Function at 0x4bd460
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x4bd49c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 0x6d5954
jmp 0x4bd4fc
mov esi, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
test esi, esi
je 0x4bd4c7
mov eax, edx
nop word [eax + eax]
cmp dword [eax + 8], 0
movq xmm0, qword [eax]
movq qword [ebp - 0x1c], xmm0
je 0x4bd514
inc ecx
add eax, 0xc
cmp ecx, esi
jb 0x4bd4b0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6e23a4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6e11f0]
cmp eax, dword [ecx + 4]
jg 0x4bd65a
jmp 0x4bd4ec
mov edx, dword [ebp - 0x10]
mov esi, 1
push edx
mov ebx, 0x6d15e8
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [edi + 4], ebx
mov eax, edi
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x4bd48d
mov ecx, dword [ebp - 0xc]
xor esi, esi
test ecx, ecx
je 0x4bd573
mov edx, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp edx, dword [ebx + eax]
jne 0x4bd56b
mov eax, dword [ebx + eax + 8]
test eax, eax
je 0x4bd56b
push eax
push str.explorer.exe
call fcn.00619355
add esp, 8
test eax, eax
je 0x4bd59d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
inc esi
add ebx, 0x10
cmp esi, ecx
jb 0x4bd543
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6e23a4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6e11f0]
cmp eax, dword [ecx + 4]
jg 0x4bd6a4
push dword [ebp - 0x10]
xor esi, esi
jmp 0x4bd4f2
mov eax, dword [ebp - 0x10]
add esi, esi
push eax
mov esi, dword [eax + esi*8 + 4]
call sub.WTSAPI32.dll_WTSFreeMemory
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4bd5e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], 0x6d5954
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4bd607
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x4bd624
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x4bd61e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x4bd624
mov dword [edi], 0
mov eax, dword [ebp - 8]
mov dword [edi + 4], 0x6d5954
test eax, eax
je 0x4bd640
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00608185
mov esp, ebp
pop ebp
ret
push 0x6e11f0
call fcn.00608556
add esp, 4
cmp dword [0x6e11f0], 0xffffffff
jne 0x4bd4e9
push 0x657920
mov dword [0x6d15ec], 0x6d15e8
mov dword [vtable.._AVimpersonation_error_category__1__make_error_code__A0xafd247c1__YA_AVerror_code_std__W4impersonation_error_2__Z_.0], 0x6610c4
call fcn.00608400
push 0x6e11f0
call fcn.0060850c
add esp, 8
jmp 0x4bd4e9
push 0x6e11f0
call fcn.00608556
add esp, 4
cmp dword [0x6e11f0], 0xffffffff
jne 0x4bd593
push 0x657920
mov dword [0x6d15ec], 0x6d15e8
mov dword [vtable.._AVimpersonation_error_category__1__make_error_code__A0xafd247c1__YA_AVerror_code_std__W4impersonation_error_2__Z_.0], 0x6610c4
call fcn.00608400
push 0x6e11f0
call fcn.0060850c
add esp, 8
jmp 0x4bd593