Function at 0x140005f30
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x420
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rsi, rdx
mov qword [rsp + 0x68], rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x48], r15d
movdqa xmm0, xmmword [0x1400241e0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r15w
mov dword [rdx], r15d
xor edx, edx
lea r8d, [r15 + 0x20]
lea rcx, [rbp + 0xc0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x4c], 0x20
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x5c], r15d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x100]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movdqa xmm0, xmmword [0x1400241e0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r15w
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov r14d, r15d
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
xor edx, edx
lea r8d, [r15 + 0x20]
lea rcx, [rbp + 0xe0]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x70], 0x20
test rdi, rdi
je 0x140006466
cmp dword [rdi], r15d
je 0x140006466
cmp qword [rdi + 0x870], r15
ja 0x140006046
lea esi, [r15 + 0xd]
jmp 0x14000646b
mov eax, dword [rdi + 0x62c]
mov dword [rsp + 0x44], eax
test eax, eax
je 0x1400062cd
lea rdx, str.sedplugins.dll
lea rcx, [rbp - 0x60]
call fcn.14001434c
mov dword [rsp + 0x40], eax
test eax, eax
js 0x1400062cd
lea rcx, [rdi + 0x860]
cmp qword [rcx + 0x18], 8
jb 0x140006085
mov rcx, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [0x14001d8ec]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstok_s]
test rax, rax
je 0x1400060dc
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140009378
nop
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x78]
call fcn.1400080dc
nop
lea rcx, [rbp - 0x20]
call fcn.14000a404
lea r8, [rbp - 0x70]
lea rdx, [0x14001d8ec]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstok_s]
test rax, rax
jne 0x14000609b
mov r14, qword [rbp - 0x78]
mov rax, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x78]
sub rax, rbx
sar rax, 5
cmp rax, 4
je 0x140006105
mov esi, 0xd
mov dword [rsp + 0x40], esi
mov rsi, qword [rsp + 0x68]
jmp 0x1400062d2
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006112
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov r12d, eax
lea rcx, [rbx + 0x20]
cmp qword [rcx + 0x18], 8
jb 0x14000612e
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov r15d, eax
lea rcx, [rbx + 0x40]
cmp qword [rcx + 0x18], 8
jb 0x14000614a
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov esi, eax
lea rcx, [rbx + 0x60]
cmp qword [rcx + 0x18], 8
jb 0x140006165
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul]
mov r13d, eax
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
call fcn.140008ce4
mov dword [rsp + 0x40], eax
test eax, eax
js 0x1400062c3
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
lea r8, [rsp + 0x4c]
lea rdx, [rbp + 0xc0]
call fcn.140017b38
mov dword [rsp + 0x40], eax
test eax, eax
js 0x1400062c3
lea rcx, [rdi + 0x820]
cmp qword [rcx + 0x18], 8
jb 0x1400061e7
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe0]
xor edx, edx
lea r8d, [rdx + 0xc]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov dword [rsp + 0x40], eax
test eax, eax
js 0x1400062c3
mov r8d, dword [rsp + 0x4c]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xe0]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
xor ecx, ecx
test eax, eax
setne cl
mov dword [rsp + 0x60], ecx
mov r9d, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x58]
mov r10d, dword [rsp + 0x5c]
test ecx, ecx
je 0x14000627e
cmp r9d, r12d
jb 0x140006274
jne 0x140006262
cmp r8d, r15d
jb 0x140006274
cmp r8d, r15d
jne 0x14000626b
cmp edx, esi
jb 0x140006274
cmp edx, esi
jne 0x14000627e
cmp r10d, r13d
jae 0x14000627e
mov eax, 1
xor r15d, r15d
jmp 0x140006284
xor r15d, r15d
mov eax, r15d
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea r8, str._u._u._u._u
mov edx, 0x104
lea rcx, [rbp + 0x100]
call fcn.140002db0
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x40]
call fcn.1400092d4
jmp 0x1400060fb
mov rsi, qword [rsp + 0x68]
xor r15d, r15d
jmp 0x1400062d2
mov rbx, qword [rsp + 0x78]
cmp dword [rsp + 0x44], r15d
je 0x1400062e5
cmp dword [rsp + 0x48], r15d
mov eax, 1
jne 0x1400062e8
mov eax, r15d
mov dword [rsi], eax
call fcn.140008b98
mov rdi, rax
cmp dword [rax], 1
jbe 0x140006460
movabs rax, 0x800000000001
test qword [rdi + 0x10], rax
je 0x140006460
mov rcx, qword [rdi + 0x18]
and rcx, rax
cmp rcx, qword [rdi + 0x18]
jne 0x140006460
lea rax, str.2019.2B
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 8
call fcn.140008378
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 8
call fcn.140008500
lea rdx, [0x14001d6ec]
mov rcx, r15
or r8, 0xffffffffffffffff
test rax, rax
je 0x140006375
mov rdx, rax
mov rcx, r8
inc rcx
cmp byte [rax + rcx], r15b
jne 0x14000636c
mov qword [rbp + 0x40], rdx
lea eax, [rcx + 1]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], r15d
lea rax, str.SedimentPackSelfUpdater
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0x18
lea rax, [rsp + 0x40]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 4
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], 4
lea rax, [rsp + 0x44]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 4
lea rax, [rsp + 0x60]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 4
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [0x14001d6f0]
mov rax, r15
test rcx, rcx
je 0x14000640e
mov rdx, rcx
mov rax, r8
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140006404
mov qword [rbp + 0xa0], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 0xa8], eax
mov dword [rbp + 0xac], r15d
lea rax, [rsp + 0x48]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], 4
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc
lea rdx, [0x140025872]
mov rcx, rdi
call fcn.140001078
mov esi, dword [rsp + 0x40]
jmp 0x140006470
mov esi, 0x80070057
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x1400064da
mov rdi, rbx
cmp rbx, qword [rbp - 0x80]
je 0x140006490
mov rcx, rdi
call fcn.14000a404
add rdi, 0x20
cmp rdi, qword [rbp - 0x80]
jne 0x14000647e
sub r14, rbx
sar r14, 5
mov rcx, rbx
movabs rax, 0x7ffffffffffffff
cmp r14, rax
ja 0x140006519
shl r14, 5
cmp r14, 0x1000
jb 0x1400064d1
test cl, 0x1f
jne 0x140006519
mov rbx, qword [rbx - 8]
cmp rbx, rcx
jae 0x140006519
sub rcx, rbx
sub rcx, 8
cmp rcx, 0x1f
ja 0x140006519
mov rcx, rbx
call fcn.140018814
nop
lea rcx, [rbp - 0x40]
call fcn.14000a404
nop
lea rcx, [rbp - 0x60]
call fcn.14000a404
mov eax, esi
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140018830
mov rbx, qword [rsp + 0x470]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop