Function at 0x613320
Capabilities:
Enumerate processes on remote desktop session host
Get session information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x288
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
dec esi
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x26c], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ebx, eax
lea edi, [ebp - 0x25c]
mov dword [edi + 8], esi
mov dword [edi], 0x771118
xor eax, eax
mov dword [edi + 4], eax
mov byte [edi + 8], 0
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x268], eax
mov ecx, edi
shr ecx, 0xe
mov eax, edi
shr eax, 0x13
mov dword [ebp - 0x290], eax
mov eax, dword [eax*4 + 0x81156c]
mov dword [ebp - 0x294], ecx
bt eax, ecx
jae 0x613614
push edi
call fcn.004bf510
add esp, 4
mov dword [ebp - 0x264], edi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x613b1f
mov al, 1
mov byte [ebp - 0x254], al
lea edi, [ebp - 0x268]
mov byte [edi + 8], al
lea eax, [ebp - 0x284]
push eax
push edi
push 8
push ebx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov esi, eax
mov edi, dword [edi + 4]
test edi, edi
je 0x613606
cmp byte [edi + 8], 0
je 0x613b22
mov ecx, dword [edi + 4]
test ecx, ecx
setne dl
mov eax, dword [ebp - 0x268]
cmp ecx, eax
sete dh
and dh, dl
cmp dh, 1
je 0x613b17
test ecx, ecx
je 0x613428
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x268]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x264]
mov byte [eax + 8], 0
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x81156c]
bt edx, ecx
jae 0x613454
push eax
call fcn.004bf630
add esp, 4
test esi, esi
je 0x61360d
cmp dword [ebp - 0x284], 4
jne 0x613b25
mov eax, dword [ebp - 0x258]
cmp dword [eax], 0
sete cl
mov dword [ebp - 0x25c], 0x771118
cmp byte [ebp - 0x254], 1
je 0x613b1c
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x6134a0
push eax
mov edi, ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, edi
mov dword [ebp - 0x288], ebx
mov esi, ebx
shr esi, 8
xor edi, edi
mov eax, 0
mov bl, 1
test cl, cl
cmovne eax, esi
jne 0x61369b
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x25c], 0x771118
mov dword [ebp - 0x258], edi
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x268], edi
mov eax, dword [ebp - 0x290]
mov eax, dword [eax*4 + 0x81156c]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x61362b
lea esi, [ebp - 0x25c]
push esi
call fcn.004bf510
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x613b2b
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
xor ebx, ebx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x268]
push eax
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov esi, eax
mov edi, dword [ebp - 0x264]
test edi, edi
je 0x6135af
cmp byte [edi + 8], 0
je 0x613b2e
mov ecx, dword [edi + 4]
test ecx, ecx
setne dl
mov eax, dword [ebp - 0x268]
cmp ecx, eax
sete dh
and dh, dl
cmp dh, 1
je 0x613b17
test ecx, ecx
je 0x6135a2
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x268]
mov dword [edi + 4], eax
mov ebx, dword [ebp - 0x264]
mov byte [ebx + 8], 0
mov eax, ebx
shr eax, 0xe
mov ecx, ebx
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x81156c]
bt ecx, eax
jae 0x6135ce
push ebx
call fcn.004bf630
add esp, 4
test esi, esi
je 0x613658
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x613658
mov ecx, dword [ebp - 0x258]
add ecx, 8
cmp dword [ecx], 0
je 0x613648
add ecx, 0xc
dec eax
jne 0x6135e9
mov dword [ebp - 0x288], 0
mov esi, dword [ebp - 0x28c]
jmp 0x613664
xor eax, eax
jmp 0x613435
xor ecx, ecx
jmp 0x613475
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x81956c], 1
mov dword [ebp - 0x264], edi
jmp 0x6133c0
lea ecx, [ebp - 0x25c]
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x81956c], 1
mov dword [ebp - 0x264], ecx
jmp 0x613537
mov esi, dword [ecx - 8]
mov dword [ebp - 0x288], esi
shr esi, 8
mov al, 1
jmp 0x613666
xor esi, esi
mov dword [ebp - 0x288], 0
xor eax, eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x25c], 0x771118
cmp byte [ebp - 0x254], 1
je 0x613b28
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x613693
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
xor edi, edi
mov ebx, dword [ebp - 0x28c]
lea ecx, [ebp - 0x284]
push str.EXPLORER.EXE
call fcn.00535d80
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x26c], edi
test bl, bl
je 0x6137cc
shl esi, 8
movzx eax, byte [ebp - 0x288]
or eax, esi
mov dword [ebp - 0x288], eax
push 0x24c
push 0xff
lea eax, [ebp - 0x25c]
push eax
call fcn.005c9b00
add esp, 0xc
xor edi, edi
lea ecx, [ebp - 0x25c]
push edi
push edi
lea eax, [ebp - 0x284]
push eax
call fcn.0063f9e0
lea esi, [ebp - 0x268]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea edi, [ebp - 0x25c]
lea ebx, [ebp - 0x278]
jmp 0x613733
mov eax, dword [eax + 8]
mov dword [ebp - 0x278], eax
mov ecx, esi
push ebx
call fcn.0049c6c0
mov ecx, edi
call fcn.0063f980
test eax, eax
jne 0x613722
lea ecx, [ebp - 0x25c]
call fcn.0063fa40
mov esi, dword [ebp - 0x268]
mov edi, dword [ebp - 0x264]
cmp esi, edi
jne 0x613774
jmp 0x6137a8
lea ecx, [ebp - 0x274]
lea eax, [ebp - 0x25c]
push eax
call fcn.0049c5e0
add esi, 4
cmp esi, edi
je 0x6137a2
mov eax, dword [esi]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x278], 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x61376d
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x278], eax
je 0x61375b
jmp 0x61376d
mov esi, dword [ebp - 0x268]
test esi, esi
je 0x6137cc
mov eax, dword [ebp - 0x264]
cmp eax, esi
je 0x6137bd
add eax, 0xfffffffc
jne 0x6137b2
jmp 0x61380c
mov dword [ebp - 0x264], esi
push esi
call fcn.005c57c0
add esp, 4
cmp byte [ebp - 0x279], 0
jns 0x6137e3
push dword [ebp - 0x284]
call fcn.005c57c0
add esp, 4
mov esi, dword [ebp - 0x274]
mov ebx, dword [ebp - 0x270]
cmp esi, ebx
je 0x61380e
mov ecx, dword [esi]
mov edi, ecx
and edi, 0xffffff00
test esi, esi
je 0x61382f
mov eax, ebx
cmp eax, esi
je 0x613814
add eax, 0xfffffffc
jne 0x613803
ud2
xor edi, edi
xor ecx, ecx
jmp 0x6137fd
mov dword [ebp - 0x270], esi
push esi
mov dword [ebp - 0x288], ecx
call fcn.005c57c0
mov ecx, dword [ebp - 0x288]
add esp, 4
mov eax, dword [ebp + 8]
cmp esi, ebx
je 0x6138c8
mov ebx, eax
movzx eax, cl
or eax, edi
push eax
push 1
push 0x440
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea esi, [ebp - 0x284]
mov dword [esi], 0
mov ecx, esi
push eax
call fcn.00536090
mov eax, dword [esi]
inc eax
cmp eax, 1
ja 0x6138d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov esi, ebx
mov dword [ebx], eax
mov dword [ebx + 0xc], 2
mov eax, dword [ebp - 0x284]
inc eax
cmp eax, 2
jb 0x6138b1
call fcn.0055fb70
push dword [ebp - 0x284]
call fcn.0054ae70
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x288
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [eax], 0x8000ffff
mov dword [eax + 0xc], 2
mov esi, eax
jmp 0x6138b1
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - fcn.00600380], 0x77110c
xor eax, eax
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x290]
mov eax, dword [eax*4 + 0x81156c]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x61394a
lea esi, [ebp - 0x25c]
push esi
call fcn.004bf510
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
lea edi, [ebp - 0x268]
je 0x613968
jmp 0x613b34
lea ecx, [ebp - 0x25c]
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x81956c], 1
mov dword [ebp - 0x264], ecx
lea edi, [ebp - 0x268]
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
push edi
push 0xa
push dword [ebp - 0x284]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
mov ecx, edi
call fcn.006002d0
test esi, esi
jne 0x6139ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov esi, ebx
mov dword [ebx], eax
mov dword [ebx + 0xc], 2
mov dword [ebp - fcn.00600380], 0x77110c
cmp byte [ebp - 0x254], 1
je 0x613b31
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x613892
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x613892
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - fcn.00600380], 0x77110c
xor eax, eax
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x274], eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x81156c]
bt ecx, eax
jae 0x613a4d
push edi
call fcn.004bf510
add esp, 4
mov dword [ebp - 0x270], edi
mov byte [ebp - 0x26c], 0
test byte [ebp - 0x260], 1
je 0x613a5f
jmp 0x613b3a
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x81956c], 1
mov dword [ebp - 0x270], edi
mov al, 1
mov byte [ebp - 0x260], al
lea esi, [ebp - 0x274]
mov byte [esi + 8], al
mov eax, dword [ebp - 0x258]
sub esp, 0x18
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x7809b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
mov ecx, esi
call fcn.006002d0
test edi, edi
je 0x613af2
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x264], 0
mov esi, ebx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
xor ecx, ecx
inc ecx
mov eax, 0x77110c
mov dword [esi], eax
mov dword [esi + 0xc], ecx
mov dword [ebp - fcn.00600380], 0x77110c
cmp byte [ebp - 0x260], 1
je 0x613b37
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x6139b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6139b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov ecx, 2
mov esi, ebx
jmp 0x613ac0
call fcn.005dae09
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3