Function at 0x419500
Capabilities:
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1848
call fcn.0042a310
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1838], 1
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1828], 0
lea eax, [ebp - 0x1834]
push eax
lea ecx, [ebp - 0x1828]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x419814
mov dword [ebp - 0x182c], 0
jmp 0x419573
mov edx, dword [ebp - 0x182c]
add edx, 1
mov dword [ebp - 0x182c], edx
mov eax, dword [ebp - 0x182c]
cmp eax, dword [ebp - 0x1834]
jae 0x419814
mov ecx, dword [ebp - 0x182c]
shl ecx, 4
mov edx, dword [ebp - 0x1828]
mov eax, dword [edx + ecx + 4]
push eax
push 0
push 0x1001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1830], eax
cmp dword [ebp - 0x1830], 0
je 0x419804
mov dword [ebp - 0x183c], 0x800
lea ecx, [ebp - 0x183c]
push ecx
lea edx, [ebp - 0x1824]
push edx
push 0
mov eax, dword [ebp - 0x1830]
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x4197f7
lea ecx, [ebp - 0x1824]
push ecx
call fcn.00409ae0
add esp, 4
cmp eax, 1
jne 0x4196e2
mov edx, dword [ebp - 0x1838]
push edx
mov eax, dword [ebp - 0x1830]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x419674
mov ecx, 0xa
mov esi, 0x4506f8
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
push 0
lea ecx, [ebp - 0x1e4]
push ecx
call fcn.0042d590
add esp, 0xc
mov edx, dword [ebp - 0x182c]
shl edx, 4
mov eax, dword [ebp - 0x1828]
mov ecx, dword [eax + edx + 8]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.0042faf2
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.00407ed0
add esp, 4
jmp 0x4196ce
mov ecx, 0xa
mov esi, 0x450734
lea edi, [ebp - 0x414]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
push 0
lea ecx, [ebp - 0x3ec]
push ecx
call fcn.0042d590
add esp, 0xc
mov edx, dword [ebp - 0x182c]
shl edx, 4
mov eax, dword [ebp - 0x1828]
mov ecx, dword [eax + edx + 8]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.0042faf2
add esp, 8
lea eax, [ebp - 0x414]
push eax
call fcn.00407ed0
add esp, 4
lea ecx, [ebp - 0x1824]
push ecx
call fcn.004088e0
add esp, 4
jmp 0x4197f7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1844], esp
lea edx, [ebp - 0x1824]
push edx
call fcn.00403550
mov dword [ebp - 0x1848], eax
call fcn.0041e020
add esp, 0x18
mov dword [ebp - 0x1840], eax
cmp dword [ebp - 0x1840], 1
jne 0x4197f7
mov eax, dword [ebp - 0x1838]
push eax
mov ecx, dword [ebp - 0x1830]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x41978e
mov ecx, 0xa
mov esi, 0x450808
lea edi, [ebp - 0x61c]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
push 0
lea edx, [ebp - 0x5f4]
push edx
call fcn.0042d590
add esp, 0xc
mov eax, dword [ebp - 0x182c]
shl eax, 4
mov ecx, dword [ebp - 0x1828]
mov edx, dword [ecx + eax + 8]
push edx
lea eax, [ebp - 0x61c]
push eax
call fcn.0042faf2
add esp, 8
lea ecx, [ebp - 0x61c]
push ecx
call fcn.00407ed0
add esp, 4
jmp 0x4197e8
mov ecx, 0xa
mov esi, str.taskkill__F__T__IM
lea edi, [ebp - 0x824]
rep movsd dword es:[edi], dword [esi]
push 0x1e0
push 0
lea edx, [ebp - 0x7fc]
push edx
call fcn.0042d590
add esp, 0xc
mov eax, dword [ebp - 0x182c]
shl eax, 4
mov ecx, dword [ebp - 0x1828]
mov edx, dword [ecx + eax + 8]
push edx
lea eax, [ebp - 0x824]
push eax
call fcn.0042faf2
add esp, 8
lea ecx, [ebp - 0x824]
push ecx
call fcn.00407ed0
add esp, 4
lea edx, [ebp - 0x1824]
push edx
call fcn.004088e0
add esp, 4
mov eax, dword [ebp - 0x1830]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x465f70], 1
jne 0x41980f
jmp 0x419814
jmp 0x419564
cmp dword [ebp - 0x1828], 0
je 0x419833
mov ecx, dword [ebp - 0x1828]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x1828], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret