Function at 0x57cae0
Capabilities:
Get session information
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5e80
mov eax, dword fs:[0]
push eax
mov eax, 0x224c
call fcn.0050ed70
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x224c], ebx
mov dword [ebp - 0x2238], ebx
mov dword [ebp - 0x2248], 0
call fcn.004b4040
mov ecx, eax
test ecx, ecx
je 0x57cfdf
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2230], esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x2240]
mov dword [ebp - 0x2240], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x57cf94
mov dword [ebp - 0x2228], 0
call fcn.004b4040
mov ecx, eax
test ecx, ecx
je 0x57cfe9
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, eax
lea eax, [ebx + 0x10]
mov dword [ebp - 0x2234], eax
mov byte [ebp - 4], 1
call fcn.004b4040
mov ecx, eax
test ecx, ecx
je 0x57cff3
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x223c], edi
lea eax, [ebp - 0x2250]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x2228]
push eax
push 5
push dword [ebp - 0x2240]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x57cf1a
mov eax, dword [ebp - 0x2228]
test eax, eax
je 0x57cf1a
push eax
lea ecx, [ebp - 0x2234]
call fcn.004c36d0
push dword [ebp - 0x2228]
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0x2250]
mov dword [ebp - 0x2228], 0
push eax
lea eax, [ebp - 0x2228]
push eax
push 7
push dword [ebp - 0x2240]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x57ce9b
mov eax, dword [ebp - 0x2228]
test eax, eax
je 0x57ce9b
push eax
lea ecx, [ebp - 0x223c]
call fcn.004c36d0
push dword [ebp - 0x2228]
call sub.WTSAPI32.dll_WTSFreeMemory
lea ecx, [ebp - 0x222c]
call fcn.004c2910
mov esi, dword [ebp - 0x223c]
mov byte [ebp - 4], 4
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x57cc88
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x57cc9e
call fcn.004b4040
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x57cffd
mov eax, dword [ecx]
call dword [eax + 0xc]
push 1
push 0x64528c
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x2248], 2
mov dword [ebp - 0x2224], eax
lea eax, [ebp - 0x2224]
push esi
push eax
call fcn.004c58a0
add esp, 0x14
mov esi, dword [ebp - 0x2224]
mov byte [ebp - 4], 5
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x57ccec
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x57cd02
call fcn.004b4040
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x57d007
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2248], 6
mov dword [ebp - 0x2244], eax
mov eax, dword [ebp - 0x2234]
push dword [eax - 0xc]
push eax
push dword [esi - 0xc]
lea eax, [ebp - 0x2244]
push esi
push eax
call fcn.004c58a0
mov eax, dword [ebp - 0x2244]
add esp, 0x14
mov esi, dword [ebp - 0x222c]
lea edx, [eax - 0x10]
lea edi, [esi - 0x10]
cmp edx, edi
je 0x57cd9b
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x57cd86
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x57cd86
push edx
call fcn.004bfdc0
add esp, 4
mov ebx, eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x57cd7b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [ebx + 0x10]
mov dword [ebp - 0x222c], esi
jmp 0x57cd9b
push dword [eax - 0xc]
lea ecx, [ebp - 0x222c]
push eax
call fcn.004c0470
mov esi, dword [ebp - 0x222c]
lea ecx, [ebp - 0x2244]
call fcn.004b2a80
lea ecx, [ebp - 0x2224]
mov byte [ebp - 4], 3
call fcn.004b2a80
push 0x2004
lea eax, [ebp - 0x2220]
push 0
push eax
call fcn.0058c8f0
push 0x20c
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0058c8f0
add esp, 0x18
mov dword [ebp - 0x224c], 0x1000
lea eax, [ebp - 0x2258]
mov dword [ebp - 0x2254], 0x105
push eax
lea eax, [ebp - 0x2254]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224c]
push eax
lea eax, [ebp - 0x2220]
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x57ce52
lea eax, [ebp - 0x2224]
push eax
lea eax, [ebp - 0x2220]
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidW
push dword [ebp - 0x2224]
lea ecx, [ebp - 0x2230]
call fcn.004c36d0
push dword [ebp - 0x2224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x2238]
lea eax, [ebp - 0x2230]
push eax
call fcn.004b2f20
lea ecx, [ebp - 0x222c]
call fcn.004b2a80
lea ecx, [ebp - 0x223c]
call fcn.004b2a80
lea ecx, [ebp - 0x2234]
call fcn.004b2a80
lea ecx, [ebp - 0x2230]
call fcn.004b2a80
mov eax, dword [ebp - 0x2238]
jmp 0x57cfc3
lea eax, [esi - 0x10]
push eax
mov dword [ebp - 0x2224], eax
call fcn.004bfdc0
mov ebx, dword [ebp - 0x2238]
add eax, 0x10
or esi, 0xffffffff
mov byte [ebp - 4], 1
add esp, 4
add edi, 0xfffffff0
mov dword [ebx], eax
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x57ced6
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2234]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x57cef7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2224]
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x57cfc1
mov ecx, dword [edx]
push edx
jmp 0x57cfbc
lea eax, [esi - 0x10]
push eax
mov dword [ebp - 0x2224], eax
call fcn.004bfdc0
mov ecx, dword [ebp - 0x2238]
add eax, 0x10
or esi, 0xffffffff
mov byte [ebp - 4], 1
add esp, 4
add edi, 0xfffffff0
mov dword [ecx], eax
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x57cf55
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x57cf6d
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2224]
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x57cf8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2238]
jmp 0x57cfc3
add esi, 0xfffffff0
push esi
call fcn.004bfdc0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x57cfc1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004b3510
push 0x80004005
call fcn.004b3510
push 0x80004005
call fcn.004b3510
push 0x80004005
call fcn.004b3510
push 0x80004005
call fcn.004b3510
int3