Function at 0x180028190
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov r12, rdx
mov r13, rcx
xor ebx, ebx
mov dword [rbp + 0x77], ebx
mov dword [rbp + 0x7f], ebx
mov qword [rbp - 0x59], rbx
xor r15b, r15b
xor dil, dil
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x59]
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x180028441
mov esi, ebx
cmp dword [rbp + 0x7f], ebx
jbe 0x180028441
nop dword [rax]
mov eax, esi
lea rcx, [rax + rax*2]
lea r14, [rcx*8]
mov r8, qword [rbp - 0x59]
mov r8, qword [r14 + r8 + 0x10]
lea rdx, [rbp - 0x51]
mov rcx, r13
call fcn.180028cb0
nop
or r8d, 0xffffffff
mov rdx, qword [rbp - 0x59]
mov rdx, qword [r14 + rdx + 8]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x77]
call fcn.1800280c0
nop
or ebx, 1
mov dword [rbp + 0x77], ebx
mov rdx, rax
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
test al, al
jne 0x1800282b0
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x77]
call fcn.180028140
nop
or ebx, 2
mov dword [rbp + 0x77], ebx
mov rdx, rax
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
test al, al
jne 0x1800282b0
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x77]
call fcn.180028100
nop
or ebx, 4
mov dword [rbp + 0x77], ebx
mov rdx, rax
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
test al, al
jne 0x1800282b0
mov dil, 1
jmp 0x1800282b3
xor dil, dil
test bl, 4
je 0x1800282c9
and ebx, 0xfffffffb
mov dword [rbp + 0x77], ebx
lea rcx, [rbp - 0x21]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
test bl, 2
je 0x1800282df
and ebx, 0xfffffffd
mov dword [rbp + 0x77], ebx
lea rcx, [rbp - 0x11]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
test bl, 1
je 0x1800282f1
and ebx, 0xfffffffe
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test dil, dil
je 0x180028403
mov edx, 0xc
lea rcx, str.explorer.exe
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::toLower_void____ptr64]
mov rdi, rax
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::toLower_void____ptr64]
nop
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
movzx edi, al
lea rcx, [rbp - 9]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test dil, dil
je 0x180028403
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 7]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::debug_void____ptr64]
nop
lea rdx, str.check_has_explorer
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x29]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
mov rdx, qword [rbp - 0x59]
add rdx, r14
mov rcx, r13
call fcn.180029790
test eax, eax
jne 0x180028403
mov rax, qword [rbp - 0x59]
mov ecx, dword [r14 + rax + 4]
cmp dword [r12], ecx
je 0x180028424
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 7]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rbp - 0x19]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::debug_void____ptr64]
nop
lea rdx, str.check_other_active_explorer
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x19]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
mov r15b, 1
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
inc esi
cmp esi, dword [rbp + 0x7f]
jae 0x18002843e
jmp 0x180028200
mov dil, 1
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
jmp 0x180028441
xor dil, dil
mov rcx, qword [rbp - 0x59]
call sub.WTSAPI32.dll_WTSFreeMemory
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 7]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rbp + 0x77]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::debug_void____ptr64]
nop
lea rdx, str.check_active
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
mov rcx, rax
movzx edx, dil
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___bool____ptr64]
mov rcx, rax
movzx edx, r15b
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___bool____ptr64]
nop
lea rcx, [rbp + 0x77]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
test dil, dil
jne 0x1800284ad
test r15b, r15b
je 0x1800284ad
xor al, al
jmp 0x1800284af
mov al, 1
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret