Function at 0x58fe10
Capabilities:
Enumerate processes on remote desktop session host
Get session information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x288
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
dec esi
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x26c], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ebx, eax
lea edi, [ebp - 0x25c]
mov dword [edi + 8], esi
mov dword [edi], 0x6b8a18
xor eax, eax
mov dword [edi + 4], eax
mov byte [edi + 8], 0
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x268], eax
mov esi, edi
shr esi, 0xe
mov eax, edi
shr eax, 0x13
mov dword [ebp - 0x28c], eax
mov eax, dword [eax*4 + 0x74ac68]
bt eax, esi
jae 0x590127
push edi
call fcn.004f6930
add esp, 4
mov dword [ebp - 0x264], edi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x590649
mov al, 1
mov byte [ebp - 0x254], al
lea edi, [ebp - 0x268]
mov byte [edi + 8], al
lea eax, [ebp - 0x284]
push eax
push edi
push 8
mov dword [ebp - 0x288], ebx
push ebx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov edi, dword [edi + 4]
test edi, edi
je 0x590107
cmp byte [edi + 8], 0
je 0x59064c
mov ebx, eax
mov eax, dword [edi + 4]
test eax, eax
setne dl
mov ecx, dword [ebp - 0x268]
cmp eax, ecx
sete dh
and dh, dl
cmp dh, 1
je 0x590641
test eax, eax
je 0x58ff18
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [ebp - 0x268]
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x264]
mov byte [eax + 8], 0
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x74ac68]
bt edx, ecx
jae 0x58ff44
push eax
call fcn.004f6a60
add esp, 4
test ebx, ebx
je 0x590100
cmp dword [ebp - 0x284], 4
jne 0x59064f
mov eax, dword [ebp - 0x258]
cmp dword [eax], 0
sete bl
mov dword [ebp - 0x25c], 0x6b8a18
cmp byte [ebp - 0x254], 1
je 0x590646
mov dword [ebp - 0x294], esi
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x58ff92
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov edi, dword [ebp - 0x288]
shr edi, 8
xor esi, esi
mov eax, 0
mov cl, 1
test bl, bl
cmovne eax, edi
lea ebx, [ebp - 0x25c]
jne 0x5901a7
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x25c], 0x6b8a18
mov dword [ebp - 0x258], esi
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x268], esi
mov eax, dword [ebp - 0x28c]
mov eax, dword [eax*4 + 0x74ac68]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x590110
push ebx
call fcn.004f6930
add esp, 4
mov dword [ebp - 0x264], ebx
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x590655
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
xor ebx, ebx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x268]
push eax
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov esi, eax
mov edi, dword [ebp - 0x264]
test edi, edi
je 0x59009f
cmp byte [edi + 8], 0
je 0x590658
mov eax, dword [edi + 4]
test eax, eax
setne dl
mov ecx, dword [ebp - 0x268]
cmp eax, ecx
sete dh
and dh, dl
cmp dh, 1
je 0x590641
test eax, eax
je 0x590092
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [ebp - 0x268]
mov dword [edi + 4], ecx
mov ebx, dword [ebp - 0x264]
mov byte [ebx + 8], 0
mov eax, ebx
shr eax, 0xe
mov ecx, ebx
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x74ac68]
bt ecx, eax
jae 0x5900be
push ebx
call fcn.004f6a60
add esp, 4
test esi, esi
je 0x59014e
mov eax, dword [ebp - 0x284]
test eax, eax
lea ebx, [ebp - 0x25c]
je 0x590164
mov ecx, dword [ebp - 0x258]
add ecx, 8
cmp dword [ecx], 0
je 0x59013e
add ecx, 0xc
dec eax
jne 0x5900e3
mov dword [ebp - 0x288], 0
mov edi, dword [ebp - 0x290]
jmp 0x590170
xor ebx, ebx
jmp 0x58ff65
mov ebx, eax
xor eax, eax
jmp 0x58ff25
mov eax, ebx
shr eax, 0x15
mov byte [eax + 0x752c68], 1
mov dword [ebp - 0x264], ebx
jmp 0x590027
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x752c68], 1
mov dword [ebp - 0x264], edi
jmp 0x58feaa
mov edi, dword [ecx - 8]
mov dword [ebp - 0x288], edi
shr edi, 8
mov al, 1
jmp 0x590172
xor edi, edi
mov dword [ebp - 0x288], 0
xor eax, eax
lea ebx, [ebp - 0x25c]
jmp 0x590172
xor edi, edi
mov dword [ebp - 0x288], 0
xor eax, eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x25c], 0x6b8a18
cmp byte [ebp - 0x254], 1
je 0x590652
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x59019f
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
xor esi, esi
mov ecx, dword [ebp - 0x28c]
mov dword [ebp - 0x28c], edi
mov edi, ecx
lea ecx, [ebp - 0x284]
push 0x6c8b14
call fcn.004de950
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x26c], esi
mov eax, edi
test al, al
je 0x590311
mov ecx, dword [ebp - 0x28c]
shl ecx, 8
movzx eax, byte [ebp - 0x288]
or eax, ecx
mov dword [ebp - 0x288], eax
push 0x24c
push 0xff
push ebx
call fcn.00544260
add esp, 0xc
xor edi, edi
mov ecx, ebx
push edi
push edi
lea eax, [ebp - 0x284]
push eax
call fcn.005bac40
lea esi, [ebp - 0x268]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea edi, [ebp - 0x278]
jmp 0x59023c
mov ecx, esi
push edi
call fcn.0047ed50
mov dword [ebp - 0x264], eax
mov ecx, ebx
call fcn.005babe0
test eax, eax
je 0x59026d
mov ecx, dword [eax + 8]
mov dword [ebp - 0x278], ecx
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x260]
jae 0x59022e
test eax, eax
je 0x5903ff
mov dword [eax], ecx
add eax, 4
jmp 0x590236
lea ecx, [ebp - 0x25c]
call fcn.005baca0
mov ebx, dword [ebp - 0x268]
mov esi, dword [ebp - 0x264]
jmp 0x5902a1
lea ecx, [ebp - 0x274]
lea eax, [ebp - 0x25c]
push eax
call fcn.0047ed50
mov dword [ebp - 0x270], eax
add ebx, 4
cmp ebx, esi
je 0x5902fe
mov dword [ebp - 0x25c], 0xffffffff
mov eax, dword [ebx]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x278], 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x59029e
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x278], eax
jne 0x59029e
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x26c]
jae 0x590286
test eax, eax
je 0x5903ff
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
add eax, 4
jmp 0x590298
lea ecx, [ebp - 0x25c]
lea eax, [ebp - 0x268]
mov dword [ecx], eax
call fcn.004dee20
cmp byte [ebp - 0x279], 0
jns 0x590328
push dword [ebp - 0x284]
call fcn.00540380
add esp, 4
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x270]
je 0x5903dd
mov ebx, dword [eax]
lea eax, [ebp - 0x274]
lea esi, [ebp - 0x25c]
mov dword [esi], eax
mov ecx, esi
call fcn.004dee20
push ebx
push 1
push 0x440
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebx, [ebp - 0x284]
mov dword [ebx], 0
mov ecx, ebx
push eax
call fcn.004dee60
mov eax, dword [ebx]
inc eax
cmp eax, 1
ja 0x59040e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov dword [edi], eax
mov dword [edi + 0xc], 2
mov eax, dword [ebp - 0x284]
inc eax
cmp eax, 2
jb 0x5903c6
call fcn.004f2b80
push dword [ebp - 0x284]
call fcn.004e4b30
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, edi
add esp, 0x288
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x274]
lea ecx, [ebp - 0x25c]
mov dword [ecx], eax
call fcn.004dee20
mov dword [edi], 0x8000ffff
mov dword [edi + 0xc], 2
jmp 0x5903c6
push 0x6bd165
push 0x6bd0bf
call fcn.0057cbd0
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - fcn.00579c10], 0x6b8a0c
xor eax, eax
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x268], eax
mov eax, esi
shr eax, 0xe
mov ecx, esi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x74ac68]
bt ecx, eax
jae 0x590477
push esi
call fcn.004f6930
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
lea ebx, [ebp - 0x268]
je 0x59048f
jmp 0x59065e
mov eax, esi
shr eax, 0x15
mov byte [eax + 0x752c68], 1
mov dword [ebp - 0x264], esi
lea ebx, [ebp - 0x268]
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
push ebx
push 0xa
push dword [ebp - 0x284]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
mov ecx, ebx
call fcn.00579b50
test esi, esi
jne 0x59050f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov dword [edi], eax
mov dword [edi + 0xc], 2
mov dword [ebp - fcn.00579c10], 0x6b8a0c
cmp byte [ebp - 0x254], 1
je 0x59065b
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x5903a7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5903a7
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - fcn.00579c10], 0x6b8a0c
xor eax, eax
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x274], eax
mov eax, ebx
shr eax, 0xe
mov ecx, ebx
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x74ac68]
bt ecx, eax
jae 0x590578
push ebx
call fcn.004f6930
add esp, 4
mov dword [ebp - 0x270], ebx
mov byte [ebp - 0x26c], 0
test byte [ebp - 0x260], 1
lea ebx, [ebp - 0x274]
je 0x590590
jmp 0x590664
mov eax, ebx
shr eax, 0x15
mov byte [eax + 0x752c68], 1
mov dword [ebp - 0x270], ebx
lea ebx, [ebp - 0x274]
mov al, 1
mov byte [ebp - 0x260], al
mov byte [ebp - 0x26c], al
mov eax, dword [ebp - 0x258]
sub esp, 0x18
mov dword [esp + 0x14], ebx
movaps xmm0, xmmword [0x6c8660]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
mov ecx, ebx
call fcn.00579b50
test esi, esi
je 0x59061e
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x264], 0
mov dword [edi + 4], eax
mov byte [edi + 8], 0
xor ecx, ecx
inc ecx
mov eax, 0x6b8a0c
mov dword [edi], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - fcn.00579c10], 0x6b8a0c
cmp byte [ebp - 0x260], 1
je 0x590661
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x5904de
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5904de
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov ecx, 2
jmp 0x5905ec
call fcn.0055487f
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3