Function at 0x1400324f0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov r15, rcx
xor r14d, r14d
mov qword [rcx], r14
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x140032820
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
lea rcx, [rbp + 0x48]
call fcn.140032290
test eax, eax
jne 0x14003253c
mov ebx, 0xb30
jmp 0x140032564
mov dword [rbp + 0x38], r14d
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
jne 0x140032592
mov ebx, 0xb38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Last_Error__d
mov r8d, ebx
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesUtils.cpp
mov ecx, 1
call fcn.1400473d0
mov rbx, qword [rbp + 0x48]
jmp 0x1400327c4
mov esi, r14d
mov rbx, qword [rbp + 0x48]
cmp dword [rbp + 0x38], r14d
jbe 0x140032776
nop dword [rax]
nop word [rax + rax]
mov eax, esi
lea rcx, [rax + rax*2]
lea rdi, [rcx*8]
mov rax, qword [rbp + 0x50]
mov rcx, qword [rdi + rax + 0x10]
test rcx, rcx
je 0x14003276b
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x14003260b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Last_Error__d
mov r8d, 0xb46
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesUtils.cpp
mov ecx, 1
call fcn.1400473d0
jmp 0x14003276b
mov r8, qword [rbp + 0x40]
test r8, r8
je 0x14003282b
mov rax, rbx
mov rdx, r8
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140032638
add rax, 2
test cx, cx
jne 0x140032621
mov eax, r14d
jmp 0x14003263d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140032762
mov rax, qword [rbp + 0x50]
mov r8d, dword [rdi + rax + 4]
mov edx, 1
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140032695
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Last_Error__d
mov r8d, 0xb50
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesUtils.cpp
lea ecx, [rdi + 1]
call fcn.1400473d0
mov rcx, qword [rbp + 0x40]
jmp 0x140032765
lea r8, [rbp - 0x18]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400326eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Last_Error__d
mov r8d, 0xb59
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesUtils.cpp
mov ecx, 1
call fcn.1400473d0
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003276b
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x18b
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400327f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Last_Error__d
mov r8d, 0xb64
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesUtils.cpp
mov ecx, 1
call fcn.1400473d0
mov qword [r15], r14
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003276b
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc esi
cmp esi, dword [rbp + 0x38]
jb 0x1400325b0
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [rbx - 8], 1
jle 0x140032796
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x48]
call fcn.14000dd30
mov rbx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
lea r9, str.Last_Error__d___SID___s
mov r8d, 0xb7b
lea rdx, str.C:WorkVSRevoWindowsProjectsRevo_HelperRevo_HelperSourcesUtils.cpp
mov ecx, 1
call fcn.1400473d0
nop
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400327e1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov r14d, 1
jmp 0x1400327c4
mov ecx, 0x80004005
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3