Function at 0x140069b90
Capabilities:
Get session information

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, r8
mov r14, rdx
mov edi, ecx
test ecx, ecx
jne 0x140069bce
call fcn.14000d080
mov rcx, rax
call fcn.14007dfa0
cmp eax, 4
jb 0x140069bce
xor al, al
jmp 0x140069d5b
mov qword [rsp + 0x60], rbp
xor bpl, bpl
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov esi, r12d
mov qword [rsp + 0x68], rbx
nop dword [rax + rax]
cmp esi, 0xa
jge 0x140069d43
lea rdx, str.Trying_to_start_app_in_session
lea rcx, [0x14047aa00]
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
mov rcx, rax
lea rdx, str.__attempt:
call fcn.140036d30
mov rcx, rax
mov edx, esi
call fcn.140028560
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov dword [rsp + 0x38], r12d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x140069d72
lea rdx, str.Session
lea rcx, [0x14047aa00]
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
mov rcx, rax
lea rdx, str._cannot_be_queried_because_it_is_closed_or_a_close_operation_is_pending.
call fcn.140036d30
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
lea rdx, str.Did_not_start_app_in_session
lea rcx, [0x14047aa00]
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
lea rdx, str.___the_session_wasnt_ready.
mov rcx, rax
call fcn.140036d30
mov rbx, rax
mov dl, 0xa
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
mov ecx, 0x3e8
inc esi
call qword [sym.imp.KERNEL32.dll_Sleep]
test bpl, bpl
je 0x140069bf0
mov r12, qword [rsp + 0x50]
movzx eax, bpl
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140282c10
add rsp, 0x70
pop r15
pop r14
pop rdi
ret
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test ebx, ebx
je 0x140069daf
lea rdx, str.Session
lea rcx, [0x14047aa00]
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
mov rcx, rax
lea rdx, str._is_not_active.
jmp 0x140069cae
mov ecx, edi
call fcn.14006a7d0
test al, al
je 0x140069cda
mov r8, r15
mov rdx, r14
mov ecx, edi
call fcn.140069e50
test al, al
je 0x140069e1d
mov rdx, r14
mov ecx, edi
call fcn.14006a4a0
lea rcx, [0x14047aa00]
test al, al
je 0x140069e02
lea rdx, str.Successfully_started_app_in_session
mov bpl, 1
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
jmp 0x140069d06
lea rdx, str.Failed_to_start_starting_app_in_session
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
jmp 0x140069d06
lea rdx, str.Did_not_start_app_in_session
lea rcx, [0x14047aa00]
call fcn.140036d30
mov rcx, rax
mov edx, edi
call fcn.1400283a0
lea rdx, str.___it_is_possible_that_no_user_is_logged_in.
jmp 0x140069cfe