Function at 0x180005980
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov rax, qword [0x1800c3380]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x40], 0x35f09eac
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x44], eax
sub eax, 0xa810d669
je 0x180005e7c
jmp 0x1800059b5
mov eax, dword [rbp - 0x44]
sub eax, 0xa8ed42ec
je 0x180005cd5
jmp 0x1800059c8
mov eax, dword [rbp - 0x44]
sub eax, 0xaa1a8a58
je 0x180005bd6
jmp 0x1800059db
mov eax, dword [rbp - 0x44]
sub eax, 0xaff6b319
je 0x180005c8e
jmp 0x1800059ee
mov eax, dword [rbp - 0x44]
sub eax, 0xc9ae40b9
je 0x180005e26
jmp 0x180005a01
mov eax, dword [rbp - 0x44]
sub eax, 0xd4386a36
je 0x180005b87
jmp 0x180005a14
mov eax, dword [rbp - 0x44]
sub eax, 0xd5d74c94
je 0x180005d21
jmp 0x180005a27
mov eax, dword [rbp - 0x44]
sub eax, 0xdc7bfc6f
je 0x180005d15
jmp 0x180005a3a
mov eax, dword [rbp - 0x44]
sub eax, 0xe4fe3664
je 0x180005c4b
jmp 0x180005a4d
mov eax, dword [rbp - 0x44]
sub eax, 0xfcba998f
je 0x180005e55
jmp 0x180005a60
mov eax, dword [rbp - 0x44]
sub eax, 0xe2eac60
je 0x180005b49
jmp 0x180005a73
mov eax, dword [rbp - 0x44]
sub eax, 0x35f09eac
je 0x180005afd
jmp 0x180005a86
mov eax, dword [rbp - 0x44]
sub eax, 0x4374b51c
je 0x180005caa
jmp 0x180005a99
mov eax, dword [rbp - 0x44]
sub eax, 0x59c525b5
je 0x180005e32
jmp 0x180005aac
mov eax, dword [rbp - 0x44]
sub eax, 0x5bb60f40
je 0x180005da2
jmp 0x180005abf
mov eax, dword [rbp - 0x44]
sub eax, 0x6ecbf10d
je 0x180005c3f
jmp 0x180005ad2
mov eax, dword [rbp - 0x44]
sub eax, 0x6f0fbfe4
je 0x180005cf9
jmp 0x180005ae5
mov eax, dword [rbp - 0x44]
sub eax, 0x730da031
je 0x180005d05
jmp 0x180005af8
jmp 0x180005e83
mov eax, 0x10
mov qword [rbp - 0x50], rax
call fcn.180089180
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.180089180
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x38]
mov dword [rax], 0
mov rax, qword [rbp - 0x30]
mov qword [rax], 0
mov dword [rbp - 0x40], 0xe2eac60
jmp 0x180005e83
mov rax, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
mov edx, eax
mov eax, 0x4374b51c
mov ecx, 0xd4386a36
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x180005e83
mov eax, dword [0x1800c6b7c]
mov ecx, dword [0x1800c6b78]
mov edx, eax
sub edx, 0x6bb2c850
sub edx, 1
add edx, 0x6bb2c850
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfcba998f
mov ecx, 0xaa1a8a58
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x180005e83
lea rcx, [0x1800c4900]
lea rdx, [0x1800af4a8]
sub rsp, 0x20
call fcn.18000e210
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov eax, dword [0x1800c6b7c]
mov ecx, dword [0x1800c6b78]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfcba998f
mov ecx, 0x6ecbf10d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x180005e83
mov dword [rbp - 0x40], 0xe4fe3664
jmp 0x180005e83
mov rax, qword [rbp - 0x38]
mov edx, dword [rax]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.180010fe0
add rsp, 0x20
mov rcx, rax
lea rdx, [0x180011a70]
sub rsp, 0x20
call fcn.1800119e0
add rsp, 0x20
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x40], 0xaff6b319
jmp 0x180005e83
mov eax, dword [rbp - 0x1c]
cmp eax, 0x82
setbe al
and al, 1
mov byte [rbp - 0x39], al
mov dword [rbp - 0x40], 0xd5d74c94
jmp 0x180005e83
lea rcx, [0x1800c4a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.18000e210
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x40], 0xa8ed42ec
jmp 0x180005e83
mov rcx, qword [rbp - 0x18]
lea rdx, [0x180011a70]
sub rsp, 0x20
call fcn.1800119e0
add rsp, 0x20
mov dword [rbp - 0x40], 0x6f0fbfe4
jmp 0x180005e83
mov dword [rbp - 0x40], 0x730da031
jmp 0x180005e83
mov byte [rbp - 0x39], 1
mov dword [rbp - 0x40], 0xdc7bfc6f
jmp 0x180005e83
mov dword [rbp - 0x40], 0xd5d74c94
jmp 0x180005e83
mov ecx, dword [0x1800c6b7c]
mov eax, dword [0x1800c6b78]
mov edx, ecx
sub edx, 0x1803467f
sub edx, 1
add edx, 0x1803467f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa810d669
mov ecx, 0x5bb60f40
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x180005e83
mov al, byte [rbp - 0x39]
and al, 1
mov byte [rbp - 9], al
mov ecx, dword [0x1800c6b7c]
mov eax, dword [0x1800c6b78]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa810d669
mov ecx, 0xc9ae40b9
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x180005e83
mov dword [rbp - 0x40], 0x59c525b5
jmp 0x180005e83
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov dword [rbp - 0x54], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.1800891e0
mov eax, dword [rbp - 0x54]
mov rsp, rbp
pop rbp
ret
lea rcx, [0x1800c4900]
lea rdx, [0x1800af4a8]
sub rsp, 0x20
call fcn.18000e210
add rsp, 0x20
mov dword [rbp - 0x40], 0xaa1a8a58
jmp 0x180005e83
mov dword [rbp - 0x40], 0x5bb60f40
jmp 0x18000599f