Function at 0x504a4c
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.00535595
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.0053558f
add esp, 4
mov eax, 0x6187fe
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x504b00
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x504afc
imul eax, dword [ebx]
jmp 0x504af1
mov ecx, eax
test ecx, ecx
je 0x504b1f
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x504b18
push ebx
push eax
call fcn.0053558f
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x504b06
call fcn.0053558f
add esp, 4
mov eax, 0x6187fe
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov ebx, dword [ebp + 0x18]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x504b51
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x504b4d
imul eax, dword [ebx]
jmp 0x504b42
mov ecx, eax
test ecx, ecx
je 0x504b70
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x504b69
push ebx
push eax
call fcn.0053558f
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x504b57
call fcn.0053558f
add esp, 4
mov eax, 0x6187fe
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp + 0x20]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x504ba2
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x504b9e
imul eax, dword [ebx]
jmp 0x504b93
mov ecx, eax
test ecx, ecx
je 0x504bc1
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x504bba
push ebx
push eax
call fcn.0053558f
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x504ba8
call fcn.0053558f
add esp, 4
mov eax, 0x6187fe
mov ebx, dword [ebp + 0x20]
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0
call dword [sym.imp.wtsapi32.dll_WTSEnumerateProcessesA]
nop
nop
nop
nop
cmp dword [ebp - 0x30], esp
je 0x504c10
push 6
call fcn.0053559b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5050f6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push eax
lea eax, [ebp - 0x18]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x5050f3
dec dword [ebp - 0x18]
mov dword [ebp - 0x30], esp
push 0x10
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x30], esp
je 0x504c6a
push 6
call fcn.0053559b
add esp, 4
mov ebx, dword [ebp - 0x1c]
add ebx, 4
mov dword [ebp - 0x30], ebx
push dword [ebp + 8]
push 4
mov eax, 2
call fcn.00536400
add esp, 8
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebx]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
mov dword [ebp - 0x38], ebx
call fcn.0049d8c2
mov dword [ebp - 0x3c], ecx
mov edi, dword [ebp - 0x38]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x504cb9
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x38]
call fcn.005355ad
add esp, 8
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x3c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 8
mov dword [ebp - 0x30], ebx
push dword [ebp + 0x10]
push 4
mov eax, 2
call fcn.00536400
add esp, 8
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebx]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
mov dword [ebp - 0x38], ebx
call fcn.0049d8c2
mov dword [ebp - 0x3c], ecx
mov edi, dword [ebp - 0x38]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x504d35
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x38]
call fcn.005355ad
add esp, 8
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x3c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x34]
push edi
test eax, eax
je 0x504d7a
push eax
mov ebx, eax
call fcn.0049d8e2
inc eax
push eax
call fcn.00535595
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
inc dword [ebp - 4]
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.005399d0
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 0xc
mov dword [ebp - 0x34], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.005399d0
add esp, 0x10
mov dword [ebp - 0x38], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.005399d0
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], esp
mov eax, 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
push dword [ebx]
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_LookupAccountSidA]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x504e2d
push 6
call fcn.0053559b
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x504e3d
push ebx
call fcn.0053558f
add esp, 4
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x504e4d
push ebx
call fcn.0053558f
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x504e5d
push ebx
call fcn.0053558f
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x504f5d
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.005383c0
add esp, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x504e9c
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0x28], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.005383c0
add esp, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x504ed5
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0x2c], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.005399d0
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 0xc
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], esp
mov eax, 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
mov ebx, dword [ebp - 0x34]
push dword [ebx]
push dword [ebp - 0x30]
call dword [sym.imp.advapi32.dll_LookupAccountSidA]
nop
nop
nop
nop
cmp dword [ebp - 0x38], esp
je 0x504f44
push 6
call fcn.0053559b
add esp, 4
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x504f57
push ebx
call fcn.0053558f
add esp, 4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
push SysStringLen
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x504f70
mov eax, 0x618809
push eax
push 1
mov ebx, 0x174
call fcn.00538400
add esp, 0x10
mov dword [ebp - 0x30], eax
push dword [ebp + 0x20]
push 4
mov eax, 2
call fcn.00536400
add esp, 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp + 0x20]
mov ebx, dword [ebx]
mov dword [ebp - 0x38], ebx
call fcn.0049d8c2
mov dword [ebp - 0x3c], ecx
mov edi, dword [ebp - 0x38]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x504fca
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x38]
call fcn.005355ad
add esp, 8
mov ebx, dword [ebp + 0x20]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x3c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x34]
push edi
test eax, eax
je 0x50500f
push eax
mov ebx, eax
call fcn.0049d8e2
inc eax
push eax
call fcn.00535595
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x505022
push ebx
call fcn.0053558f
add esp, 4
push SysStringLen
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x505035
mov eax, 0x618809
push eax
push 1
mov ebx, 0x174
call fcn.00538400
add esp, 0x10
mov dword [ebp - 0x30], eax
push dword [ebp + 0x18]
push 4
mov eax, 2
call fcn.00536400
add esp, 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp + 0x18]
mov ebx, dword [ebx]
mov dword [ebp - 0x38], ebx
call fcn.0049d8c2
mov dword [ebp - 0x3c], ecx
mov edi, dword [ebp - 0x38]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x50508f
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x38]
call fcn.005355ad
add esp, 8
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x3c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x34]
push edi
test eax, eax
je 0x5050d4
push eax
mov ebx, eax
call fcn.0049d8e2
inc eax
push eax
call fcn.00535595
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x5050e7
push ebx
call fcn.0053558f
add esp, 4
add dword [ebp - 0x14], 0x10
pop eax
pop ebx
pop ecx
jmp 0x504c2f
add esp, 0xc
mov dword [ebp - 0x30], esp
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.wtsapi32.dll_WTSFreeMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x30], esp
je 0x505119
push 6
call fcn.0053559b
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x505121
push eax
mov ebx, dword [ebp - 0x1c]
push ebx
add ebx, 8
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x505139
push ebx
call fcn.0053558f
add esp, 4
pop ebx
call fcn.0053558f
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x505152
push ebx
call fcn.0053558f
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x505162
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x20