Function at 0x1400184a0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1400d7090]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rbx, r8
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rcx
mov qword [r11 - 0xa0], rbx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [r11 - 0xa8], r15
mov dword [r11 - 0x78], r15d
lea rdx, [0x1400c8dfc]
lea rcx, [r11 - 0x70]
call fcn.140007450
nop
lea rdx, [0x1400c8dfc]
lea rcx, [rsp + 0x90]
call fcn.140007450
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor edx, edx
xor ecx, ecx
lea r8d, [r15 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
mov rsi, qword [rsp + 0xd0]
test eax, eax
je 0x1400189f8
mov eax, r15d
movabs rdx, 0x7ffffffffffffffe
mov dword [rsp + 0x34], eax
cmp eax, dword [rsp + 0xb0]
jae 0x1400189f3
lea rcx, [rax + rax*2]
lea r12, [rcx*8]
mov rax, qword [rsp + 0x80]
mov r14, qword [r12 + rax + 8]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1400185a0
cmp rbx, rsi
ja 0x1400185e8
lea rdi, [rsp + 0xb8]
cmp rsi, 8
cmovae rdi, qword [rsp + 0xb8]
mov qword [rsp + 0xc8], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.140074000
mov word [rbx + rdi], r15w
jmp 0x1400186aa
cmp rbx, rdx
ja 0x140018b45
mov rdi, rbx
or rdi, 7
cmp rdi, rdx
jbe 0x140018602
mov rdi, rdx
jmp 0x140018623
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x140018618
mov rdi, rdx
jmp 0x140018623
lea rax, [rcx + rsi]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0xb8]
call fcn.14000bef0
mov r15, rax
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], rdi
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.140074000
xor eax, eax
mov word [rbx + r15], ax
cmp rsi, 8
jb 0x14001869f
lea rdx, [rsi*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001869a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b4b
call fcn.14001d650
mov qword [rsp + 0xb8], r15
xor r15d, r15d
mov rax, qword [rsp + 0x80]
mov r14, qword [r12 + rax + 8]
mov r13, qword [rsp + 0xa0]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [r14 + rdi*2], 0
jne 0x1400186d0
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, rdi
jb 0x140018b51
lea r12, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae r12, qword [rsp + 0x90]
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], r15
lea r15, [rdi + r13]
mov ebx, 7
lea rsi, [rsp + 0xd8]
cmp r15, rbx
jbe 0x1400187d6
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14001875f
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14001878f
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140018b56
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400187bb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140018b5b
mov rcx, rax
call fcn.14001d8c0
test rax, rax
je 0x140018b67
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400187ce
test rcx, rcx
je 0x1400187ca
call fcn.14001d8c0
mov rsi, rax
jmp 0x1400187ce
xor eax, eax
mov esi, eax
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], rbx
lea rbx, [r13*2]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.140074000
lea rcx, [rbx + rsi]
lea r8, [rdi + rdi]
mov rdx, r14
call fcn.140074000
xor eax, eax
mov word [rsi + r15*2], ax
mov r14d, dword [rsp + 0x30]
or r14d, 2
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
sub rax, rdi
cmp rax, 3
jb 0x140018882
lea rax, [rdi + 3]
mov qword [rsp + 0xe8], rax
lea rbx, [rsp + 0xd8]
cmp rcx, 8
cmovae rbx, qword [rsp + 0xd8]
lea rcx, [rbx + rdi*2]
mov r8d, 6
lea rdx, [0x1400c9690]
call fcn.140074000
xor r15d, r15d
mov word [rbx + rdi*2 + 6], r15w
lea rax, [rsp + 0xd8]
jmp 0x1400188a9
mov qword [rsp + 0x20], 3
lea r9, [0x1400c9690]
xor r8d, r8d
lea edx, [r8 + 3]
lea rcx, [rsp + 0xd8]
call fcn.14000b030
xor r15d, r15d
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r14d, 4
mov dword [rsp + 0x30], r14d
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x140018925
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018916
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b61
call fcn.14001d650
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm1
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
jb 0x14001897d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b67
call fcn.14001d650
mov rbx, qword [rsp + 0x40]
cmp dword [rsp + 0x38], 1
jne 0x140018a7b
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001899a
mov rax, qword [rbx]
lea r8, [rsp + 0xb8]
mov rsi, qword [rsp + 0xd0]
cmp rsi, 8
cmovae r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc8]
cmp rdx, qword [rbx + 0x10]
jne 0x140018a69
test rdx, rdx
je 0x1400189e9
sub r8, rax
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x140018a69
add rax, 2
sub rdx, 1
jne 0x1400189d1
mov dword [0x1400da450], 1
mov rdi, qword [rsp + 0x48]
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0xa0]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], r15w
cmp rsi, 8
jb 0x140018a93
lea rdx, [rsi*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b6d
jmp 0x140018a8e
mov dword [0x1400da450], r15d
mov eax, dword [rsp + 0x34]
inc eax
jmp 0x14001855c
mov rsi, qword [rsp + 0xd0]
mov eax, dword [rsp + 0x34]
inc eax
jmp 0x14001855c
call fcn.14001d650
mov qword [rsp + 0xc8], r15
mov qword [rsp + 0xd0], 7
mov word [rsp + 0xb8], r15w
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140018aeb
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140018ae6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140018b3f
mov rcx, r8
call fcn.14001d650
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rax, rdi
jmp 0x140018b12
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.14001d630
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14007c430
nop
call fcn.1400016b0
nop
call fcn.14007c430
int3
call fcn.1400016b0
call fcn.140001610
call fcn.140001610
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
int3