Function at 0x180006c90
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov rax, qword [0x1800c7380]
xor rax, rbp
mov qword [rbp - 8], rax
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
mov edx, ecx
add edx, 0x8f120250
sub edx, 1
sub edx, 0x8f120250
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [rbp - 0x42], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [rbp - 0x41], al
mov dword [rbp - 0x48], 0xf1349a83
mov eax, dword [rbp - 0x48]
mov dword [rbp - 0x4c], eax
sub eax, 0x8f3533a3
je 0x1800074a5
jmp 0x180006cff
mov eax, dword [rbp - 0x4c]
sub eax, 0x9591283e
je 0x1800071ab
jmp 0x180006d12
mov eax, dword [rbp - 0x4c]
sub eax, 0x9852bca2
je 0x18000781f
jmp 0x180006d25
mov eax, dword [rbp - 0x4c]
sub eax, 0x997d15d5
je 0x1800077a6
jmp 0x180006d38
mov eax, dword [rbp - 0x4c]
sub eax, 0xa8bd393c
je 0x1800074e1
jmp 0x180006d4b
mov eax, dword [rbp - 0x4c]
sub eax, 0xb0819ee9
je 0x1800073ed
jmp 0x180006d5e
mov eax, dword [rbp - 0x4c]
sub eax, 0xe617246a
je 0x180007716
jmp 0x180006d71
mov eax, dword [rbp - 0x4c]
sub eax, 0xe6ff7de3
je 0x1800075f1
jmp 0x180006d84
mov eax, dword [rbp - 0x4c]
sub eax, 0xeef87b3b
je 0x1800072ef
jmp 0x180006d97
mov eax, dword [rbp - 0x4c]
sub eax, 0xf1349a83
je 0x180006f77
jmp 0x180006daa
mov eax, dword [rbp - 0x4c]
sub eax, 0xf2816ab7
je 0x1800071c6
jmp 0x180006dbd
mov eax, dword [rbp - 0x4c]
sub eax, 0xfc474d31
je 0x18000711b
jmp 0x180006dd0
mov eax, dword [rbp - 0x4c]
sub eax, 0xfc61e526
je 0x180006fcf
jmp 0x180006de3
mov eax, dword [rbp - 0x4c]
sub eax, 0xff0b9d21
je 0x180007695
jmp 0x180006df6
mov eax, dword [rbp - 0x4c]
sub eax, 0x17a83f2d
je 0x18000776b
jmp 0x180006e09
mov eax, dword [rbp - 0x4c]
sub eax, 0x1be47b3b
je 0x18000709f
jmp 0x180006e1c
mov eax, dword [rbp - 0x4c]
sub eax, 0x22e72922
je 0x18000734a
jmp 0x180006e2f
mov eax, dword [rbp - 0x4c]
sub eax, 0x261de0d4
je 0x1800077ec
jmp 0x180006e42
mov eax, dword [rbp - 0x4c]
sub eax, 0x2687d354
je 0x1800073e1
jmp 0x180006e55
mov eax, dword [rbp - 0x4c]
sub eax, 0x2791bb5a
je 0x180007437
jmp 0x180006e68
mov eax, dword [rbp - 0x4c]
sub eax, 0x33c80e6b
je 0x18000719f
jmp 0x180006e7b
mov eax, dword [rbp - 0x4c]
sub eax, 0x3556bc58
je 0x180007288
jmp 0x180006e8e
mov eax, dword [rbp - 0x4c]
sub eax, 0x4478fbbc
je 0x1800074b1
jmp 0x180006ea1
mov eax, dword [rbp - 0x4c]
sub eax, 0x470de1ed
je 0x180007207
jmp 0x180006eb4
mov eax, dword [rbp - 0x4c]
sub eax, 0x4ddf31e0
je 0x180007093
jmp 0x180006ec7
mov eax, dword [rbp - 0x4c]
sub eax, 0x52fe75ea
je 0x1800074d5
jmp 0x180006eda
mov eax, dword [rbp - 0x4c]
sub eax, 0x5b1bcea8
je 0x1800074f4
jmp 0x180006eed
mov eax, dword [rbp - 0x4c]
sub eax, 0x5d27be16
je 0x180007614
jmp 0x180006f00
mov eax, dword [rbp - 0x4c]
sub eax, 0x5f7bb4d7
je 0x1800077ca
jmp 0x180006f13
mov eax, dword [rbp - 0x4c]
sub eax, 0x6335f3c9
je 0x180007813
jmp 0x180006f26
mov eax, dword [rbp - 0x4c]
sub eax, 0x679a089b
je 0x1800072fb
jmp 0x180006f39
mov eax, dword [rbp - 0x4c]
sub eax, 0x7a375828
je 0x1800075fd
jmp 0x180006f4c
mov eax, dword [rbp - 0x4c]
sub eax, 0x7b774c6f
je 0x180007739
jmp 0x180006f5f
mov eax, dword [rbp - 0x4c]
sub eax, 0x7ff70b51
je 0x180007575
jmp 0x180006f72
jmp 0x180007826
mov r11b, byte [rbp - 0x42]
mov r10b, byte [rbp - 0x41]
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7b774c6f
mov ecx, 0xfc61e526
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.18008d270
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
call fcn.18008d270
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.18008d270
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x38]
mov dword [rax], 0
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b774c6f
mov ecx, 0x4ddf31e0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov dword [rbp - 0x48], 0x1be47b3b
jmp 0x180007826
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x17a83f2d
mov ecx, 0xfc474d31
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov rax, qword [rbp - 0x30]
mov qword [rax], 0
mov rax, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x21], al
mov eax, dword [0x1800cac3c]
mov ecx, dword [0x1800cac38]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x17a83f2d
mov ecx, 0x33c80e6b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov dword [rbp - 0x48], 0x9591283e
jmp 0x180007826
mov dl, byte [rbp - 0x21]
mov eax, 0xb0819ee9
mov ecx, 0xf2816ab7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
lea rcx, [0x1800c8900]
lea rdx, [0x1800b34a8]
sub rsp, 0x20
call fcn.1800103b0
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x38]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.1800134e0
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x48], 0x470de1ed
jmp 0x180007826
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
mov edx, ecx
sub edx, 0xaa33ba6f
sub edx, 1
add edx, 0xaa33ba6f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x997d15d5
mov ecx, 0x3556bc58
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov rcx, qword [rbp - 0x20]
lea rdx, [0x180013ed0]
sub rsp, 0x20
call fcn.180013d70
add rsp, 0x20
mov eax, dword [0x1800cac3c]
mov ecx, dword [0x1800cac38]
mov edx, eax
sub edx, 0xcaf6e4d2
sub edx, 1
add edx, 0xcaf6e4d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x997d15d5
mov ecx, 0xeef87b3b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov dword [rbp - 0x48], 0x679a089b
jmp 0x180007826
mov eax, dword [0x1800cac3c]
mov ecx, dword [0x1800cac38]
mov edx, eax
add edx, 0x219d7c7f
sub edx, 1
sub edx, 0x219d7c7f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f7bb4d7
mov ecx, 0x22e72922
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov rax, qword [rbp - 0x38]
cmp dword [rax], 0x82
setbe cl
mov rax, qword [rbp - 0x40]
and cl, 1
mov byte [rax], cl
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
mov edx, ecx
sub edx, 0xf1bf869c
sub edx, 1
add edx, 0xf1bf869c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x5f7bb4d7
mov ecx, 0x2687d354
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov dword [rbp - 0x48], 0x7a375828
jmp 0x180007826
mov eax, dword [0x1800cac3c]
mov ecx, dword [0x1800cac38]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x261de0d4
mov ecx, 0x2791bb5a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
lea rcx, [0x1800c8a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.1800103b0
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov eax, dword [0x1800cac3c]
mov ecx, dword [0x1800cac38]
mov edx, eax
sub edx, 0x762508eb
sub edx, 1
add edx, 0x762508eb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x261de0d4
mov ecx, 0x8f3533a3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov dword [rbp - 0x48], 0x4478fbbc
jmp 0x180007826
mov rcx, qword [rbp - 0x18]
lea rdx, [0x180013ed0]
sub rsp, 0x20
call fcn.180013d70
add rsp, 0x20
mov dword [rbp - 0x48], 0x52fe75ea
jmp 0x180007826
mov dword [rbp - 0x48], 0xa8bd393c
jmp 0x180007826
mov rax, qword [rbp - 0x40]
mov byte [rax], 1
mov dword [rbp - 0x48], 0x5b1bcea8
jmp 0x180007826
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
mov edx, ecx
sub edx, 0x2bc1d5d6
sub edx, 1
add edx, 0x2bc1d5d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6335f3c9
mov ecx, 0x7ff70b51
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6335f3c9
mov ecx, 0xe6ff7de3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov dword [rbp - 0x48], 0x7a375828
jmp 0x180007826
mov rax, qword [rbp - 0x40]
mov al, byte [rax]
and al, 1
mov byte [rbp - 9], al
mov dword [rbp - 0x48], 0x5d27be16
jmp 0x180007826
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
mov edx, ecx
sub edx, 0x6b6fca16
sub edx, 1
add edx, 0x6b6fca16
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9852bca2
mov ecx, 0xff0b9d21
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov ecx, dword [0x1800cac3c]
mov eax, dword [0x1800cac38]
mov edx, ecx
add edx, 0x25188a2b
sub edx, 1
sub edx, 0x25188a2b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9852bca2
mov ecx, 0xe617246a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x180007826
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov dword [rbp - 0x5c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008d2d0
mov eax, dword [rbp - 0x5c]
mov rsp, rbp
pop rbp
ret
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.18008d270
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.18008d270
sub rsp, rax
mov rax, rsp
mov dword [rax], 0
mov dword [rbp - 0x48], 0xfc61e526
jmp 0x180007826
mov rax, qword [rbp - 0x30]
mov qword [rax], 0
mov rax, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
mov dword [rbp - 0x48], 0xfc474d31
jmp 0x180007826
mov rcx, qword [rbp - 0x20]
lea rdx, [0x180013ed0]
sub rsp, 0x20
call fcn.180013d70
add rsp, 0x20
mov dword [rbp - 0x48], 0x3556bc58
jmp 0x180007826
mov rax, qword [rbp - 0x38]
cmp dword [rax], 0x82
setbe cl
mov rax, qword [rbp - 0x40]
and cl, 1
mov byte [rax], cl
mov dword [rbp - 0x48], 0x22e72922
jmp 0x180007826
lea rcx, [0x1800c8a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.1800103b0
add rsp, 0x20
mov dword [rbp - 0x48], 0x2791bb5a
jmp 0x180007826
mov dword [rbp - 0x48], 0x7ff70b51
jmp 0x180007826
mov dword [rbp - 0x48], 0xff0b9d21
jmp 0x180006ce9