Function at 0x140006030
Capabilities:
Check if file exists
Enumerate processes
Get file attributes
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
mov rbx, rdx
mov ecx, dword [rdx + 4]
call fcn.140004d20
test eax, eax
jne 0x140006085
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x14000628e
mov eax, dword [rbx + 4]
lea r9, str.ulEventType___d__SessionId___u__Memory_could_not_be_allocated_for_this_session.
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x60004007
mov dword [rsp + 0x20], edi
call fcn.1400065c0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
sub edi, 1
je 0x1400061aa
sub edi, 1
je 0x14000613d
sub edi, 3
je 0x1400060f0
cmp edi, 1
jne 0x14000628e
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x1400060c4
mov r9d, dword [rbx + 4]
lea r8, str.WTS_SESSION_LOGOFF:_session_id__u
lea edx, [rdi + 3]
call fcn.1400067e0
mov edx, dword [rbx + 4]
mov rcx, qword [0x140075cd0]
call fcn.1400033b0
mov ecx, dword [rbx + 4]
mov rax, qword [0x140075d20]
and dword [rax + rcx*4], 0xfffffffd
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140004030
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x140006111
mov r9d, dword [rbx + 4]
lea r8, str.WTS_SESSION_LOGON:_session_id__u
mov edx, 4
call fcn.1400067e0
mov ecx, dword [rbx + 4]
xor r8d, r8d
mov rax, qword [0x140075d20]
mov edx, 0x100
or dword [rax + rcx*4], 2
mov rcx, qword [0x140075cd0]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140002cc0
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x14000615e
mov r9d, dword [rbx + 4]
lea r8, str.WTS_CONSOLE_DISCONNECT:_session_id__u
mov edx, 4
call fcn.1400067e0
mov rcx, qword [0x140075cd0]
mov edx, 0xffffffff
call fcn.140003790
mov eax, dword [rbx + 4]
mov rcx, qword [0x140075d20]
test byte [rcx + rax*4], 2
jne 0x140006197
mov rcx, qword [0x140075cd0]
mov edx, eax
call fcn.1400033b0
mov eax, dword [rbx + 4]
mov rcx, qword [0x140075d20]
and dword [rcx + rax*4], 0xfffffffe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140004030
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x1400061cb
mov r9d, dword [rbx + 4]
lea r8, str.WTS_CONSOLE_CONNECT:_session_id__u
mov edx, 4
call fcn.1400067e0
mov edx, dword [rbx + 4]
mov rcx, qword [0x140075cd0]
call fcn.140003790
mov edx, dword [rbx + 4]
mov rax, qword [0x140075d20]
mov ecx, dword [rax + rdx*4]
dec ecx
cmp ecx, 1
jbe 0x140006266
mov rcx, qword [0x140075cd0]
call fcn.1400033f0
test eax, eax
jne 0x140006237
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x14000628e
mov eax, dword [rbx + 4]
lea r9, str.Create_client_event_failed_for_session_id_u.
mov edx, 0x60004003
mov dword [rsp + 0x20], eax
mov r8d, 1
call fcn.1400065c0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rbx + 4]
call fcn.140004b90
test eax, eax
je 0x14000628e
mov ecx, dword [rbx + 4]
mov rax, qword [0x140075d20]
or dword [rax + rcx*4], 1
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x14000628e
lea r8, str.Client_started_for_session_id__u
jmp 0x140006280
mov ecx, edx
call fcn.140003ca0
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x14000628e
lea r8, str.Client_already_started_for_session_id__u
mov r9d, dword [rbx + 4]
mov edx, 4
call fcn.1400067e0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret