Function at 0x1800298d0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rsi, rdx
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x30], r13d
mov rdi, qword [sym.imp.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null]
mov qword [rsp + 0x60], rdi
mov rbx, rdi
mov qword [rsp + 0x78], rbx
mov r15d, r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
lea r8d, [r13 + 1]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
or r14d, 0xffffffff
test eax, eax
je 0x180029e33
mov eax, r13d
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x48], r13d
jbe 0x180029d92
nop dword [rax + rax]
lea rcx, [rax + rax*2]
lea r15, [rcx*8]
mov qword [rsp + 0x70], r15
mov r8, qword [rsp + 0x38]
mov r8, qword [r8 + r15 + 0x10]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp + 0xb0]
call fcn.180028cb0
nop
mov r8d, r14d
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + r15 + 8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QByteArray___cdecl_QString::toLocal8Bit_void____ptr64]
mov r14, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QByteArray___cdecl_QString::toLocal8Bit_void____ptr64]
mov rsi, rax
add r15, qword [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.Qt5Core.dll_public:_char_const____ptr64___cdecl_QByteArray::constData_void_const___ptr64]
mov r14, rax
mov rcx, rsi
call qword [sym.imp.Qt5Core.dll_public:_char_const____ptr64___cdecl_QByteArray::constData_void_const___ptr64]
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
mov qword [rsp + 0x28], r14
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
mov r9d, dword [r15 + 4]
mov r8, rsi
lea rdx, str._s_tpid_d_tsessionid_d_tuserName_s
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::debug_char_const____ptr64_const___ptr64]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QByteArray::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QByteArray::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1800280e0
nop
or r12d, 1
mov dword [rsp + 0x30], r12d
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
test al, al
jne 0x180029afb
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xc8]
call fcn.1800280a0
nop
or r12d, 2
mov dword [rsp + 0x30], r12d
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
test al, al
jne 0x180029afb
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x44]
call fcn.180028120
nop
or r12d, 4
mov dword [rsp + 0x30], r12d
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
test al, al
jne 0x180029afb
mov sil, 1
jmp 0x180029afe
xor sil, sil
test r12b, 4
je 0x180029b18
and r12d, 0xfffffffb
mov dword [rsp + 0x30], r12d
lea rcx, [rbp - 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
test r12b, 2
je 0x180029b32
and r12d, 0xfffffffd
mov dword [rsp + 0x30], r12d
lea rcx, [rbp - 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
test r12b, 1
je 0x180029b4b
and r12d, 0xfffffffe
mov dword [rsp + 0x30], r12d
lea rcx, [rbp - 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test sil, sil
je 0x180029d27
mov edx, 0xc
lea rcx, str.explorer.exe
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::toLower_void____ptr64]
mov rsi, rax
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QString::toLower_void____ptr64]
nop
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
movzx esi, al
lea rcx, [rbp - 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test sil, sil
je 0x180029d27
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::debug_void____ptr64]
mov rcx, rax
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x70]
lea rdx, str.explorer_pid_sessionid
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
mov rcx, rax
mov edx, dword [rsi + r14 + 4]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1800a8c1c]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
mov rcx, rax
mov edx, dword [rsi + r14]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
mov r9, qword [rsp + 0x38]
mov r8d, dword [rdi + 8]
btr r8d, 0x1f
movsxd rdx, dword [rdi + 4]
lea r10d, [rdx + 1]
cmp r10d, r8d
seta cl
cmp dword [rdi], 1
ja 0x180029c6c
test cl, cl
jne 0x180029c6c
mov rcx, rdx
mov rax, qword [rdi + 0x10]
lea rdx, [rax + rdx*4]
mov eax, dword [r9 + r14 + 4]
mov dword [rdx + rdi], eax
jmp 0x180029ca1
mov esi, dword [r9 + r14 + 4]
movzx eax, cl
neg al
sbb r9d, r9d
and r9d, 8
test cl, cl
cmovne r8d, r10d
lea rcx, [rsp + 0x60]
call fcn.180029f00
mov rdi, qword [rsp + 0x60]
movsxd rcx, dword [rdi + 4]
mov rax, qword [rdi + 0x10]
lea rcx, [rax + rcx*4]
mov dword [rcx + rdi], esi
inc dword [rdi + 4]
mov r9, qword [rsp + 0x38]
mov r8d, dword [rbx + 8]
btr r8d, 0x1f
movsxd rdx, dword [rbx + 4]
lea r10d, [rdx + 1]
cmp r10d, r8d
seta cl
cmp dword [rbx], 1
ja 0x180029cda
test cl, cl
jne 0x180029cda
mov rax, qword [rbx + 0x10]
lea rdx, [rax + rdx*4]
mov eax, dword [r9 + r14]
mov dword [rdx + rbx], eax
jmp 0x180029d0e
mov esi, dword [r9 + r14]
movzx eax, cl
neg al
sbb r9d, r9d
and r9d, 8
test cl, cl
cmovne r8d, r10d
lea rcx, [rsp + 0x78]
call fcn.180029f00
mov rbx, qword [rsp + 0x78]
movsxd rcx, dword [rbx + 4]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rcx*4]
mov dword [rcx + rbx], esi
inc dword [rbx + 4]
mov rsi, qword [rbp + 0xb8]
mov eax, dword [rsi]
mov rdx, qword [rsp + 0x38]
cmp dword [rdx + r14], eax
je 0x180029d5e
jmp 0x180029d2e
mov rsi, qword [rbp + 0xb8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
cmp eax, dword [rsp + 0x48]
jae 0x180029d8d
or r14d, 0xffffffff
jmp 0x180029970
mov eax, dword [rsp + 0x58]
lea rcx, [rax + rax*2]
mov r15d, dword [rdx + rcx*8 + 4]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test r15d, r15d
jne 0x180029e33
jmp 0x180029d92
mov r15d, dword [rsp + 0x40]
cmp dword [rbx + 4], 0
jle 0x180029e33
mov r14, r13
nop
lea rcx, [r14 + rdi]
mov rax, qword [rdi + 0x10]
mov r15d, dword [rcx + rax]
mov rcx, qword [rbx + 0x10]
add rcx, r14
mov eax, dword [rcx + rbx]
mov dword [rsp + 0x40], eax
mov dword [rsi], eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0xb0]
call fcn.180029790
mov esi, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::debug_void____ptr64]
nop
lea rdx, str.getsession_cur_state
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
mov rcx, rax
mov edx, esi
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
test esi, esi
je 0x180029e33
inc r13d
add r14, 4
cmp r13d, dword [rbx + 4]
mov rsi, qword [rbp + 0xb8]
jl 0x180029da0
mov rcx, qword [rsp + 0x38]
call sub.WTSAPI32.dll_WTSFreeMemory
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QMessageLogger::constructor_char_const____ptr64__int__char_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug___cdecl_QMessageLogger::debug_void____ptr64]
nop
lea rdx, str.getSession_result
mov rcx, rax
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___char_const____ptr64____ptr64]
mov rcx, rax
mov edx, r15d
call qword [sym.imp.Qt5Core.dll_public:_class_QDebug____ptr64___cdecl_QDebug::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDebug::destructor_void____ptr64]
nop
mov eax, dword [rbx]
or esi, 0xffffffff
test eax, eax
je 0x180029ea3
cmp eax, esi
je 0x180029eb6
lock dec dword [rbx]
mov rdi, qword [rsp + 0x60]
jne 0x180029eb6
mov rbx, qword [rsp + 0x78]
mov edx, 4
lea r8d, [rdx + 4]
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__]
nop
mov eax, dword [rdi]
test eax, eax
je 0x180029ece
cmp eax, 0xffffffff
je 0x180029ee0
lock xadd dword [rdi], esi
dec esi
jne 0x180029ee0
mov rdi, qword [rsp + 0x60]
mov edx, 4
lea r8d, [rdx + 4]
mov rcx, rdi
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__]
mov eax, r15d
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret