Function at 0x140001690
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
lea rax, [rbp - 0x18]
lea r9, [rbp - 0x20]
mov qword [rbp - 0x20], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r14d, edi
lea r8d, [rdi + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x140001756
mov ebx, edi
cmp dword [rbp - 0x18], ebx
jbe 0x140001741
nop dword [rax]
mov eax, ebx
lea rdx, str.VirtualBoxVM.exe
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
lea rsi, [rcx*8]
mov rcx, qword [rsi + rax + 8]
call fcn.140003d04
test rax, rax
jne 0x140001721
inc ebx
cmp ebx, dword [rbp - 0x18]
jb 0x1400016f0
jmp 0x140001741
mov rax, qword [rbp - 0x20]
lea rcx, str.____Process_active:__s_with_PID__d_n
mov r8d, dword [rsi + rax + 4]
mov rdx, qword [rsi + rax + 8]
call fcn.140001310
mov r14d, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test r14d, r14d
jne 0x140001964
jmp 0x140001774
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.err:__d_n
call fcn.140001430
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor edx, edx
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x18]
xor ecx, ecx
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r14d, edi
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x140001920
mov ebx, edi
cmp dword [rbp - 0x18], ebx
jbe 0x140001801
nop word [rax + rax]
mov eax, ebx
lea rdx, str.VirtualBox.exe
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
lea rsi, [rcx*8]
mov rcx, qword [rsi + rax + 8]
call fcn.140003d04
test rax, rax
jne 0x1400017e1
inc ebx
cmp ebx, dword [rbp - 0x18]
jb 0x1400017b0
jmp 0x140001801
mov rax, qword [rbp - 0x20]
lea rcx, str.____Process_active:__s_with_PID__d_n
mov r8d, dword [rsi + rax + 4]
mov rdx, qword [rsi + rax + 8]
call fcn.140001310
mov r14d, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test r14d, r14d
je 0x14000193e
lea rcx, str.____VirtualBox_process_active_n
call fcn.140001430
lea rcx, str.____Trying_to_exit_virtualbox_by_postmessage_close_window_n
call fcn.140001430
lea rdx, str.Oracle_VM_VirtualBox_Manager
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, str.____Letting_VBoxSDS_exit__wait_12_seconds__n_n
call fcn.140001430
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x18]
xor ecx, ecx
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x1400018f4
mov ebx, edi
cmp dword [rbp - 0x18], ebx
jbe 0x1400018e0
nop
mov eax, ebx
lea rdx, str.VBoxSDS.exe
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
lea rsi, [rcx*8]
mov rcx, qword [rsi + rax + 8]
call fcn.140003d04
test rax, rax
jne 0x1400018c1
inc ebx
cmp ebx, dword [rbp - 0x18]
jb 0x140001890
jmp 0x1400018e0
mov rax, qword [rbp - 0x20]
lea rcx, str.____Process_active:__s_with_PID__d_n
mov r8d, dword [rsi + rax + 4]
mov rdx, qword [rsi + rax + 8]
call fcn.140001310
mov edi, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test edi, edi
jne 0x14000197b
jmp 0x140001912
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.err:__d_n
call fcn.140001430
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea rcx, str.___Success_stopping_vboxsds__n
call fcn.140001430
jmp 0x14000193e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.err:__d_n
call fcn.140001430
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140002f30
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
lea rcx, str.____You_seem_to_have_active_VMs_running__please_stop_them_before_running_this_to_prevent_corruption_of_any_saved_data_of_the_VMs._n
call fcn.140001430
mov ecx, 1
call fcn.140005594
int3
lea rcx, str.____error_stopping_vboxsds_n
call fcn.140001430
mov ecx, 1
call fcn.140005594
int3