rsp + 0x38]
inc rax
jmp 0x1400202d1
xor eax, eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xa8]
test eax, eax
je 0x140020314
cmp eax, 1
je 0x14002033e
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x70]
call fcn.1400208a9
mov ebp, eax
jmp 0x140020387
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov r15, qword [rcx + rax*8]
lea rcx, [r15 + 0x60]
mov rdx, r14
call fcn.1400645a7
mov byte [r15 + 0xa8], 1
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r12b, byte [rax + 0xa4]
mov r13b, byte [rax + 0xa5]
mov word [rax + 0xa4], 0x8001
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x70]
call fcn.1400208a9
mov ebp, eax
mov ecx, r12d
mov edx, r13d
call fcn.140068cb2
cmp qword [rsp + 0x38], 0
jne 0x14002088a
mov qword [rsp + 0x38], 0xffffffffffffffff
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1400208a5
mov qword [rsp + 0x38], 0
test bpl, bpl
je 0x140020864
mov r8, qword [rsp + 0x30]
mov r15d, dword [r8 + 0x58]
test r15d, r15d
je 0x140020518
cmp byte [r12 + 0x68], 0
jne 0x14002057b
inc dword [r12 + 0x60]
mov rdx, qword [rsp + 0x30]
add rdx, 0x10
mov rcx, r12
call fcn.14006ceb2
test rax, rax
je 0x140020534
cmp qword [rsp + 0x38], 0
jne 0x14002088a
mov r13, rax
mov qword [rsp + 0x38], 0xffffffffffffffff
cmp qword [rsp + 0x40], 0
je 0x140020434
mov rcx, rdi
call fcn.1400045d1
mov rax, qword [rsp + 0x38]
inc rax
jmp 0x140020436
xor eax, eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xa8]
cmp eax, 1
je 0x140020492
mov bpl, 2
test eax, eax
jne 0x1400204bc
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov r12, qword [rcx + rax*8]
lea rcx, [r12 + 0x60]
mov rdx, r14
call fcn.1400645a7
mov byte [r12 + 0xa8], 1
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov bpl, byte [rax + 0xa4]
mov r12b, byte [rax + 0xa5]
mov word [rax + 0xa4], 0x8001
mov rax, qword [r13 + 0x10]
mov rcx, r13
call qword [rax]
cmp bpl, 2
je 0x1400204d5
mov ecx, ebp
mov edx, r12d
call fcn.140068cb2
cmp qword [rsp + 0x38], 0
jne 0x14002088a
mov qword [rsp + 0x38], 0xffffffffffffffff
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1400208a5
mov qword [rsp + 0x38], 0
dec r15d
jne 0x1400203d7
mov r8, qword [rsp + 0x30]
add r8, 0x10
mov rcx, rsi
mov rdx, r12
call fcn.14006d985
mov r12, rax
mov rax, qword [rsp + 0x30]
jmp 0x140020290
movabs rax, 0x7fffffffffffffff
cmp qword [rsp + 0x48], rax
jae 0x14002088a
mov r8, qword [rsp + 0x30]
add r8, 0x10
cmp qword [rsp + 0x60], 0
jne 0x14002051c
mov rcx, rsi
mov rdx, r12
call fcn.14006cf4a
jmp 0x140020527
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400205e9
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x18]
jmp 0x1400205e9
cmp qword [rsp + 0x38], 0
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x90], rcx
mov sil, 1
jne 0x14002088a
mov qword [rsp + 0x38], 0xffffffffffffffff
cmp qword [rsp + 0x40], 0
je 0x1400205cc
mov rcx, rdi
call fcn.1400045d1
mov rax, qword [rsp + 0x38]
inc rax
jmp 0x1400205ce
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rcx + 0x10], r12
mov qword [rcx + 8], rax
call fcn.1400043ad
test sil, sil
jne 0x1400208a5
test rbx, rbx
jne 0x140020606
cmp qword [rsp + 0x80], 0
je 0x140020606
lea rcx, [rsp + 0x80]
call fcn.1400043ad
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xa8]
cmp eax, 1
je 0x14002065a
test eax, eax
jne 0x1400208a5
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rsi, qword [rcx + rax*8]
lea rcx, [rsi + 0x60]
lea rdx, [0x140067986]
call fcn.1400645a7
mov byte [rsi + 0xa8], 1
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0xa6], 2
je 0x1400208a5
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0xa6], 2
cmp dword [rax + 0x98], 0
jne 0x1400206a2
call fcn.140068e1b
lea rcx, [rsp + 0x108]
mov rax, qword [rcx + 0x10]
mov edx, dword [0x1400f5b90]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov dword [rdx + 0x98], 1
mov qword [rdx + 0x9c], rax
call fcn.14000433d
cmp byte [rsp + 0x170], 3
jne 0x140020700
cmp byte [rsp + 0x168], 3
jne 0x140020700
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x128]
call fcn.140004476
lea rcx, [rsp + 0x178]
call fcn.14000433d
mov rsi, qword [rsp + 0x100]
test rsi, rsi
je 0x140020746
mov rax, qword [rsp + 0xf0]
mov rcx, rsi
shl rcx, 4
lea rdi, [rcx + rax]
add rdi, 0xfffffffffffffff8
mov rcx, qword [rdi - 8]
mov rdx, qword [rdi]
call case.0x14002f30d.2134
add rdi, 0xfffffffffffffff0
dec rsi
jne 0x140020731
xor ebx, ebx
mov qword [rsp + 0x100], rbx
lea r14, [rsp + 0x120]
lea rsi, [rsp + 0x188]
mov ecx, 9
mov rdi, r14
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x128]
mov rcx, rsi
xor edx, edx
call fcn.14006e06c
mov rcx, r14
call fcn.14006f022
xchg qword [rsi + 0x10], rbx
test rbx, rbx
je 0x140020796
mov rcx, rbx
call fcn.140067fed
mov rax, qword [rsp + 0x120]
lock dec qword [rax]
jne 0x1400207b1
lea rcx, [rsp + 0x120]
call fcn.140066efe
mov rcx, rsi
mov edx, 0x3b9aca00
call fcn.14006e06c
mov rax, qword [rsp + 0x128]
lock dec qword [rax]
jne 0x1400207d4
mov rcx, rsi
call fcn.140067193
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x14002083b
mov rsi, qword [rcx + 0x30]
mov rdx, rsi
or rdx, 4
mov rax, rsi
lock cmpxchg qword [rcx + 0x30], rdx
mov rsi, rax
jne 0x1400207e5
mov eax, esi
and eax, 0xa
cmp eax, 8
jne 0x14002080f
mov rax, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x130]
test sil, 2
jne 0x140020824
test rax, rax
jne 0x140020828
jmp 0x14002083b
mov byte [rax + 0x38], 0
lock dec qword [rax]
jne 0x14002083b
mov rcx, qword [rsp + 0x130]
call fcn.140067136
lea rcx, [rsp + 0xf0]
call fcn.1400033c2
movaps xmm6, xmmword [rsp + 0x230]
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x1400f5b90]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x90], rcx
xor esi, esi
jmp 0x1400205a9
call fcn.140064158
ud2
call fcn.140066ca7
ud2
lea rcx, [rsp + 0xd0]
call fcn.1400045d1
ud2