Function at 0x100182c0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acf1f
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x10018625
mov dword [ebp - 0x1c], 0
jmp 0x10018329
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
ja 0x10018625
push 0x100
mov eax, dword [ebp - 0x1c]
shl eax, 4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax + 8]
push edx
lea eax, [ebp - 0x31c]
push eax
call fcn.1005edd4
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + ecx + 4]
push eax
call fcn.100176b0
add esp, 8
test eax, eax
je 0x10018395
lea eax, [ebp - 0x21c]
push eax
push str.W_s
lea ecx, [ebp - 0x11c]
push ecx
call fcn.100074e0
add esp, 0xc
jmp 0x100183b0
lea eax, [ebp - 0x31c]
push eax
push str.B_s
lea ecx, [ebp - 0x11c]
push ecx
call fcn.100074e0
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x10018477
push 0x88
call fcn.100211dc
add esp, 4
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x3b0], 0
je 0x100183f0
mov ecx, dword [ebp - 0x3b0]
call fcn.10014800
mov dword [ebp - 0x3c4], eax
jmp 0x100183fa
mov dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp - 0x320], ecx
mov eax, 0x6e
mov ecx, dword [ebp - 0x320]
mov word [ecx + 4], ax
xor eax, eax
mov ecx, dword [ebp - 0x320]
mov word [ecx + 6], ax
push 0x100b2974
call fcn.1004be70
add esp, 4
push eax
push 0x100b2974
mov eax, dword [ebp - 0x320]
add eax, 8
push eax
call fcn.1003ff50
add esp, 0xc
mov eax, dword [ebp - 0x320]
movsx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x320]
push edx
call fcn.10018d70
add esp, 8
jmp 0x10018620
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x10018540
push 0x88
call fcn.100211dc
add esp, 4
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x3b8], 0
je 0x100184b9
mov ecx, dword [ebp - 0x3b8]
call fcn.10014800
mov dword [ebp - 0x3c4], eax
jmp 0x100184c3
mov dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp - 0x324], ecx
mov eax, 0x14a
mov ecx, dword [ebp - 0x324]
mov word [ecx + 4], ax
xor eax, eax
mov ecx, dword [ebp - 0x324]
mov word [ecx + 6], ax
push 0x100b2974
call fcn.1004be70
add esp, 4
push eax
push 0x100b2974
mov eax, dword [ebp - 0x324]
add eax, 8
push eax
call fcn.1003ff50
add esp, 0xc
mov eax, dword [ebp - 0x324]
movsx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x324]
push edx
call fcn.10018d70
add esp, 8
jmp 0x10018620
cmp dword [ebp - 0x1c], 1
jb 0x10018620
mov eax, dword [ebp - 0x14]
add eax, 1
cmp dword [ebp - 0x1c], eax
jae 0x10018620
push 0x88
call fcn.100211dc
add esp, 4
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x3c0], 0
je 0x1001858f
mov ecx, dword [ebp - 0x3c0]
call fcn.10014800
mov dword [ebp - 0x3c4], eax
jmp 0x10018599
mov dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp - 0x328], ecx
mov eax, 0xdc
mov ecx, dword [ebp - 0x328]
mov word [ecx + 4], ax
lea eax, [ebp - 0x11c]
push eax
call fcn.1004be70
add esp, 4
add eax, 1
mov ecx, dword [ebp - 0x328]
mov word [ecx + 6], ax
mov eax, dword [ebp - 0x328]
movsx ecx, word [eax + 6]
push ecx
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x328]
add eax, 8
push eax
call fcn.1003ff50
add esp, 0xc
mov eax, dword [ebp - 0x328]
movsx ecx, word [eax]
push ecx
mov edx, dword [ebp - 0x328]
push edx
call fcn.10018d70
add esp, 8
jmp 0x10018320
cmp dword [ebp - 0x18], 0
je 0x1001863b
mov eax, dword [ebp - 0x18]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret