Function at 0x414d30
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8b28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x535820]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
push 1
push 0
push 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesA]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x38], edx
test ecx, ecx
je 0x414fe4
xor ebx, ebx
mov dword [ebp - 0x34], ebx
jmp 0x414da0
mov eax, dword [ebp - 0x30]
movq xmm0, qword [ebx + eax]
movq qword [ebp - 0x4c], xmm0
movq xmm0, qword [ebx + eax + 8]
movq qword [ebp - 0x44], xmm0
cmp dword [ebp - 0x4c], esi
jne 0x414fd2
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0xf
cmp byte [edx], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jne 0x414ddf
xor ecx, ecx
jmp 0x414ded
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414de4
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00405920
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp ebx, 0x10
lea edx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
mov ecx, 0xa
cmp edi, ecx
cmovb ecx, edi
test ecx, ecx
je 0x414e76
mov esi, str.chrome.exe
sub ecx, 4
jb 0x414e37
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x414e3c
add edx, 4
add esi, 4
sub ecx, 4
jae 0x414e26
cmp ecx, 0xfffffffc
je 0x414e70
mov al, byte [edx]
cmp al, byte [esi]
jne 0x414e69
cmp ecx, 0xfffffffd
je 0x414e70
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x414e69
cmp ecx, 0xfffffffe
je 0x414e70
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x414e69
cmp ecx, 0xffffffff
je 0x414e70
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x414e70
sbb eax, eax
or eax, 1
jmp 0x414e72
xor eax, eax
test eax, eax
jne 0x414e8b
cmp edi, 0xa
jb 0x414e8b
xor eax, eax
cmp edi, 0xa
setne al
test eax, eax
je 0x415002
cmp ebx, 0x10
lea edx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
mov ecx, 0xc
cmp edi, ecx
cmovb ecx, edi
test ecx, ecx
je 0x414f00
mov esi, str.iexplore.exe
sub ecx, 4
jb 0x414ec1
lea ecx, [ecx]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x414ec6
add edx, 4
add esi, 4
sub ecx, 4
jae 0x414eb0
cmp ecx, 0xfffffffc
je 0x414efa
mov al, byte [edx]
cmp al, byte [esi]
jne 0x414ef3
cmp ecx, 0xfffffffd
je 0x414efa
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x414ef3
cmp ecx, 0xfffffffe
je 0x414efa
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x414ef3
cmp ecx, 0xffffffff
je 0x414efa
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x414efa
sbb eax, eax
or eax, 1
jmp 0x414efc
xor eax, eax
test eax, eax
jne 0x414f15
cmp edi, 0xc
jb 0x414f15
xor eax, eax
cmp edi, 0xc
setne al
test eax, eax
je 0x415002
mov esi, dword [ebp - 0x2c]
cmp ebx, 0x10
lea ecx, [ebp - 0x2c]
mov eax, 0x11
cmovae ecx, esi
cmp edi, eax
cmovb eax, edi
push eax
mov edx, str.microsoftedge.exe
call fcn.00401010
add esp, 4
test eax, eax
jne 0x414f50
cmp edi, 0x11
jb 0x414f50
cmp edi, 0x11
setne al
test eax, eax
je 0x415002
cmp ebx, 0x10
lea ecx, [ebp - 0x2c]
mov eax, 9
cmovae ecx, esi
cmp edi, eax
cmovb eax, edi
push eax
mov edx, str.opera.exe
call fcn.00401010
add esp, 4
test eax, eax
jne 0x414f84
cmp edi, 9
jb 0x414f84
cmp edi, 9
setne al
test eax, eax
je 0x415002
push str.firefox.exe
lea ecx, [ebp - 0x2c]
call fcn.00409e40
test eax, eax
je 0x415002
push str.whale.exe
lea ecx, [ebp - 0x2c]
call fcn.00409e40
test eax, eax
je 0x415002
push str.swing.exe
lea ecx, [ebp - 0x2c]
call fcn.00409e40
test eax, eax
je 0x415002
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004047a0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x3c]
inc edx
add ebx, 0x10
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ebx
cmp edx, ecx
jb 0x414da0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d8e4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x48]
call fcn.00415350
cmp dword [ebp - 0x18], 0x10
mov esi, eax
jb 0x41501d
push dword [ebp - 0x2c]
call fcn.0041e60d
add esp, 4
mov eax, esi
jmp 0x414fe6