Function at 0x1015bd00
Capabilities:
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 1
push 0
push 0
mov esi, ecx
xor bl, bl
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
je 0x1015be60
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jbe 0x1015be4b
xor edi, edi
mov dword [ebp - 0xc], edi
lea esp, [esp]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + edi]
cmp eax, dword [esi]
jne 0x1015be34
push str.explorer.exe
push dword [ecx + edi + 8]
call fcn.102134f3
add esp, 8
test eax, eax
jne 0x1015be34
mov eax, dword [ebp - 4]
push dword [edi + eax + 4]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1015be08
cmp dword [esi + 0x40], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
jne 0x1015bdef
lea eax, [ebp - 8]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1015bdef
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1015bde6
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], eax
jmp 0x1015bdef
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov bl, 1
cmp edi, dword [esi + 0x38]
je 0x1015be34
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1015be34
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1015be34
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], 0x10
inc eax
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x10]
jb 0x1015bd50
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
mov edi, edi
push str.Program_Manager
push str.Progman
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x1015be53
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 8], 0
jbe 0x1015be60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1015be60
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1015bf37
cmp dword [esi + 0x40], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
jne 0x1015bf17
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1015bf17
lea eax, [ebp - 0x18]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1015bf10
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], eax
jmp 0x1015bf1d
push dword [ebp - 0xc]
call ebx
jmp 0x1015bf1d
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp edi, dword [esi + 0x38]
je 0x1015be5c
push edi
call ebx
jmp 0x1015be5c
push dword [ebp - 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1015be60
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1015be5c