Function at 0x180005ce0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov rax, qword [0x1800cf380]
xor rax, rbp
mov qword [rbp - 8], rax
mov ecx, dword [0x1800d2c3c]
mov eax, dword [0x1800d2c38]
mov edx, ecx
add edx, 0x9b34b9b2
sub edx, 1
sub edx, 0x9b34b9b2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [rbp - 0x32], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [rbp - 0x31], al
mov dword [rbp - 0x38], 0x7fd044ec
mov eax, dword [rbp - 0x38]
mov dword [rbp - 0x3c], eax
sub eax, 0x883863d9
je 0x180006294
jmp 0x180005d4f
mov eax, dword [rbp - 0x3c]
sub eax, 0x95500456
je 0x180006417
jmp 0x180005d62
mov eax, dword [rbp - 0x3c]
sub eax, 0x96aef799
je 0x180006071
jmp 0x180005d75
mov eax, dword [rbp - 0x3c]
sub eax, 0x98c62e25
je 0x180005fb4
jmp 0x180005d88
mov eax, dword [rbp - 0x3c]
sub eax, 0x9a900a6b
je 0x1800062a0
jmp 0x180005d9b
mov eax, dword [rbp - 0x3c]
sub eax, 0xacf33c89
je 0x1800065b2
jmp 0x180005dae
mov eax, dword [rbp - 0x3c]
sub eax, 0xb6e25bd2
je 0x1800065ec
jmp 0x180005dc1
mov eax, dword [rbp - 0x3c]
sub eax, 0xb85a552c
je 0x180006130
jmp 0x180005dd4
mov eax, dword [rbp - 0x3c]
sub eax, 0xc097e95e
je 0x18000638f
jmp 0x180005de7
mov eax, dword [rbp - 0x3c]
sub eax, 0xc4e9f963
je 0x18000627c
jmp 0x180005dfa
mov eax, dword [rbp - 0x3c]
sub eax, 0xcd3d2afe
je 0x180006216
jmp 0x180005e0d
mov eax, dword [rbp - 0x3c]
sub eax, 0xd15f1782
je 0x1800064c8
jmp 0x180005e20
mov eax, dword [rbp - 0x3c]
sub eax, 0xddba7d81
je 0x180006667
jmp 0x180005e33
mov eax, dword [rbp - 0x3c]
sub eax, 0xe84d4758
je 0x1800064b0
jmp 0x180005e46
mov eax, dword [rbp - 0x3c]
sub eax, 0xeac3bda0
je 0x18000659a
jmp 0x180005e59
mov eax, dword [rbp - 0x3c]
sub eax, 0xf2376c01
je 0x18000669a
jmp 0x180005e6c
mov eax, dword [rbp - 0x3c]
sub eax, 0xf3f607ef
je 0x180006658
jmp 0x180005e7f
mov eax, dword [rbp - 0x3c]
sub eax, 0xe904b6
je 0x1800065c9
jmp 0x180005e92
mov eax, dword [rbp - 0x3c]
sub eax, 0x74dcaa5
je 0x18000639b
jmp 0x180005ea5
mov eax, dword [rbp - 0x3c]
sub eax, 0xf5b5ace
je 0x1800061fb
jmp 0x180005eb8
mov eax, dword [rbp - 0x3c]
sub eax, 0x13998f29
je 0x180006321
jmp 0x180005ecb
mov eax, dword [rbp - 0x3c]
sub eax, 0x39baea1c
je 0x1800064bc
jmp 0x180005ede
mov eax, dword [rbp - 0x3c]
sub eax, 0x3d08fadb
je 0x180006673
jmp 0x180005ef1
mov eax, dword [rbp - 0x3c]
sub eax, 0x51291cb4
je 0x1800065a6
jmp 0x180005f04
mov eax, dword [rbp - 0x3c]
sub eax, 0x56e444b2
je 0x1800061b1
jmp 0x180005f17
mov eax, dword [rbp - 0x3c]
sub eax, 0x5c32ec32
je 0x1800060c7
jmp 0x180005f2a
mov eax, dword [rbp - 0x3c]
sub eax, 0x5c8675a3
je 0x18000607d
jmp 0x180005f3d
mov eax, dword [rbp - 0x3c]
sub eax, 0x5f542f83
je 0x180006512
jmp 0x180005f50
mov eax, dword [rbp - 0x3c]
sub eax, 0x67a0a4a7
je 0x180006124
jmp 0x180005f63
mov eax, dword [rbp - 0x3c]
sub eax, 0x77994a84
je 0x1800066be
jmp 0x180005f76
mov eax, dword [rbp - 0x3c]
sub eax, 0x7fd044ec
je 0x180005f8e
jmp 0x180005f89
jmp 0x1800066cc
mov al, byte [rbp - 0x32]
mov cl, byte [rbp - 0x31]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6e25bd2
mov ecx, 0x98c62e25
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov eax, 0x10
mov qword [rbp - 0x48], rax
call fcn.180095140
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.180095140
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.180095140
sub rsp, rax
mov r9, rsp
mov rax, qword [rbp - 0x28]
mov dword [rax], 0
mov qword [r9], 0
mov rax, qword [rbp - 0x28]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
mov dword [rbp - 0x20], eax
mov eax, dword [0x1800d2c3c]
mov ecx, dword [0x1800d2c38]
mov edx, eax
add edx, 0xaacfb876
sub edx, 1
sub edx, 0xaacfb876
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb6e25bd2
mov ecx, 0x96aef799
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov dword [rbp - 0x38], 0x5c8675a3
jmp 0x1800066cc
mov eax, dword [0x1800d2c3c]
mov ecx, dword [0x1800d2c38]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3f607ef
mov ecx, 0x5c32ec32
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov eax, dword [rbp - 0x20]
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x1a], al
mov eax, dword [0x1800d2c3c]
mov ecx, dword [0x1800d2c38]
mov edx, eax
add edx, 0x79616530
sub edx, 1
sub edx, 0x79616530
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3f607ef
mov ecx, 0x67a0a4a7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov dword [rbp - 0x38], 0xb85a552c
jmp 0x1800066cc
mov ecx, dword [0x1800d2c3c]
mov eax, dword [0x1800d2c38]
mov edx, ecx
sub edx, 0x513a7d06
sub edx, 1
add edx, 0x513a7d06
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xddba7d81
mov ecx, 0x56e444b2
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov eax, dword [0x1800d2c3c]
mov ecx, dword [0x1800d2c38]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xddba7d81
mov ecx, 0xf5b5ace
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov dl, byte [rbp - 0x1a]
mov eax, 0x9a900a6b
mov ecx, 0xcd3d2afe
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
lea rcx, [0x1800d0900]
lea rdx, [0x1800bb4a8]
sub rsp, 0x20
call fcn.18000f680
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x28]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.180012850
add rsp, 0x20
mov rcx, rax
lea rdx, [0x1800134c0]
sub rsp, 0x20
call fcn.180013430
add rsp, 0x20
mov rax, qword [rbp - 0x28]
cmp dword [rax], 0x82
setbe al
and al, 1
mov byte [rbp - 0x19], al
mov dword [rbp - 0x38], 0xc4e9f963
jmp 0x1800066cc
mov rax, qword [rbp - 0x30]
mov cl, byte [rbp - 0x19]
and cl, 1
mov byte [rax], cl
mov dword [rbp - 0x38], 0x883863d9
jmp 0x1800066cc
mov dword [rbp - 0x38], 0xacf33c89
jmp 0x1800066cc
mov ecx, dword [0x1800d2c3c]
mov eax, dword [0x1800d2c38]
mov edx, ecx
sub edx, 0x3eafa1fd
sub edx, 1
add edx, 0x3eafa1fd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3d08fadb
mov ecx, 0x13998f29
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
lea rcx, [0x1800d0a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.18000f680
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov eax, dword [0x1800d2c3c]
mov ecx, dword [0x1800d2c38]
mov edx, eax
sub edx, 0x1f428a45
sub edx, 1
add edx, 0x1f428a45
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3d08fadb
mov ecx, 0xc097e95e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov dword [rbp - 0x38], 0x74dcaa5
jmp 0x1800066cc
mov ecx, dword [0x1800d2c3c]
mov eax, dword [0x1800d2c38]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2376c01
mov ecx, 0x95500456
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov rcx, qword [rbp - 0x18]
lea rdx, [0x1800134c0]
sub rsp, 0x20
call fcn.180013430
add rsp, 0x20
mov ecx, dword [0x1800d2c3c]
mov eax, dword [0x1800d2c38]
mov edx, ecx
add edx, 0x1d79d362
sub edx, 1
sub edx, 0x1d79d362
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf2376c01
mov ecx, 0xe84d4758
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov dword [rbp - 0x38], 0x39baea1c
jmp 0x1800066cc
mov dword [rbp - 0x38], 0xd15f1782
jmp 0x1800066cc
mov eax, dword [0x1800d2c3c]
mov ecx, dword [0x1800d2c38]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x77994a84
mov ecx, 0x5f542f83
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov rax, qword [rbp - 0x30]
mov byte [rax], 1
mov ecx, dword [0x1800d2c3c]
mov eax, dword [0x1800d2c38]
mov edx, ecx
sub edx, 0x360fdace
sub edx, 1
add edx, 0x360fdace
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x77994a84
mov ecx, 0xeac3bda0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x1800066cc
mov dword [rbp - 0x38], 0x51291cb4
jmp 0x1800066cc
mov dword [rbp - 0x38], 0xacf33c89
jmp 0x1800066cc
mov rax, qword [rbp - 0x30]
mov al, byte [rax]
and al, 1
mov byte [rbp - 9], al
mov dword [rbp - 0x38], 0xe904b6
jmp 0x1800066cc
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov dword [rbp - 0x4c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.1800951a0
mov eax, dword [rbp - 0x4c]
mov rsp, rbp
pop rbp
ret
mov eax, 0x10
mov qword [rbp - 0x60], rax
call fcn.180095140
sub rsp, rax
mov rax, qword [rbp - 0x60]
call fcn.180095140
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp - 0x58], rcx
call fcn.180095140
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov r9, rsp
mov dword [rax], 0
mov qword [r9], 0
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
mov dword [rbp - 0x38], 0x98c62e25
jmp 0x1800066cc
mov eax, dword [rbp - 0x20]
mov dword [rbp - 0x38], 0x5c32ec32
jmp 0x1800066cc
mov dword [rbp - 0x38], 0x56e444b2
jmp 0x1800066cc
lea rcx, [0x1800d0a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.18000f680
add rsp, 0x20
mov dword [rbp - 0x38], 0x13998f29
jmp 0x1800066cc
mov rcx, qword [rbp - 0x18]
lea rdx, [0x1800134c0]
sub rsp, 0x20
call fcn.180013430
add rsp, 0x20
mov dword [rbp - 0x38], 0x95500456
jmp 0x1800066cc
mov rax, qword [rbp - 0x30]
mov byte [rax], 1
mov dword [rbp - 0x38], 0x5f542f83
jmp 0x180005d39