Function at 0x10022550
Capabilities:
Enumerate processes on remote desktop session host
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10181848
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x101f7210]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov eax, dword [0x101f7210]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
push str._tNSIS_KillAllProcess
sub esp, 0xc
mov dword [esp + 0x24], str.WPFHelper.cpp:NSIS_KillAllProcess__:Line_339
mov eax, esp
mov dword [esp + 0x28], 0
movq xmm0, qword [esp + 0x24]
movq qword [eax], xmm0
mov dword [eax + 8], 1
call fcn.10005540
mov ebx, dword [ebp + 8]
add esp, 0x10
mov dword [esp + 0x14], str.WPFHelper.cpp:NSIS_IsClientRunning__:Line_546
mov dword [esp + 0x18], 0
movq xmm0, qword [esp + 0x14]
push ebx
push str._tPortable_d._n
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 1
call fcn.10005540
add esp, 0x14
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x30]
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
jne 0x10022661
mov dword [esp + 0x14], str.WPFHelper.cpp:NSIS_IsClientRunning__:Line_551
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [esp + 0x14]
push eax
push str._tWTSEnumerateProcesses_failed___d_._n
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.10005540
add esp, 0x14
xor eax, eax
jmp 0x100227e2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.1000ed90
mov dword [esp + 0x28], eax
xor esi, esi
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], esi
mov word [esp + 0x34], ax
mov dword [esp + 0xa8], 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], eax
mov byte [esp + 0x4c], al
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], eax
mov byte [esp + 0x7c], al
push eax
push 0x101cf8e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xb0], 7
call fcn.1001e640
xor edi, edi
mov dword [esp + 0xa8], 8
cmp dword [esp + 0x30], edi
jbe 0x1002277e
mov eax, dword [esp + 0x2c]
mov edx, dword [esi + eax + 8]
test edx, edx
je 0x10022731
cmp word [edx], 0
jne 0x1002270c
xor eax, eax
jmp 0x10022726
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x24], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10022715
sub eax, dword [esp + 0x24]
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x3c]
call fcn.1001e640
cmp ebx, 1
jne 0x10022743
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esi + eax]
jmp 0x10022745
test ebx, ebx
jne 0x1002276e
cmp dword [esp + 0x48], 8
lea eax, [esp + 0x34]
push 0x101cffd0
cmovae eax, dword [esp + 0x38]
push eax
call fcn.1014cceb
add esp, 8
neg eax
sbb eax, eax
inc eax
jne 0x10022808
inc edi
add esi, 0x10
cmp edi, dword [esp + 0x30]
jb 0x100226f6
xor esi, esi
push dword [esp + 0x2c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0x11
push 0x101cffd0
lea ecx, [esp + 0x3c]
call fcn.1001e640
push esi
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], str.WPFHelper.cpp:NSIS_IsClientRunning__:Line_574
mov dword [esp + 0x20], 0
call fcn.10002930
movq xmm0, qword [esp + 0x18]
push eax
push 0x101d04a0
sub esp, 0xc
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], 1
call fcn.10005540
add esp, 0x18
lea ecx, [esp + 0x34]
call fcn.100024d0
mov eax, esi
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.1014aad2
mov esp, ebp
pop ebp
ret 4
mov esi, 1
jmp 0x1002277e