Function at 0x180091480
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
xor esi, esi
test rcx, rcx
mov rbx, rcx
je 0x1800914a0
mov eax, dword [0x1801b3320]
mov dword [rcx], eax
mov eax, dword [0x1801b3324]
test al, 1
je 0x1800914bc
and eax, 2
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
or eax, 1
mov qword [rsp + 0x50], r12
mov ecx, 0x8000
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov dword [0x1801b3324], eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, eax
mov r12d, eax
bts ecx, 0xf
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbp, rax
je 0x1800915eb
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r13, rax
je 0x1800915eb
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x1800915eb
lea rdx, str.RegOpenKeyA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1801b3308], rax
je 0x1800915eb
lea rdx, str.RegQueryValueExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1801b3310], rax
je 0x1800915eb
lea rdx, str.RegCloseKey
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1801b3318], rax
je 0x1800915eb
call fcn.18008f700
mov r14d, 1
test eax, eax
je 0x180091629
lea rdx, str.ProcessIdToSessionId
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x18009173e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1801b3320]
mov ecx, eax
call rdi
test eax, eax
je 0x18009173e
cmp dword [0x1801b3320], esi
jne 0x18009173e
test rbx, rbx
je 0x1800915f6
mov dword [rbx], 0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x1800916ab
lea rdx, str.WTSQuerySessionInformationA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbp, rax
je 0x1800916ab
lea rdx, str.WTSFreeMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x1800916ab
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8d, [rcx + 4]
mov edx, 0xffffffff
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x1800916ab
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
mov dword [0x1801b3320], eax
cmp dword [rcx], esi
cmovne esi, r14d
call rdi
test esi, esi
jne 0x18009173e
lea rcx, str.wfapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x1800915eb
lea rdx, str.WFQuerySessionInformationA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbp, rax
je 0x1800915eb
lea rdx, str.WFFreeMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x1800915eb
xor ecx, ecx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8d, [rcx + 4]
mov edx, 0xffffffff
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x1800915eb
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
mov dword [0x1801b3320], eax
cmp dword [rcx], 0
cmovne esi, r14d
call rdi
test esi, esi
je 0x1800915eb
lea rdx, str.GetSystemMetrics
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180091762
mov ecx, 0x1000
call rax
test eax, eax
je 0x1800915eb
test rbx, rbx
je 0x18009176f
mov ecx, dword [0x1801b3320]
mov dword [rbx], ecx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or dword [0x1801b3324], 2
mov eax, r14d
jmp 0x180091601