Function at 0x50f9b0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x50f9ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, 0x60c5e8
jmp 0x50fa4c
mov esi, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
test esi, esi
je 0x50fa17
mov eax, edx
nop word [eax + eax]
cmp dword [eax + 8], 0
movq xmm0, qword [eax]
movq qword [ebp - 0x1c], xmm0
je 0x50fa64
inc ecx
add eax, 0xc
cmp ecx, esi
jb 0x50fa00
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61f218]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x61e990]
cmp eax, dword [ecx + 8]
jg 0x50fbaa
jmp 0x50fa3c
mov edx, dword [ebp - 0x10]
mov esi, 1
push edx
mov ebx, 0x60c5f8
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [edi + 4], ebx
mov eax, edi
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x50f9dd
mov ecx, dword [ebp - 0xc]
xor esi, esi
test ecx, ecx
je 0x50fac3
mov edx, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp edx, dword [ebx + eax]
jne 0x50fabb
mov eax, dword [ebx + eax + 8]
test eax, eax
je 0x50fabb
push eax
push str.explorer.exe
call fcn.0055ed26
add esp, 8
test eax, eax
je 0x50faed
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
inc esi
add ebx, 0x10
cmp esi, ecx
jb 0x50fa93
mov eax, dword fs:[0x2c]
mov ecx, dword [0x61f218]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x61e990]
cmp eax, dword [ecx + 8]
jg 0x50fbf4
push dword [ebp - 0x10]
xor esi, esi
jmp 0x50fa42
mov eax, dword [ebp - 0x10]
add esi, esi
push eax
mov esi, dword [eax + esi*8 + 4]
call sub.WTSAPI32.dll_WTSFreeMemory
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x50fb32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], 0x60c5e8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x50fb57
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x50fb74
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x50fb6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x50fb74
mov dword [edi], 0
mov eax, dword [ebp - 8]
mov dword [edi + 4], 0x60c5e8
test eax, eax
je 0x50fb90
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553cca
mov esp, ebp
pop ebp
ret
push 0x61e990
call fcn.00553e0b
add esp, 4
cmp dword [0x61e990], 0xffffffff
jne 0x50fa39
push 0x59f640
mov dword [0x60c5fc], 0x60c5f8
mov dword [vtable.._AVimpersonation_error_category__1__make_error_code__A0x9a1c86aa__YA_AVerror_code_std__W4impersonation_error_2__Z_.0], 0x5a6874
call fcn.0055414d
push 0x61e990
call fcn.00553dc1
add esp, 8
jmp 0x50fa39
push 0x61e990
call fcn.00553e0b
add esp, 4
cmp dword [0x61e990], 0xffffffff
jne 0x50fae3
push 0x59f640
mov dword [0x60c5fc], 0x60c5f8
mov dword [vtable.._AVimpersonation_error_category__1__make_error_code__A0x9a1c86aa__YA_AVerror_code_std__W4impersonation_error_2__Z_.0], 0x5a6874
call fcn.0055414d
push 0x61e990
call fcn.00553dc1
add esp, 8
jmp 0x50fae3