Function at 0x6166a0
Capabilities:
Enumerate processes on remote desktop session host
Get session information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x288
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
dec esi
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x26c], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ebx, eax
lea edi, [ebp - 0x25c]
mov dword [edi + 8], esi
mov dword [edi], 0x777118
xor eax, eax
mov dword [edi + 4], eax
mov byte [edi + 8], 0
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x268], eax
mov ecx, edi
shr ecx, 0xe
mov eax, edi
shr eax, 0x13
mov dword [ebp - 0x290], eax
mov eax, dword [eax*4 + 0x81756c]
mov dword [ebp - 0x294], ecx
bt eax, ecx
jae 0x616994
push edi
call fcn.004bee90
add esp, 4
mov dword [ebp - 0x264], edi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x616e9f
mov al, 1
mov byte [ebp - 0x254], al
lea edi, [ebp - 0x268]
mov byte [edi + 8], al
lea eax, [ebp - 0x284]
push eax
push edi
push 8
push ebx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov esi, eax
mov edi, dword [edi + 4]
test edi, edi
je 0x616986
cmp byte [edi + 8], 0
je 0x616ea2
mov ecx, dword [edi + 4]
test ecx, ecx
setne dl
mov eax, dword [ebp - 0x268]
cmp ecx, eax
sete dh
and dh, dl
cmp dh, 1
je 0x616e97
test ecx, ecx
je 0x6167a8
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x268]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x264]
mov byte [eax + 8], 0
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x81756c]
bt edx, ecx
jae 0x6167d4
push eax
call fcn.004befb0
add esp, 4
test esi, esi
je 0x61698d
cmp dword [ebp - 0x284], 4
jne 0x616ea5
mov eax, dword [ebp - 0x258]
cmp dword [eax], 0
sete cl
mov dword [ebp - 0x25c], 0x777118
cmp byte [ebp - 0x254], 1
je 0x616e9c
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x616820
push eax
mov edi, ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, edi
mov dword [ebp - 0x288], ebx
mov esi, ebx
shr esi, 8
xor edi, edi
mov eax, 0
mov bl, 1
test cl, cl
cmovne eax, esi
jne 0x616a1b
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x25c], 0x777118
mov dword [ebp - 0x258], edi
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x268], edi
mov eax, dword [ebp - 0x290]
mov eax, dword [eax*4 + 0x81756c]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x6169ab
lea esi, [ebp - 0x25c]
push esi
call fcn.004bee90
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x616eab
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
xor ebx, ebx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x268]
push eax
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov esi, eax
mov edi, dword [ebp - 0x264]
test edi, edi
je 0x61692f
cmp byte [edi + 8], 0
je 0x616eae
mov ecx, dword [edi + 4]
test ecx, ecx
setne dl
mov eax, dword [ebp - 0x268]
cmp ecx, eax
sete dh
and dh, dl
cmp dh, 1
je 0x616e97
test ecx, ecx
je 0x616922
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x268]
mov dword [edi + 4], eax
mov ebx, dword [ebp - 0x264]
mov byte [ebx + 8], 0
mov eax, ebx
shr eax, 0xe
mov ecx, ebx
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x81756c]
bt ecx, eax
jae 0x61694e
push ebx
call fcn.004befb0
add esp, 4
test esi, esi
je 0x6169d8
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x6169d8
mov ecx, dword [ebp - 0x258]
add ecx, 8
cmp dword [ecx], 0
je 0x6169c8
add ecx, 0xc
dec eax
jne 0x616969
mov dword [ebp - 0x288], 0
mov esi, dword [ebp - 0x28c]
jmp 0x6169e4
xor eax, eax
jmp 0x6167b5
xor ecx, ecx
jmp 0x6167f5
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x81f56c], 1
mov dword [ebp - 0x264], edi
jmp 0x616740
lea ecx, [ebp - 0x25c]
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x81f56c], 1
mov dword [ebp - 0x264], ecx
jmp 0x6168b7
mov esi, dword [ecx - 8]
mov dword [ebp - 0x288], esi
shr esi, 8
mov al, 1
jmp 0x6169e6
xor esi, esi
mov dword [ebp - 0x288], 0
xor eax, eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x25c], 0x777118
cmp byte [ebp - 0x254], 1
je 0x616ea8
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x616a13
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
xor edi, edi
mov ebx, dword [ebp - 0x28c]
lea ecx, [ebp - 0x284]
push str.EXPLORER.EXE
call fcn.005372d0
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x26c], edi
test bl, bl
je 0x616b4c
shl esi, 8
movzx eax, byte [ebp - 0x288]
or eax, esi
mov dword [ebp - 0x288], eax
push 0x24c
push 0xff
lea eax, [ebp - 0x25c]
push eax
call fcn.005cced0
add esp, 0xc
xor edi, edi
lea ecx, [ebp - 0x25c]
push edi
push edi
lea eax, [ebp - 0x284]
push eax
call fcn.00643620
lea esi, [ebp - 0x268]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea edi, [ebp - 0x25c]
lea ebx, [ebp - 0x278]
jmp 0x616ab3
mov eax, dword [eax + 8]
mov dword [ebp - 0x278], eax
mov ecx, esi
push ebx
call fcn.0049c1d0
mov ecx, edi
call fcn.006435c0
test eax, eax
jne 0x616aa2
lea ecx, [ebp - 0x25c]
call fcn.00643680
mov esi, dword [ebp - 0x268]
mov edi, dword [ebp - 0x264]
cmp esi, edi
jne 0x616af4
jmp 0x616b28
lea ecx, [ebp - 0x274]
lea eax, [ebp - 0x25c]
push eax
call fcn.0049c0f0
add esi, 4
cmp esi, edi
je 0x616b22
mov eax, dword [esi]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x278], 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x616aed
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x278], eax
je 0x616adb
jmp 0x616aed
mov esi, dword [ebp - 0x268]
test esi, esi
je 0x616b4c
mov eax, dword [ebp - 0x264]
cmp eax, esi
je 0x616b3d
add eax, 0xfffffffc
jne 0x616b32
jmp 0x616b8c
mov dword [ebp - 0x264], esi
push esi
call fcn.005c8b90
add esp, 4
cmp byte [ebp - 0x279], 0
jns 0x616b63
push dword [ebp - 0x284]
call fcn.005c8b90
add esp, 4
mov esi, dword [ebp - 0x274]
mov ebx, dword [ebp - 0x270]
cmp esi, ebx
je 0x616b8e
mov ecx, dword [esi]
mov edi, ecx
and edi, 0xffffff00
test esi, esi
je 0x616baf
mov eax, ebx
cmp eax, esi
je 0x616b94
add eax, 0xfffffffc
jne 0x616b83
ud2
xor edi, edi
xor ecx, ecx
jmp 0x616b7d
mov dword [ebp - 0x270], esi
push esi
mov dword [ebp - 0x288], ecx
call fcn.005c8b90
mov ecx, dword [ebp - 0x288]
add esp, 4
mov eax, dword [ebp + 8]
cmp esi, ebx
je 0x616c48
mov ebx, eax
movzx eax, cl
or eax, edi
push eax
push 1
push 0x440
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea esi, [ebp - 0x284]
mov dword [esi], 0
mov ecx, esi
push eax
call fcn.005375e0
mov eax, dword [esi]
inc eax
cmp eax, 1
ja 0x616c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov esi, ebx
mov dword [ebx], eax
mov dword [ebx + 0xc], 2
mov eax, dword [ebp - 0x284]
inc eax
cmp eax, 2
jb 0x616c31
call fcn.005613d0
push dword [ebp - 0x284]
call fcn.0054cbb0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x288
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [eax], 0x8000ffff
mov dword [eax + 0xc], 2
mov esi, eax
jmp 0x616c31
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - fcn.00603700], 0x77710c
xor eax, eax
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x290]
mov eax, dword [eax*4 + 0x81756c]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x616cca
lea esi, [ebp - 0x25c]
push esi
call fcn.004bee90
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
lea edi, [ebp - 0x268]
je 0x616ce8
jmp 0x616eb4
lea ecx, [ebp - 0x25c]
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x81f56c], 1
mov dword [ebp - 0x264], ecx
lea edi, [ebp - 0x268]
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
push edi
push 0xa
push dword [ebp - 0x284]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
mov ecx, edi
call fcn.00603650
test esi, esi
jne 0x616d6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov esi, ebx
mov dword [ebx], eax
mov dword [ebx + 0xc], 2
mov dword [ebp - fcn.00603700], 0x77710c
cmp byte [ebp - 0x254], 1
je 0x616eb1
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x616c12
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x616c12
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - fcn.00603700], 0x77710c
xor eax, eax
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x274], eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x81756c]
bt ecx, eax
jae 0x616dcd
push edi
call fcn.004bee90
add esp, 4
mov dword [ebp - 0x270], edi
mov byte [ebp - 0x26c], 0
test byte [ebp - 0x260], 1
je 0x616ddf
jmp 0x616eba
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x81f56c], 1
mov dword [ebp - 0x270], edi
mov al, 1
mov byte [ebp - 0x260], al
lea esi, [ebp - 0x274]
mov byte [esi + 8], al
mov eax, dword [ebp - 0x258]
sub esp, 0x18
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x786a50]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
mov ecx, esi
call fcn.00603650
test edi, edi
je 0x616e72
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x264], 0
mov esi, ebx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
xor ecx, ecx
inc ecx
mov eax, 0x77710c
mov dword [esi], eax
mov dword [esi + 0xc], ecx
mov dword [ebp - fcn.00603700], 0x77710c
cmp byte [ebp - 0x260], 1
je 0x616eb7
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x616d39
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x616d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov ecx, 2
mov esi, ebx
jmp 0x616e40
call fcn.005de1d9
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3