Function at 0x18000c720
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
sub rsp, 0x98
mov rax, qword [0x1800792c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
cmp dword [rsp + 0x34], 0x27
jae 0x18000d2bc
movzx r10d, byte [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0xa0], rbx
xor eax, eax
mov qword [rsp + 0xa8], rbp
mov rbp, qword [0x1800804c0]
mov qword [rsp + 0xb0], rsi
mov rsi, qword [0x1800804b8]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r12
movabs r12, 0x630464a50c0400e5
mov qword [rsp + 0x80], r13
movabs r13, 0xfa5ca7bdbeb156d3
mov qword [rsp + 0x78], r14
movabs r14, 0xb51ec083541c0643
mov qword [rsp + 0x70], r15
movabs r15, 0xcbac218c5956aaf7
mov dword [rsp + 0x40], 0x3b383935
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x54], rax
nop dword [rax]
mov rax, rbp
mov r9, rsi
nop word [rax + rax]
xor edi, edi
cmp rdi, 0x1c
jae 0x18000d2e3
movzx ebx, byte [rsp + rdi + 0x40]
mov r11d, ebx
cmp rax, rdi
ja 0x18000d2da
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x18000c852
lea rdx, [rdi + r15]
movzx ecx, r11b
and cl, dl
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x3f
add r10b, dl
jmp 0x18000c871
je 0x18000d25e
inc rcx
cmp rax, rcx
je 0x18000d211
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x18000d1bc
movzx r8d, bl
cmp r9, rdi
ja 0x18000d2d1
lea rcx, [r9 + 0x20]
cmp rax, rcx
jae 0x18000c8a3
lea rdx, [rdi + r14]
movzx ecx, r11b
and cl, dl
movzx r10d, r8b
add cl, cl
sub r10b, cl
add r10b, 0x2b
add r10b, dl
jmp 0x18000c8f1
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x18000d17f
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x18000d162
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x18000d149
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x18000d130
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x18000d111
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x18000d0ea
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x18000ce5a
nop
lea rcx, [r9 + 0x2a]
cmp rax, rcx
je 0x18000ce3d
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x18000ce1b
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x18000cdf5
lea rcx, [r9 + 0x1000]
cmp rax, rcx
je 0x18000cdd5
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x18000cdb5
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x18000cd9c
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x18000cd7f
lea rcx, [r9 + 0x5a]
cmp rax, rcx
je 0x18000cd60
lea rcx, [r9 + 0x200]
cmp rax, rcx
je 0x18000cd32
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x18000c900
mov rax, rcx
lea r9, [rcx + 0x400]
lea rcx, [r9 + 3]
cmp rax, rcx
jb 0x18000d2a1
lea rcx, [r9 + 0x61]
cmp rax, rcx
jb 0x18000d286
lea rcx, [r9 + 5]
cmp rax, rcx
jb 0x18000caeb
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x18000cace
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x18000cab3
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jb 0x18000cce1
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x18000cc94
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x18000cc53
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x18000cc32
lea rcx, [r9 + 4]
cmp rax, rcx
jb 0x18000c900
lea rax, [r9 + 0x40]
lea r9, [rax + 0x7a]
lea rcx, [r9 + 6]
cmp rax, rcx
ja 0x18000cc04
lea rcx, [r9 + 0x64]
cmp rax, rcx
ja 0x18000cbe5
lea rcx, [r9 + 9]
cmp rax, rcx
ja 0x18000cbc8
lea rcx, [r9 + 0x200]
cmp rax, rcx
ja 0x18000cbaf
lea rcx, [r9 + 0x10]
cmp rax, rcx
ja 0x18000cb8f
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x18000cb6f
lea rcx, [r9 + 0x28]
cmp rax, rcx
ja 0x18000cb49
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x18000cb27
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x18000cb08
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x18000c900
lea rax, [r9 + 0x80]
lea r9, [rax + 0x2a]
jmp 0x18000c900
lea r10d, [rdi + 0x1d]
movzx ecx, r10b
and cl, bl
add cl, cl
sub r10b, cl
add r10b, 0x35
add r10b, bl
jmp 0x18000c8f1
lea edx, [rdi + 0x2f]
movzx ecx, bl
and cl, dl
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x49
add r10b, dl
jmp 0x18000c875
lea edx, [rdi + 0x41]
movzx ecx, bl
and cl, dl
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x39
add r10b, dl
jmp 0x18000c824
lea edx, [rdi + 0x18]
movzx ecx, bl
and cl, dl
mov r10d, 0x2c
sub r10b, cl
add r10b, r10b
add r10b, bl
add r10b, dl
jmp 0x18000d199
lea edx, [rdi + 0x2a]
movzx ecx, bl
and cl, dl
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x26
inc rdi
jmp 0x18000c812
lea r8d, [rdi + 0x3c]
mov edx, 0x2e
movzx ecx, bl
dec rdi
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
inc rdi
jmp 0x18000c812
lea r8d, [rdi + 0x4e]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
movzx r11d, dil
sub r10b, cl
sub r10b, 0x22
jmp 0x18000d1d7
lea r8d, [rdi + 0x60]
mov edx, 0x30
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
jmp 0x18000d1f5
lea edx, [rdi + 0x72]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x1e
jmp 0x18000d1f8
mov edx, 0x32
lea r8d, [rdi - 0x7c]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000d0bb
lea r8d, [rdi - 0x6a]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x1a
add r10b, r8b
jmp 0x18000d226
lea r8d, [rdi - 0x58]
movzx ecx, bl
and cl, r8b
mov edx, 0x34
sub dl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
inc rdi
jmp 0x18000c812
lea edx, [rdi - 0x2b]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
add r10b, 0x2d
mov byte [rsp + rdi + 0x40], r10b
inc rdi
jmp 0x18000c812
lea r8d, [rdi - 0x19]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x51
add r10b, r8b
cmp r9, 0x61
jb 0x18000cc46
lea r8d, [rdi + 0x6a]
mov edx, 0xd
movzx ecx, bl
and cl, r8b
sub dl, cl
add dl, dl
add dl, bl
add dl, r8b
lea r10d, [rdx + rdx]
jmp 0x18000d199
lea r8d, [rdi - 7]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x31
add r10b, r8b
cmp rax, 0x3e8
jae 0x18000d080
lea rcx, [r9 + 2]
cmp rax, rcx
jbe 0x18000cfd5
mov edx, 0x17
lea r8d, [rdi + 0x1e]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000cc6a
lea r8d, [rdi + 0xb]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x4d
add r10b, r8b
lea rcx, [r9 + rax]
cmp rcx, 0x64
je 0x18000d0a6
lea rcx, [r9 + 0x5a]
cmp rax, rcx
jbe 0x18000cf31
lea r8d, [rdi - 0x25]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 3
jmp 0x18000ccab
lea r8d, [rdi - 0x6e]
movzx ecx, bl
and cl, r8b
mov edx, 1
sub dl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
inc rdi
jmp 0x18000c812
lea r8d, [rdi - 0x5c]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x7c
add r10b, r8b
jmp 0x18000d226
mov edx, 3
lea r8d, [rdi - 0x4a]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000d0bb
lea edx, [rdi - 0x38]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x78
jmp 0x18000d1f8
lea r8d, [rdi - 0x26]
mov edx, 5
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
jmp 0x18000d1f5
lea r8d, [rdi - 0x14]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
movzx r11d, dil
sub r10b, cl
sub r10b, 0x74
jmp 0x18000d1d7
lea r8d, [rdi - 2]
mov edx, 7
movzx ecx, bl
dec rdi
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
inc rdi
jmp 0x18000c812
lea edx, [rdi + 0x10]
movzx ecx, bl
and cl, dl
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x70
inc rdi
jmp 0x18000c812
mov edx, 9
lea r8d, [rdi + 0x22]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000d196
lea rdx, [r9 + 5]
cmp rax, rdx
jae 0x18000ce7f
lea r8d, [rdi - 9]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x3f
jmp 0x18000ccf8
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x18000ceb6
lea r8d, [rdi - 0x7a]
movzx ecx, bl
and cl, r8b
mov edx, 0x2b
sub dl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
inc rdi
jmp 0x18000c812
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x18000cedc
mov edx, 0x29
lea r8d, [rdi + 0x62]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000d0bb
cmp rax, rdx
jne 0x18000cf07
lea r8d, [rdi + 0x1a]
mov edx, 0x25
movzx ecx, bl
dec rdi
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
inc rdi
jmp 0x18000c812
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x18000ccfb
mov edx, 0x23
lea r8d, [rdi - 0xa]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000d196
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x18000cf56
lea r8d, [rdi - 0x37]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x7f
jmp 0x18000d196
inc rcx
cmp rax, rcx
jne 0x18000cf7f
lea edx, [rdi - 0x49]
movzx ecx, bl
and cl, dl
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r10d, [rdx + rbx]
dec r10b
inc rdi
jmp 0x18000c812
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x18000cfa1
lea edx, [rdi - 0x7f]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
add r10b, 0x79
jmp 0x18000d1f5
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x18000ccae
lea edx, [rdi + 0x39]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rbx]
add r10b, 0x71
inc rdi
jmp 0x18000c812
lea rdx, [r9 + 1]
cmp rax, rdx
jne 0x18000d005
lea edx, [rdi + 0xc]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rbx]
sub r10b, 0x54
inc rdi
jmp 0x18000c812
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x18000d02a
lea r8d, [rdi - 0x18]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x58
jmp 0x18000d0bb
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x18000d054
mov edx, 0x11
lea r8d, [rdi - 0x4e]
movzx ecx, bl
movzx r11d, dil
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x18000d1d7
lea rcx, [rdx + 1]
cmp rax, rcx
jne 0x18000cc6d
lea edx, [rdi - 0x60]
movzx ecx, bl
and cl, dl
dec rdi
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x60
inc rdi
jmp 0x18000c812
lea r8d, [rdi + 0x58]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
movzx r11d, dil
sub r10b, cl
sub r10b, 0x68
add r10b, r8b
add r10b, bl
jmp 0x18000d1da
mov edx, 0xb
lea r8d, [rdi + 0x46]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
lea r8d, [rdi + 0x3d]
movzx ecx, bl
and cl, r8b
inc r9
add cl, cl
movzx edx, bl
sub dl, cl
add dl, 0x55
add dl, r8b
movzx ecx, dl
mov byte [rsp + rdi + 0x40], cl
add rcx, r9
sub rdi, rcx
jmp 0x18000d226
lea edx, [rdi - 0x5f]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rbx]
sub r10b, 0x67
inc rdi
jmp 0x18000c812
lea r8d, [rdi - 0x4d]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x1b
add r10b, r8b
jmp 0x18000d226
lea edx, [rdi - 0x29]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
add r10b, 0x1f
jmp 0x18000d1f8
lea edx, [rdi - 0x17]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x5f
jmp 0x18000d1f5
lea r8d, [rdi - 5]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
movzx r11d, dil
sub r10b, cl
add r10b, 0x23
jmp 0x18000d1d7
lea r8d, [rdi + 0x31]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x57
add r10b, r8b
movzx ecx, bl
lea edx, [rdi + 0x61]
and cl, dl
add cl, cl
sub bl, cl
add bl, 0x59
add bl, dl
mov byte [rsp + rdi + 0x40], bl
inc r9
dec rdi
inc rdi
jmp 0x18000c812
movzx r11d, dil
movzx ecx, bl
movzx r10d, bl
lea r8d, [r11 - 0x75]
and cl, r8b
add cl, cl
sub r10b, cl
add r10b, 0x33
add r10b, r8b
movzx ecx, bl
add r11b, 0x4f
and cl, r11b
add cl, cl
sub bl, cl
sub bl, 0x29
add bl, r11b
add bl, r10b
mov byte [rsp + rdi + 0x40], bl
add rax, r9
movzx ecx, r10b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x18000c812
lea rcx, [rdi + r13]
and r11b, cl
add r11b, r11b
sub cl, r11b
lea r10d, [rbx + rcx]
add r10b, 0x3b
lea edx, [rdi + 0x34]
inc rax
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
mov rcx, 0xffffffffffffffff
sub rcx, rax
sub dl, 0x6c
add dl, bl
mov byte [rsp + rdi + 0x40], dl
add rdi, rcx
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x18000c812
lea rcx, [rdi + r12]
and r11b, cl
add r11b, r11b
sub cl, r11b
lea r10d, [rbx + rcx]
sub r10b, 0x43
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x18000c812
add dil, 0x53
movzx ecx, bl
and cl, dil
add cl, cl
sub bl, cl
lea r10d, [rdi + rbx]
sub r10b, 0x45
jmp 0x18000c810
add dil, 0x65
movzx eax, bl
and al, dil
add al, al
sub bl, al
lea r10d, [rdi + rbx]
add r10b, 0x3d
jmp 0x18000c800
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180029e30
add rsp, 0x98
ret
mov ecx, dword [rsp + 0x17ade34]
jmp 0x18000d2e7
mov ecx, dword [rsp + 0x51892b]
jmp 0x18000d2e7
mov ecx, dword [rsp + 0x40]
call fcn.180037744
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
int3