Function at 0x140003d70
Capabilities:
Create process on windows
Enumerate process modules
Enumerate processes on remote desktop session host

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xor r15d, r15d
lea rax, [rbp + 0x250]
mov r14, rdx
mov qword [rsp + 0x60], r15
mov esi, ecx
mov qword [rsp + 0x70], r15
lea r9, [rsp + 0x70]
mov dword [rbp + 0x250], r15d
lea edi, [r15 + 1]
mov qword [rsp + 0x20], rax
mov r8d, edi
xor edx, edx
xor ecx, ecx
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
test eax, eax
jne 0x140003dee
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x140003f1e
lea r9, str.WTSEnumerateProcesses_failed.
mov r8d, edi
mov edx, 0x60004002
call fcn.1400065c0
jmp 0x140003f17
mov qword [rsp + 0x340], rbx
mov ebx, r15d
cmp dword [rbp + 0x250], ebx
jbe 0x140003f05
cmp qword [rsp + 0x60], r15
jne 0x140003f05
mov eax, ebx
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x70]
cmp dword [rax + rcx*8], esi
jne 0x140003ef7
mov r8d, dword [rax + rcx*8 + 4]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140003ef7
lea r9, [rbp + 0x258]
mov qword [rsp + 0x78], r15
mov r8d, 8
mov dword [rbp + 0x258], r15d
lea rdx, [rsp + 0x78]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x140003eed
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x200
call fcn.14000ce80
mov rdx, qword [rsp + 0x78]
lea r8, [rbp + 0x10]
mov rcx, qword [rsp + 0x68]
mov r9d, 0x200
call sub.PSAPI.DLL_GetModuleBaseNameA
mov r8d, 0xc
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x10]
call fcn.14003270c
test eax, eax
jne 0x140003eed
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
lea edx, [rax + 0xf]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140003eed
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x140003eed
lea r9, str.OpenProcessToken_failed.
mov r8d, edi
mov edx, 0x60004002
call fcn.1400065c0
lea rcx, [rsp + 0x68]
call fcn.1400077a0
inc ebx
cmp ebx, dword [rbp + 0x250]
jb 0x140003e05
mov rcx, qword [rsp + 0x70]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rbx, qword [rsp + 0x340]
mov rcx, qword [0x140075cd8]
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140003f56
test rcx, rcx
je 0x140003f45
lea r9, str.GetSystemToken_failed_to_get_a_token.__Session_id__u
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov edx, 0x60004002
call fcn.1400065c0
xor eax, eax
add rsp, 0x310
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
xorps xmm1, xmm1
mov qword [rbp - 0x70], rcx
xorps xmm0, xmm0
mov qword [rbp], rcx
xor r9d, r9d
lea rcx, str.WinSta0Default
mov r8, r14
movups xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x50], rcx
xor edx, edx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x20
movups xmmword [rbp - 0x60], xmm1
mov dword [rsp + 0x28], r15d
movups xmmword [rbp - 0x20], xmm1
mov qword [rsp + 0x20], r15
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x60], 0x68
movups xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x20], r15w
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x10], xmm1
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x140004003
mov rcx, qword [0x140075cd8]
test rcx, rcx
je 0x140004000
lea r9, str.CreateProcessAsUser_failed.__Session_id__u
mov dword [rsp + 0x20], esi
mov r8d, edi
mov edx, 0x60004002
call fcn.1400065c0
mov edi, r15d
lea rcx, [rbp - 0x80]
call fcn.1400077a0
lea rcx, [rsp + 0x60]
call fcn.1400077a0
lea rcx, [rbp - 0x78]
call fcn.1400077a0
mov eax, edi
add rsp, 0x310
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret