Function at 0x59e3b0
Capabilities:
Enumerate processes on remote desktop session host
Get session information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x288
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
dec esi
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x26c], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ebx, eax
lea edi, [ebp - 0x25c]
mov dword [edi + 8], esi
mov dword [edi], 0x6c99cc
xor eax, eax
mov dword [edi + 4], eax
mov byte [edi + 8], 0
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x268], eax
mov ecx, edi
shr ecx, 0xe
mov eax, edi
shr eax, 0x13
mov dword [ebp - 0x290], eax
mov eax, dword [eax*4 + 0x75cc90]
mov dword [ebp - 0x294], ecx
bt eax, ecx
jae 0x59e6a4
push edi
call fcn.00494f50
add esp, 4
mov dword [ebp - 0x264], edi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x59ebaf
mov al, 1
mov byte [ebp - 0x254], al
lea edi, [ebp - 0x268]
mov byte [edi + 8], al
lea eax, [ebp - 0x284]
push eax
push edi
push 8
push ebx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov esi, eax
mov edi, dword [edi + 4]
test edi, edi
je 0x59e696
cmp byte [edi + 8], 0
je 0x59ebb2
mov ecx, dword [edi + 4]
test ecx, ecx
setne dl
mov eax, dword [ebp - 0x268]
cmp ecx, eax
sete dh
and dh, dl
cmp dh, 1
je 0x59eba7
test ecx, ecx
je 0x59e4b8
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x268]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x264]
mov byte [eax + 8], 0
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x75cc90]
bt edx, ecx
jae 0x59e4e4
push eax
call fcn.00495070
add esp, 4
test esi, esi
je 0x59e69d
cmp dword [ebp - 0x284], 4
jne 0x59ebb5
mov eax, dword [ebp - 0x258]
cmp dword [eax], 0
sete cl
mov dword [ebp - 0x25c], 0x6c99cc
cmp byte [ebp - 0x254], 1
je 0x59ebac
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x59e530
push eax
mov edi, ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, edi
mov dword [ebp - 0x288], ebx
mov esi, ebx
shr esi, 8
xor edi, edi
mov eax, 0
mov bl, 1
test cl, cl
cmovne eax, esi
jne 0x59e72b
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x25c], 0x6c99cc
mov dword [ebp - 0x258], edi
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x268], edi
mov eax, dword [ebp - 0x290]
mov eax, dword [eax*4 + 0x75cc90]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x59e6bb
lea esi, [ebp - 0x25c]
push esi
call fcn.00494f50
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
jne 0x59ebbb
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
xor ebx, ebx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x268]
push eax
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov esi, eax
mov edi, dword [ebp - 0x264]
test edi, edi
je 0x59e63f
cmp byte [edi + 8], 0
je 0x59ebbe
mov ecx, dword [edi + 4]
test ecx, ecx
setne dl
mov eax, dword [ebp - 0x268]
cmp ecx, eax
sete dh
and dh, dl
cmp dh, 1
je 0x59eba7
test ecx, ecx
je 0x59e632
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x268]
mov dword [edi + 4], eax
mov ebx, dword [ebp - 0x264]
mov byte [ebx + 8], 0
mov eax, ebx
shr eax, 0xe
mov ecx, ebx
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x75cc90]
bt ecx, eax
jae 0x59e65e
push ebx
call fcn.00495070
add esp, 4
test esi, esi
je 0x59e6e8
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x59e6e8
mov ecx, dword [ebp - 0x258]
add ecx, 8
cmp dword [ecx], 0
je 0x59e6d8
add ecx, 0xc
dec eax
jne 0x59e679
mov dword [ebp - 0x288], 0
mov esi, dword [ebp - 0x28c]
jmp 0x59e6f4
xor eax, eax
jmp 0x59e4c5
xor ecx, ecx
jmp 0x59e505
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x764c90], 1
mov dword [ebp - 0x264], edi
jmp 0x59e450
lea ecx, [ebp - 0x25c]
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x764c90], 1
mov dword [ebp - 0x264], ecx
jmp 0x59e5c7
mov esi, dword [ecx - 8]
mov dword [ebp - 0x288], esi
shr esi, 8
mov al, 1
jmp 0x59e6f6
xor esi, esi
mov dword [ebp - 0x288], 0
xor eax, eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x25c], 0x6c99cc
cmp byte [ebp - 0x254], 1
je 0x59ebb8
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x59e723
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
xor edi, edi
mov ebx, dword [ebp - 0x28c]
lea ecx, [ebp - 0x284]
push 0x6d7e26
call fcn.004f1b80
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x26c], edi
test bl, bl
je 0x59e85c
shl esi, 8
movzx eax, byte [ebp - 0x288]
or eax, esi
mov dword [ebp - 0x288], eax
push 0x24c
push 0xff
lea eax, [ebp - 0x25c]
push eax
call fcn.00553af0
add esp, 0xc
xor edi, edi
lea ecx, [ebp - 0x25c]
push edi
push edi
lea eax, [ebp - 0x284]
push eax
call fcn.005ca180
lea esi, [ebp - 0x268]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea edi, [ebp - 0x25c]
lea ebx, [ebp - 0x278]
jmp 0x59e7c3
mov eax, dword [eax + 8]
mov dword [ebp - 0x278], eax
mov ecx, esi
push ebx
call fcn.0047bf10
mov ecx, edi
call fcn.005ca120
test eax, eax
jne 0x59e7b2
lea ecx, [ebp - 0x25c]
call fcn.005ca1e0
mov esi, dword [ebp - 0x268]
mov edi, dword [ebp - 0x264]
cmp esi, edi
jne 0x59e804
jmp 0x59e838
lea ecx, [ebp - 0x274]
lea eax, [ebp - 0x25c]
push eax
call fcn.0047be30
add esi, 4
cmp esi, edi
je 0x59e832
mov eax, dword [esi]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x278], 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x59e7fd
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x278], eax
je 0x59e7eb
jmp 0x59e7fd
mov esi, dword [ebp - 0x268]
test esi, esi
je 0x59e85c
mov eax, dword [ebp - 0x264]
cmp eax, esi
je 0x59e84d
add eax, 0xfffffffc
jne 0x59e842
jmp 0x59e89c
mov dword [ebp - 0x264], esi
push esi
call fcn.0054fc10
add esp, 4
cmp byte [ebp - 0x279], 0
jns 0x59e873
push dword [ebp - 0x284]
call fcn.0054fc10
add esp, 4
mov esi, dword [ebp - 0x274]
mov ebx, dword [ebp - 0x270]
cmp esi, ebx
je 0x59e89e
mov ecx, dword [esi]
mov edi, ecx
and edi, 0xffffff00
test esi, esi
je 0x59e8bf
mov eax, ebx
cmp eax, esi
je 0x59e8a4
add eax, 0xfffffffc
jne 0x59e893
ud2
xor edi, edi
xor ecx, ecx
jmp 0x59e88d
mov dword [ebp - 0x270], esi
push esi
mov dword [ebp - 0x288], ecx
call fcn.0054fc10
mov ecx, dword [ebp - 0x288]
add esp, 4
mov eax, dword [ebp + 8]
cmp esi, ebx
je 0x59e958
mov ebx, eax
movzx eax, cl
or eax, edi
push eax
push 1
push 0x440
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea esi, [ebp - 0x284]
mov dword [esi], 0
mov ecx, esi
push eax
call fcn.004f2080
mov eax, dword [esi]
inc eax
cmp eax, 1
ja 0x59e969
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov esi, ebx
mov dword [ebx], eax
mov dword [ebx + 0xc], 2
mov eax, dword [ebp - 0x284]
inc eax
cmp eax, 2
jb 0x59e941
call fcn.005080f0
push dword [ebp - 0x284]
call fcn.004f9550
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
add esp, 0x288
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [eax], 0x8000ffff
mov dword [eax + 0xc], 2
mov esi, eax
jmp 0x59e941
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - fcn.00588840], 0x6c99bc
xor eax, eax
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x254], 0
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x290]
mov eax, dword [eax*4 + 0x75cc90]
mov ecx, dword [ebp - 0x294]
bt eax, ecx
jae 0x59e9da
lea esi, [ebp - 0x25c]
push esi
call fcn.00494f50
add esp, 4
mov dword [ebp - 0x264], esi
mov byte [ebp - 0x260], 0
test byte [ebp - 0x254], 1
lea edi, [ebp - 0x268]
je 0x59e9f8
jmp 0x59ebc4
lea ecx, [ebp - 0x25c]
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x764c90], 1
mov dword [ebp - 0x264], ecx
lea edi, [ebp - 0x268]
mov al, 1
mov byte [ebp - 0x254], al
mov byte [ebp - 0x260], al
push edi
push 0xa
push dword [ebp - 0x284]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
mov ecx, edi
call fcn.00588790
test esi, esi
jne 0x59ea7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov esi, ebx
mov dword [ebx], eax
mov dword [ebx + 0xc], 2
mov dword [ebp - fcn.00588840], 0x6c99bc
cmp byte [ebp - 0x254], 1
je 0x59ebc1
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x59e922
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x59e922
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - fcn.00588840], 0x6c99bc
xor eax, eax
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x274], eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x75cc90]
bt ecx, eax
jae 0x59eadd
push edi
call fcn.00494f50
add esp, 4
mov dword [ebp - 0x270], edi
mov byte [ebp - 0x26c], 0
test byte [ebp - 0x260], 1
je 0x59eaef
jmp 0x59ebca
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x764c90], 1
mov dword [ebp - 0x270], edi
mov al, 1
mov byte [ebp - 0x260], al
lea esi, [ebp - 0x274]
mov byte [esi + 8], al
mov eax, dword [ebp - 0x258]
sub esp, 0x18
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x6d78f0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
mov ecx, esi
call fcn.00588790
test edi, edi
je 0x59eb82
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x264], 0
mov esi, ebx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
xor ecx, ecx
inc ecx
mov eax, 0x6c99bc
mov dword [esi], eax
mov dword [esi + 0xc], ecx
mov dword [ebp - fcn.00588840], 0x6c99bc
cmp byte [ebp - 0x260], 1
je 0x59ebc7
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x59ea49
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x59ea49
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
cmovne eax, ecx
mov ecx, 2
mov esi, ebx
jmp 0x59eb50
call fcn.0056410f
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3