Function at 0x14005eeb0
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140214ba0]
xor rax, rsp
mov qword [rbp + 0x168], rax
mov rdi, rcx
mov dword [rbp + 0x150], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea rsi, vtable.std::ios_base.0
xor r14d, r14d
mov ebx, dword [rbp + 0x150]
test eax, eax
jne 0x14005f006
cmp ebx, 0xffffffff
jne 0x14005f006
call fcn.1400553d0
lea r8d, [r14 + 2]
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.140055290
lea rbx, str.SessionUtils.cpp
mov qword [rbp + 0x130], rbx
mov dword [rbp + 0x138], 0x4d
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x30]
call fcn.1400244b0
lea rdx, str.ProcessIdToSessionId_failed:
lea rcx, [rbp + 0x30]
call fcn.1400244e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.140030540
lea rcx, [rbp + 0xc8]
call fcn.140058d50
nop
mov qword [rbp + 0xc8], rsi
lea rcx, [rbp + 0xc8]
call fcn.140128970
nop
mov qword [rbp + 0x128], r14
mov dword [rbp + 0x154], r14d
lea rax, [rbp + 0x154]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x128]
mov edx, 0xffffffff
xor ecx, ecx
lea r8d, [r14 + 4]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14005f0cc
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x14005f0cc
cmp dword [rbp + 0x154], 4
jne 0x14005f0cc
mov ebx, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov dword [rbp + 0x158], ebx
cmp ebx, 0xffffffff
jne 0x14005f157
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.sess
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], 4
movaps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x130], xmm0
mov r9d, eax
mov r8d, 0x9e
lea rdx, [rbp + 0x130]
mov rcx, rdi
call fcn.14005d2e0
call fcn.1400553d0
mov r8d, 1
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140055290
lea rax, str.ClientPipeCommunications.cpp
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], 0x9f
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x38]
call fcn.1400244b0
lea rdx, str.Failed_to_retrieve_user_session_ID
lea rcx, [rsp + 0x38]
call fcn.1400244e0
lea rcx, [rbp - 0x30]
call fcn.140058d50
nop
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.140128970
nop
xor al, al
jmp 0x14005f2fb
call fcn.1400553d0
mov r8d, 1
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140055290
mov qword [rbp + 0x130], rbx
mov dword [rbp + 0x138], 0x57
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x38]
call fcn.1400244b0
lea rdx, str.WTSQuerySessionInformation_failed:
lea rcx, [rsp + 0x38]
call fcn.1400244e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140030540
lea rcx, [rbp - 0x30]
call fcn.140058d50
nop
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.140128970
nop
mov dword [rbp + 0x158], 0xffffffff
jmp 0x14005f015
mov dword [rbp + 0x15c], r14d
mov qword [rbp + 0x160], r14
lea rax, [rbp + 0x15c]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x158]
mov rdx, qword [rdi + 0x90]
lea rcx, [rbp + 0x160]
call fcn.140069350
nop
mov rbx, qword [rbp + 0x160]
test rbx, rbx
jne 0x14005f258
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.auth_buf
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], 8
movaps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x130], xmm0
mov r9d, eax
mov r8d, 0xab
lea rdx, [rbp + 0x130]
mov rcx, rdi
call fcn.14005d2e0
call fcn.1400553d0
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140055290
lea rax, str.ClientPipeCommunications.cpp
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], 0xac
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x38]
call fcn.1400244b0
lea rdx, str.Failed_to_generate_authenticated_buffer
lea rcx, [rsp + 0x38]
call fcn.1400244e0
lea rcx, [rbp - 0x30]
call fcn.140058d50
nop
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.140128970
nop
xor dil, dil
jmp 0x14005f2e6
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov esi, dword [rbp + 0x15c]
lea rax, [0x1401eaf60]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x140], r14
lea edx, [rsi + 0xb]
lea rcx, [rbp + 0x130]
call fcn.140064460
test al, al
je 0x14005f2a3
mov r8d, esi
mov rdx, rbx
lea rcx, [rbp + 0x130]
call fcn.1400642b0
nop
call fcn.140129c4c
mov qword [rdi + 0x558], rax
mov dword [rdi + 0x230], 2
mov r8d, dword [rbp + 0x138]
mov rbx, qword [rbp + 0x140]
mov rdx, rbx
mov rcx, rdi
call fcn.14006a490
test al, al
setne dil
test rbx, rbx
je 0x14005f2e6
mov rcx, rbx
call fcn.14014f900
nop
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14005f2f7
call fcn.14014f900
movzx eax, dil
mov rcx, qword [rbp + 0x168]
xor rcx, rsp
call fcn.14014f8e0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret