Function at 0x1400060c0
Capabilities:
Check if file exists
Enumerate processes
Get file attributes
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
mov rbx, rdx
mov ecx, dword [rdx + 4]
call fcn.140004d50
test eax, eax
jne 0x140006115
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x14000632c
mov eax, dword [rbx + 4]
lea r9, str.ulEventType___d__SessionId___u__Memory_could_not_be_allocated_for_this_session.
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x60004007
mov dword [rsp + 0x20], edi
call fcn.140006660
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
sub edi, 1
je 0x14000623a
sub edi, 1
je 0x1400061cd
sub edi, 3
je 0x140006180
cmp edi, 1
jne 0x14000632c
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x140006154
mov r9d, dword [rbx + 4]
lea r8, str.WTS_SESSION_LOGOFF:_session_id__u
lea edx, [rdi + 3]
call fcn.140006880
mov edx, dword [rbx + 4]
mov rcx, qword [0x140086ce8]
call fcn.1400033e0
mov ecx, dword [rbx + 4]
mov rax, qword [0x140086d30]
and dword [rax + rcx*4], 0xfffffffd
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140004060
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x1400061a1
mov r9d, dword [rbx + 4]
lea r8, str.WTS_SESSION_LOGON:_session_id__u
mov edx, 4
call fcn.140006880
mov ecx, dword [rbx + 4]
xor r8d, r8d
mov rax, qword [0x140086d30]
mov edx, 0x100
or dword [rax + rcx*4], 2
mov rcx, qword [0x140086ce8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140002c80
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x1400061ee
mov r9d, dword [rbx + 4]
lea r8, str.WTS_CONSOLE_DISCONNECT:_session_id__u
mov edx, 4
call fcn.140006880
mov rcx, qword [0x140086ce8]
mov edx, 0xffffffff
call fcn.1400037c0
mov eax, dword [rbx + 4]
mov rcx, qword [0x140086d30]
test byte [rcx + rax*4], 2
jne 0x140006227
mov rcx, qword [0x140086ce8]
mov edx, eax
call fcn.1400033e0
mov eax, dword [rbx + 4]
mov rcx, qword [0x140086d30]
and dword [rcx + rax*4], 0xfffffffe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140004060
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x14000625b
mov r9d, dword [rbx + 4]
lea r8, str.WTS_CONSOLE_CONNECT:_session_id__u
mov edx, 4
call fcn.140006880
mov edx, dword [rbx + 4]
mov rcx, qword [0x140086ce8]
call fcn.1400037c0
mov eax, dword [0x140086d3c]
mov edi, 1
cmp eax, 4
cmove eax, edi
mov dword [0x140086d3c], eax
mov edx, dword [rbx + 4]
mov rax, qword [0x140086d30]
mov ecx, dword [rax + rdx*4]
dec ecx
cmp ecx, edi
jbe 0x140006304
mov rcx, qword [0x140086ce8]
call fcn.140003420
test eax, eax
jne 0x1400062d6
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x14000632c
mov eax, dword [rbx + 4]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov r8d, edi
mov dword [rsp + 0x20], eax
mov edx, 0x60004003
call fcn.140006660
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rbx + 4]
call fcn.140004bc0
test eax, eax
je 0x14000632c
mov ecx, dword [rbx + 4]
mov rax, qword [0x140086d30]
or dword [rax + rcx*4], edi
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x14000632c
lea r8, str.Client_started_for_session_id__u
jmp 0x14000631e
mov ecx, edx
call fcn.140003cd0
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x14000632c
lea r8, str.Client_already_started_for_session_id__u
mov r9d, dword [rbx + 4]
mov edx, 4
call fcn.140006880
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret