Function at 0x50fa30
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x50fa6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 0x60c5e8
jmp 0x50facc
mov esi, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
test esi, esi
je 0x50fa97
mov eax, edx
nop word [eax + eax]
cmp dword [eax + 8], 0
movq xmm0, qword [eax]
movq qword [ebp - 0x1c], xmm0
je 0x50fae4
inc ecx
add eax, 0xc
cmp ecx, esi
jb 0x50fa80
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61f218]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x61e990]
cmp eax, dword [ecx + 8]
jg 0x50fc2a
jmp 0x50fabc
mov edx, dword [ebp - 0x10]
mov esi, 1
push edx
mov ebx, 0x60c5f8
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [edi + 4], ebx
mov eax, edi
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x50fa5d
mov ecx, dword [ebp - 0xc]
xor esi, esi
test ecx, ecx
je 0x50fb43
mov edx, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp edx, dword [ebx + eax]
jne 0x50fb3b
mov eax, dword [ebx + eax + 8]
test eax, eax
je 0x50fb3b
push eax
push str.explorer.exe
call fcn.0055ed96
add esp, 8
test eax, eax
je 0x50fb6d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
inc esi
add ebx, 0x10
cmp esi, ecx
jb 0x50fb13
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61f218]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x61e990]
cmp eax, dword [ecx + 8]
jg 0x50fc74
push dword [ebp - 0x10]
xor esi, esi
jmp 0x50fac2
mov eax, dword [ebp - 0x10]
add esi, esi
push eax
mov esi, dword [eax + esi*8 + 4]
call sub.WTSAPI32.dll_WTSFreeMemory
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x50fbb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], 0x60c5e8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x50fbd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x50fbf4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x50fbee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x50fbf4
mov dword [edi], 0
mov eax, dword [ebp - 8]
mov dword [edi + 4], 0x60c5e8
test eax, eax
je 0x50fc10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
push 0x61e990
call fcn.00553e6b
add esp, 4
cmp dword [0x61e990], 0xffffffff
jne 0x50fab9
push 0x59fa90
mov dword [0x60c5fc], 0x60c5f8
mov dword [vtable.._AVimpersonation_error_category__1__make_error_code__A0x9a1c86aa__YA_AVerror_code_std__W4impersonation_error_2__Z_.0], 0x5a6874
call fcn.005541ad
push 0x61e990
call fcn.00553e21
add esp, 8
jmp 0x50fab9
push 0x61e990
call fcn.00553e6b
add esp, 4
cmp dword [0x61e990], 0xffffffff
jne 0x50fb63
push 0x59fa90
mov dword [0x60c5fc], 0x60c5f8
mov dword [vtable.._AVimpersonation_error_category__1__make_error_code__A0x9a1c86aa__YA_AVerror_code_std__W4impersonation_error_2__Z_.0], 0x5a6874
call fcn.005541ad
push 0x61e990
call fcn.00553e21
add esp, 8
jmp 0x50fb63