Function at 0x180006650
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rax, qword [0x1800d1380]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x38], 0xb75e77d7
mov eax, dword [rbp - 0x38]
mov dword [rbp - 0x3c], eax
sub eax, 0x8997fa40
je 0x18000716a
jmp 0x180006685
mov eax, dword [rbp - 0x3c]
sub eax, 0x96fd151a
je 0x180006c98
jmp 0x180006698
mov eax, dword [rbp - 0x3c]
sub eax, 0x9d19e5a5
je 0x180006a69
jmp 0x1800066ab
mov eax, dword [rbp - 0x3c]
sub eax, 0x9e94361d
je 0x180006e07
jmp 0x1800066be
mov eax, dword [rbp - 0x3c]
sub eax, 0xa33f2090
je 0x180006bb5
jmp 0x1800066d1
mov eax, dword [rbp - 0x3c]
sub eax, 0xab6b216a
je 0x180006ab8
jmp 0x1800066e4
mov eax, dword [rbp - 0x3c]
sub eax, 0xabfc0557
je 0x180006d86
jmp 0x1800066f7
mov eax, dword [rbp - 0x3c]
sub eax, 0xb454bc41
je 0x180006f67
jmp 0x18000670a
mov eax, dword [rbp - 0x3c]
sub eax, 0xb4b575d3
je 0x18000690a
jmp 0x18000671d
mov eax, dword [rbp - 0x3c]
sub eax, 0xb75e77d7
je 0x1800068ea
jmp 0x180006730
mov eax, dword [rbp - 0x3c]
sub eax, 0xbb2aac05
je 0x180007122
jmp 0x180006743
mov eax, dword [rbp - 0x3c]
sub eax, 0xbfaa5ff7
je 0x180006e62
jmp 0x180006756
mov eax, dword [rbp - 0x3c]
sub eax, 0xceffa1be
je 0x180007075
jmp 0x180006769
mov eax, dword [rbp - 0x3c]
sub eax, 0xcf8c0067
je 0x180006b8a
jmp 0x18000677c
mov eax, dword [rbp - 0x3c]
sub eax, 0xd0019ef4
je 0x1800070e5
jmp 0x18000678f
mov eax, dword [rbp - 0x3c]
sub eax, 0xd069c755
je 0x180006b3c
jmp 0x1800067a2
mov eax, dword [rbp - 0x3c]
sub eax, 0xd595ce73
je 0x180006c04
jmp 0x1800067b5
mov eax, dword [rbp - 0x3c]
sub eax, 0xd759e383
je 0x180006cee
jmp 0x1800067c8
mov eax, dword [rbp - 0x3c]
sub eax, 0xe2e8c9a2
je 0x180006f73
jmp 0x1800067db
mov eax, dword [rbp - 0x3c]
sub eax, 0xecee39c3
je 0x180006d6a
jmp 0x1800067ee
mov eax, dword [rbp - 0x3c]
sub eax, 0xf3986878
je 0x180006b6c
jmp 0x180006801
mov eax, dword [rbp - 0x3c]
sub eax, 0xf5d3044e
je 0x180006ff4
jmp 0x180006814
mov eax, dword [rbp - 0x3c]
sub eax, 0x3eb72ae
je 0x180006ede
jmp 0x180006827
mov eax, dword [rbp - 0x3c]
sub eax, 0x751efd8
je 0x180007146
jmp 0x18000683a
mov eax, dword [rbp - 0x3c]
sub eax, 0x11ec6f14
je 0x180006ca4
jmp 0x18000684d
mov eax, dword [rbp - 0x3c]
sub eax, 0x21ed747c
je 0x180007098
jmp 0x180006860
mov eax, dword [rbp - 0x3c]
sub eax, 0x2605a526
je 0x18000715e
jmp 0x180006873
mov eax, dword [rbp - 0x3c]
sub eax, 0x40d36e36
je 0x180006e56
jmp 0x180006886
mov eax, dword [rbp - 0x3c]
sub eax, 0x4455c622
je 0x180007152
jmp 0x180006899
mov eax, dword [rbp - 0x3c]
sub eax, 0x4f078d57
je 0x180006d76
jmp 0x1800068ac
mov eax, dword [rbp - 0x3c]
sub eax, 0x4f33a6e3
je 0x180006a4e
jmp 0x1800068bf
mov eax, dword [rbp - 0x3c]
sub eax, 0x5214ee8c
je 0x180006986
jmp 0x1800068d2
mov eax, dword [rbp - 0x3c]
sub eax, 0x74957f07
je 0x180006b48
jmp 0x1800068e5
jmp 0x180007171
mov eax, 0x10
call fcn.180097420
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x38], 0xb4b575d3
jmp 0x180007171
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x21ed747c
mov ecx, 0x5214ee8c
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov eax, 0x10
call fcn.180097420
sub rsp, rax
mov r9, rsp
mov rax, qword [rbp - 0x30]
mov dword [rax], 0
mov qword [r9], 0
mov rax, qword [rbp - 0x30]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
cmp eax, 0
setne al
and al, 1
mov byte [rbp - 0x21], al
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x21ed747c
mov ecx, 0x4f33a6e3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov dl, byte [rbp - 0x21]
mov eax, 0xcf8c0067
mov ecx, 0x9d19e5a5
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov eax, dword [0x1800d4c34]
mov ecx, dword [0x1800d4c30]
mov edx, eax
sub edx, 0xbff41237
sub edx, 1
add edx, 0xbff41237
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0019ef4
mov ecx, 0xab6b216a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
lea rcx, [0x1800d2900]
lea rdx, [0x1800bd4b8]
sub rsp, 0x20
call fcn.180010930
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.180013d50
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov eax, dword [0x1800d4c34]
mov ecx, dword [0x1800d4c30]
mov edx, eax
sub edx, 0xb56f9f25
sub edx, 1
add edx, 0xb56f9f25
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd0019ef4
mov ecx, 0xd069c755
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov dword [rbp - 0x38], 0x74957f07
jmp 0x180007171
mov rcx, qword [rbp - 0x20]
lea rdx, [0x180014d30]
sub rsp, 0x20
call fcn.180014ad0
add rsp, 0x20
mov dword [rbp - 0x38], 0xf3986878
jmp 0x180007171
mov rax, qword [rbp - 0x30]
cmp dword [rax], 0x82
setbe al
and al, 1
mov byte [rbp - 0x31], al
mov dword [rbp - 0x38], 0xbfaa5ff7
jmp 0x180007171
lea rcx, [0x1800d2a30]
lea rdx, str.Error_enumerating_processes.
sub rsp, 0x20
call fcn.180010930
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x38], 0xa33f2090
jmp 0x180007171
mov eax, dword [0x1800d4c34]
mov ecx, dword [0x1800d4c30]
mov edx, eax
add edx, 0x75165b01
sub edx, 1
sub edx, 0x75165b01
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb2aac05
mov ecx, 0xd595ce73
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov rcx, qword [rbp - 0x18]
lea rdx, [0x180014d30]
sub rsp, 0x20
call fcn.180014ad0
add rsp, 0x20
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb2aac05
mov ecx, 0x96fd151a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov dword [rbp - 0x38], 0x11ec6f14
jmp 0x180007171
mov eax, dword [0x1800d4c34]
mov ecx, dword [0x1800d4c30]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x751efd8
mov ecx, 0xd759e383
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x751efd8
mov ecx, 0xecee39c3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov dword [rbp - 0x38], 0x4f078d57
jmp 0x180007171
mov byte [rbp - 0x31], 1
mov dword [rbp - 0x38], 0xabfc0557
jmp 0x180007171
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
mov edx, ecx
add edx, 0xc268a280
sub edx, 1
sub edx, 0xc268a280
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4455c622
mov ecx, 0x9e94361d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov eax, dword [0x1800d4c34]
mov ecx, dword [0x1800d4c30]
mov edx, eax
add edx, 0x3891ea67
sub edx, 1
sub edx, 0x3891ea67
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4455c622
mov ecx, 0x40d36e36
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov dword [rbp - 0x38], 0xbfaa5ff7
jmp 0x180007171
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2605a526
mov ecx, 0x3eb72ae
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov al, byte [rbp - 0x31]
and al, 1
mov byte [rbp - 9], al
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
mov edx, ecx
add edx, 0xd4acf2d9
sub edx, 1
sub edx, 0xd4acf2d9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2605a526
mov ecx, 0xb454bc41
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov dword [rbp - 0x38], 0xe2e8c9a2
jmp 0x180007171
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
mov edx, ecx
sub edx, 0xa3806209
sub edx, 1
add edx, 0xa3806209
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8997fa40
mov ecx, 0xf5d3044e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov ecx, dword [0x1800d4c34]
mov eax, dword [0x1800d4c30]
mov edx, ecx
add edx, 0x18ce9ec4
sub edx, 1
sub edx, 0x18ce9ec4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8997fa40
mov ecx, 0xceffa1be
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x38], eax
jmp 0x180007171
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov dword [rbp - 0x40], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.180097480
mov eax, dword [rbp - 0x40]
mov rsp, rbp
pop rbp
ret
mov eax, 0x10
call fcn.180097420
sub rsp, rax
mov r9, rsp
mov rax, qword [rbp - 0x30]
mov dword [rax], 0
mov qword [r9], 0
mov rax, qword [rbp - 0x30]
xor ecx, ecx
xor edx, edx
mov r8d, 1
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
add rsp, 0x30
mov dword [rbp - 0x38], 0x5214ee8c
jmp 0x180007171
lea rcx, [0x1800d2900]
lea rdx, [0x1800bd4b8]
sub rsp, 0x20
call fcn.180010930
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.180013d50
add rsp, 0x20
mov dword [rbp - 0x38], 0xab6b216a
jmp 0x180007171
mov rcx, qword [rbp - 0x18]
lea rdx, [0x180014d30]
sub rsp, 0x20
call fcn.180014ad0
add rsp, 0x20
mov dword [rbp - 0x38], 0xd595ce73
jmp 0x180007171
mov dword [rbp - 0x38], 0xd759e383
jmp 0x180007171
mov dword [rbp - 0x38], 0x9e94361d
jmp 0x180007171
mov dword [rbp - 0x38], 0x3eb72ae
jmp 0x180007171
mov dword [rbp - 0x38], 0xf5d3044e
jmp 0x18000666f