Function at 0x1400018e0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
lea rax, [rbp - 0x18]
lea r9, [rbp - 0x20]
mov qword [rbp - 0x20], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r14d, edi
lea r8d, [rdi + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x1400019a6
mov ebx, edi
cmp dword [rbp - 0x18], ebx
jbe 0x140001991
nop dword [rax]
mov eax, ebx
lea rdx, str.VirtualBoxVM.exe
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
lea rsi, [rcx*8]
mov rcx, qword [rsi + rax + 8]
call fcn.140003564
test rax, rax
jne 0x140001971
inc ebx
cmp ebx, dword [rbp - 0x18]
jb 0x140001940
jmp 0x140001991
mov rax, qword [rbp - 0x20]
lea rcx, str.____Process_active:__s_with_PID__d_n
mov r8d, dword [rsi + rax + 4]
mov rdx, qword [rsi + rax + 8]
call fcn.140001260
mov r14d, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test r14d, r14d
jne 0x140001bb4
jmp 0x1400019c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.err:__d_n
call fcn.140001380
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor edx, edx
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x18]
xor ecx, ecx
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r14d, edi
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x140001b70
mov ebx, edi
cmp dword [rbp - 0x18], ebx
jbe 0x140001a51
nop word [rax + rax]
mov eax, ebx
lea rdx, str.VirtualBox.exe
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
lea rsi, [rcx*8]
mov rcx, qword [rsi + rax + 8]
call fcn.140003564
test rax, rax
jne 0x140001a31
inc ebx
cmp ebx, dword [rbp - 0x18]
jb 0x140001a00
jmp 0x140001a51
mov rax, qword [rbp - 0x20]
lea rcx, str.____Process_active:__s_with_PID__d_n
mov r8d, dword [rsi + rax + 4]
mov rdx, qword [rsi + rax + 8]
call fcn.140001260
mov r14d, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test r14d, r14d
je 0x140001b8e
lea rcx, str.____VirtualBox_process_active_n
call fcn.140001380
lea rcx, str.____Trying_to_exit_virtualbox_by_postmessage_close_window_n
call fcn.140001380
lea rdx, str.Oracle_VM_VirtualBox_Manager
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, str.____Letting_VBoxSDS_exit__wait_12_seconds__n_n
call fcn.140001380
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rbp - 0x20], rdi
lea rax, [rbp - 0x18]
xor ecx, ecx
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x140001b44
mov ebx, edi
cmp dword [rbp - 0x18], ebx
jbe 0x140001b30
nop
mov eax, ebx
lea rdx, str.VBoxSDS.exe
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
lea rsi, [rcx*8]
mov rcx, qword [rsi + rax + 8]
call fcn.140003564
test rax, rax
jne 0x140001b11
inc ebx
cmp ebx, dword [rbp - 0x18]
jb 0x140001ae0
jmp 0x140001b30
mov rax, qword [rbp - 0x20]
lea rcx, str.____Process_active:__s_with_PID__d_n
mov r8d, dword [rsi + rax + 4]
mov rdx, qword [rsi + rax + 8]
call fcn.140001260
mov edi, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test edi, edi
jne 0x140001bcb
jmp 0x140001b62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.err:__d_n
call fcn.140001380
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea rcx, str.___Success_stopping_vboxsds__n
call fcn.140001380
jmp 0x140001b8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.err:__d_n
call fcn.140001380
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140002790
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
lea rcx, str.____You_seem_to_have_active_VMs_running__please_stop_them_before_running_this_to_prevent_corruption_of_any_saved_data_of_the_VMs._n
call fcn.140001380
mov ecx, 1
call fcn.140004df4
int3
lea rcx, str.____error_stopping_vboxsds_n
call fcn.140001380
mov ecx, 1
call fcn.140004df4
int3