Function at 0x14000ee50
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x1400cd090]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, r8
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x38], edx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
mov qword [r11 - 0xa8], rbx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov qword [r11 - 0xb0], r12
mov dword [r11 - 0x80], r12d
mov qword [r11 - 0x58], r12
mov qword [r11 - 0x48], r12
mov r15d, 7
mov qword [r11 - 0x40], r15
mov word [r11 - 0x58], r12w
lea rdx, [0x1400c0c28]
lea rcx, [r11 - 0xa0]
call fcn.140006210
nop
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor edx, edx
xor ecx, ecx
lea r8d, [r12 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
mov r13, qword [rsp + 0xe0]
test eax, eax
je 0x14000f3d6
mov eax, r12d
movabs rdx, 0x7ffffffffffffffe
mov dword [rsp + 0x34], eax
cmp eax, dword [rsp + 0xb8]
jae 0x14000f3d1
lea rcx, [rax + rax*2]
lea rcx, [rcx*8]
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x88]
mov r14, qword [rcx + rax + 8]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x14000ef52
cmp rsi, r15
ja 0x14000efb1
lea rdi, [rsp + 0xe0]
cmp r15, 8
cmovae rdi, r13
mov qword [rsp + 0xf0], rsi
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.14006d010
mov word [rbx + rdi], r12w
mov r15, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xe0]
xor r9d, r9d
jmp 0x14000f076
cmp rsi, rdx
ja 0x14000f4f2
mov rdi, r15
mov r15, rsi
or r15, 7
cmp r15, rdx
jbe 0x14000efce
mov r15, rdx
jmp 0x14000efef
mov rcx, rdi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rdi, rax
jbe 0x14000efe4
mov r15, rdx
jmp 0x14000efef
lea rax, [rdi + rcx]
cmp r15, rax
cmovb r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsp + 0xe0]
call fcn.14000a4c0
mov r12, rax
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], r15
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.14006d010
xor r9d, r9d
mov word [rbx + r12], r9w
cmp rdi, 8
jb 0x14000f06b
lea rdx, [rdi*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000f060
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f4f8
mov rcx, r13
call fcn.140016fe8
xor r9d, r9d
mov qword [rsp + 0xe0], r12
mov r13, r12
mov rax, qword [rsp + 0x88]
mov r12, qword [rsp + 0x48]
mov r12, qword [r12 + rax + 8]
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x48], r8
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [r12 + rdi*2], 0
jne 0x14000f0a0
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r8
cmp rax, rdi
jb 0x14000f4fe
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rdx, qword [rsp + 0x98]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xd8], r9
lea rax, [r8 + rdi]
mov qword [rsp + 0x40], rax
mov ebx, 7
lea r14, [rsp + 0xc0]
cmp rax, rbx
jbe 0x14000f1cd
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x14000f139
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000f169
cmp rbx, 0xa
mov ecx, 0xa
cmovb rbx, rcx
lea rcx, [rbx + 1]
movabs r10, 0x7fffffffffffffff
cmp rcx, r10
ja 0x14000f503
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000f1a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000f508
mov rcx, rax
call fcn.140016d5c
test rax, rax
je 0x14000f514
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x48]
jmp 0x14000f1c5
test rcx, rcx
je 0x14000f1c2
call fcn.140016d5c
mov r14, rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x48]
jmp 0x14000f1c5
mov r14, r9
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rbx
lea rbx, [r8 + r8]
mov r8, rbx
mov rcx, r14
call fcn.14006d010
lea rcx, [rbx + r14]
lea r8, [rdi + rdi]
mov rdx, r12
call fcn.14006d010
mov rax, qword [rsp + 0x40]
xor r12d, r12d
mov word [r14 + rax*2], r12w
mov r14d, dword [rsp + 0x30]
or r14d, 2
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
sub rax, rdi
cmp rax, 3
jb 0x14000f274
lea rax, [rdi + 3]
mov qword [rsp + 0xd0], rax
lea rbx, [rsp + 0xc0]
cmp rcx, 8
cmovae rbx, qword [rsp + 0xc0]
lea rcx, [rbx + rdi*2]
lea r8d, [r12 + 6]
lea rdx, [0x1400c0fd8]
call fcn.14006d010
mov word [rbx + rdi*2 + 6], r12w
lea rax, [rsp + 0xc0]
jmp 0x14000f298
mov qword [rsp + 0x20], 3
lea r9, [0x1400c0fd8]
xor r8d, r8d
lea edx, [r8 + 3]
lea rcx, [rsp + 0xc0]
call fcn.1400097c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or r14d, 4
mov dword [rsp + 0x30], r14d
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x14000f314
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f305
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f50e
call fcn.140016fe8
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm1
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x14000f36c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f367
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f514
call fcn.140016fe8
mov rbx, qword [rsp + 0x58]
cmp dword [rsp + 0x38], 9
jne 0x14000f449
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000f389
mov rax, qword [rbx]
lea rdx, [rsp + 0xe0]
cmp r15, 8
cmovae rdx, r13
cmp rsi, qword [rbx + 0x10]
jne 0x14000f43f
test rsi, rsi
je 0x14000f3c7
sub rdx, rax
nop dword [rax + rax]
movzx ecx, word [rax]
cmp word [rdx + rax], cx
jne 0x14000f43f
add rax, 2
sub rsi, 1
jne 0x14000f3b0
mov dword [0x1400d0298], 8
mov rdi, qword [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0xa8]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], r12w
cmp r15, 8
jb 0x14000f45d
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000f454
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f51a
jmp 0x14000f454
mov dword [0x1400d0298], 7
mov eax, dword [rsp + 0x34]
inc eax
jmp 0x14000ef12
mov rcx, r13
call fcn.140016fe8
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000f498
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000f493
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f4ec
mov rcx, r8
call fcn.140016fe8
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rax, rdi
jmp 0x14000f4bf
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140016aa0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140071b2c
nop
call fcn.140001580
nop
call fcn.140071b2c
int3
call fcn.140001580
call fcn.1400014e0
call fcn.1400014e0
nop
call fcn.140071b2c
nop
call fcn.140071b2c
nop
call fcn.140071b2c
int3