Function at 0x180006c10
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov rax, qword [0x1800c3380]
xor rax, rbp
mov qword [rbp - 8], rax
mov ecx, dword [0x1800c6ba4]
mov eax, dword [0x1800c6ba0]
mov edx, ecx
sub edx, 0xc31956b0
sub edx, 1
add edx, 0xc31956b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [rbp - 0x42], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [rbp - 0x41], al
mov dword [rbp - 0x48], 0x30528cac
mov eax, dword [rbp - 0x48]
mov dword [rbp - 0x4c], eax
sub eax, 0x815cea6a
je 0x18000742c
jmp 0x180006c7f
mov eax, dword [rbp - 0x4c]
sub eax, 0x83701abc
je 0x180007003
jmp 0x180006c92
mov eax, dword [rbp - 0x4c]
sub eax, 0x838d6749
je 0x180006edd
jmp 0x180006ca5
mov eax, dword [rbp - 0x4c]
sub eax, 0x8c36684d
je 0x180006fe8
jmp 0x180006cb8
mov eax, dword [rbp - 0x4c]
sub eax, 0x8d46ee35
je 0x18000744f
jmp 0x180006ccb
mov eax, dword [rbp - 0x4c]
sub eax, 0x93789cb9
je 0x18000749a
jmp 0x180006cde
mov eax, dword [rbp - 0x4c]
sub eax, 0xa0933187
je 0x180007052
jmp 0x180006cf1
mov eax, dword [rbp - 0x4c]
sub eax, 0xad4f37fc
je 0x18000731f
jmp 0x180006d04
mov eax, dword [rbp - 0x4c]
sub eax, 0xbf5b4313
je 0x18000714a
jmp 0x180006d17
mov eax, dword [rbp - 0x4c]
sub eax, 0xd35efbae
je 0x1800072ef
jmp 0x180006d2a
mov eax, dword [rbp - 0x4c]
sub eax, 0x3416142
je 0x180007415
jmp 0x180006d3d
mov eax, dword [rbp - 0x4c]
sub eax, 0xd7b3995
je 0x180007232
jmp 0x180006d50
mov eax, dword [rbp - 0x4c]
sub eax, 0xfc6ac88
je 0x1800073ea
jmp 0x180006d63
mov eax, dword [rbp - 0x4c]
sub eax, 0x137ebf3c
je 0x1800070fe
jmp 0x180006d76
mov eax, dword [rbp - 0x4c]
sub eax, 0x2a176447
je 0x1800073f6
jmp 0x180006d89
mov eax, dword [rbp - 0x4c]
sub eax, 0x30528cac
je 0x180006e85
jmp 0x180006d9c
mov eax, dword [rbp - 0x4c]
sub eax, 0x42e91523
je 0x180007281
jmp 0x180006daf
mov eax, dword [rbp - 0x4c]
sub eax, 0x4b94fb8a
je 0x180006f84
jmp 0x180006dc2
mov eax, dword [rbp - 0x4c]
sub eax, 0x506fc1ec
je 0x180006f90
jmp 0x180006dd5
mov eax, dword [rbp - 0x4c]
sub eax, 0x5f1b2520
je 0x1800074c1
jmp 0x180006de8
mov eax, dword [rbp - 0x4c]
sub eax, 0x60299963
je 0x180007226
jmp 0x180006dfb
mov eax, dword [rbp - 0x4c]
sub eax, 0x63a68be1
je 0x180007409
jmp 0x180006e0e
mov eax, dword [rbp - 0x4c]
sub eax, 0x64c1a5bf
je 0x1800072fb
jmp 0x180006e21
mov eax, dword [rbp - 0x4c]
sub eax, 0x6867a972
je 0x180007369
jmp 0x180006e34
mov eax, dword [rbp - 0x4c]
sub eax, 0x70fc7b12
je 0x18000745b
jmp 0x180006e47
mov eax, dword [rbp - 0x4c]
sub eax, 0x712d197d
je 0x1800070f2
jmp 0x180006e5a
mov eax, dword [rbp - 0x4c]
sub eax, 0x75ebf522
je 0x180007482
jmp 0x180006e6d
mov eax, dword [rbp - 0x4c]
sub eax, 0x79ec9b10
je 0x180007199
jmp 0x180006e80
jmp 0x1800074c8
mov r11b, byte [rbp - 0x42]
mov r10b, byte [rbp - 0x41]
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8d46ee35
mov ecx, 0x838d6749
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.180088eb0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
call fcn.180088eb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov ecx, dword [0x1800c6ba4]
mov eax, dword [0x1800c6ba0]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8d46ee35
mov ecx, 0x4b94fb8a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x506fc1ec
jmp 0x1800074c8
mov eax, 0x10
call fcn.180088eb0
sub rsp, rax
mov r9, rsp
mov rax, qword [rbp - 0x38]
mov dword [rax], 0
mov qword [r9], 0
mov rax, qword [rbp - 0x38]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x29], al
mov dword [rbp - 0x48], 0x8c36684d
jmp 0x1800074c8
mov dl, byte [rbp - 0x29]
mov eax, 0xd7b3995
mov ecx, 0x83701abc
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov eax, dword [0x1800c6ba4]
mov ecx, dword [0x1800c6ba0]
mov edx, eax
add edx, 0xc1bb59f6
sub edx, 1
sub edx, 0xc1bb59f6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70fc7b12
mov ecx, 0xa0933187
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
lea rcx, [0x1800c4900]
lea rdx, [0x1800af4b8]
sub rsp, 0x20
call fcn.180010050
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov ecx, dword [0x1800c6ba4]
mov eax, dword [0x1800c6ba0]
mov edx, ecx
sub edx, 0xb236641a
sub edx, 1
add edx, 0xb236641a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x70fc7b12
mov ecx, 0x712d197d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x137ebf3c
jmp 0x1800074c8
mov rax, qword [rbp - 0x38]
mov edx, dword [rax]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.180013460
add rsp, 0x20
mov rcx, rax
lea rdx, [0x1800147f0]
sub rsp, 0x20
call fcn.180014480
add rsp, 0x20
mov rax, qword [rbp - 0x38]
cmp dword [rax], 0x82
setbe al
and al, 1
mov byte [rbp - 0x19], al
mov dword [rbp - 0x48], 0xbf5b4313
jmp 0x1800074c8
mov eax, dword [0x1800c6ba4]
mov ecx, dword [0x1800c6ba0]
mov edx, eax
sub edx, 0x60819f14
sub edx, 1
add edx, 0x60819f14
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x75ebf522
mov ecx, 0x79ec9b10
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov rax, qword [rbp - 0x40]
mov cl, byte [rbp - 0x19]
and cl, 1
mov byte [rax], cl
mov ecx, dword [0x1800c6ba4]
mov eax, dword [0x1800c6ba0]
mov edx, ecx
sub edx, 0x144fd3a1
sub edx, 1
add edx, 0x144fd3a1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x75ebf522
mov ecx, 0x60299963
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x3416142
jmp 0x1800074c8
mov eax, dword [0x1800c6ba4]
mov ecx, dword [0x1800c6ba0]
mov edx, eax
add edx, 0x3dd9aedb
sub edx, 1
sub edx, 0x3dd9aedb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93789cb9
mov ecx, 0x42e91523
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
lea rcx, [0x1800c4a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.180010050
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov eax, dword [0x1800c6ba4]
mov ecx, dword [0x1800c6ba0]
mov edx, eax
sub edx, 0xb006400c
sub edx, 1
add edx, 0xb006400c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93789cb9
mov ecx, 0xd35efbae
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x64c1a5bf
jmp 0x1800074c8
mov rcx, qword [rbp - 0x18]
lea rdx, [0x1800147f0]
sub rsp, 0x20
call fcn.180014480
add rsp, 0x20
mov dword [rbp - 0x48], 0xad4f37fc
jmp 0x1800074c8
mov eax, dword [0x1800c6ba4]
mov ecx, dword [0x1800c6ba0]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f1b2520
mov ecx, 0x6867a972
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov ecx, dword [0x1800c6ba4]
mov eax, dword [0x1800c6ba0]
mov edx, ecx
sub edx, 0x5c680ae4
sub edx, 1
add edx, 0x5c680ae4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f1b2520
mov ecx, 0xfc6ac88
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x48], eax
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x2a176447
jmp 0x1800074c8
mov rax, qword [rbp - 0x40]
mov byte [rax], 1
mov dword [rbp - 0x48], 0x63a68be1
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x3416142
jmp 0x1800074c8
mov rax, qword [rbp - 0x40]
mov al, byte [rax]
and al, 1
mov byte [rbp - 9], al
mov dword [rbp - 0x48], 0x815cea6a
jmp 0x1800074c8
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov dword [rbp - 0x5c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.180088f10
mov eax, dword [rbp - 0x5c]
mov rsp, rbp
pop rbp
ret
mov dword [rbp - 0x48], 0x838d6749
jmp 0x1800074c8
lea rcx, [0x1800c4900]
lea rdx, [0x1800af4b8]
sub rsp, 0x20
call fcn.180010050
add rsp, 0x20
mov dword [rbp - 0x48], 0xa0933187
jmp 0x1800074c8
mov rax, qword [rbp - 0x40]
mov cl, byte [rbp - 0x19]
and cl, 1
mov byte [rax], cl
mov dword [rbp - 0x48], 0x79ec9b10
jmp 0x1800074c8
lea rcx, [0x1800c4a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.180010050
add rsp, 0x20
mov dword [rbp - 0x48], 0x42e91523
jmp 0x1800074c8
mov dword [rbp - 0x48], 0x6867a972
jmp 0x180006c69