Function at 0x402d20
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x488
xor r13d, r13d
xor r14d, r14d
mov rsi, rdx
mov ebp, ecx
call fcn.004016c0
lea rcx, [rsi + 8]
mov eax, 1
cmp eax, ebp
jge 0x403035
mov rbx, qword [rcx]
cmp byte [rbx], 0x2d
jne 0x402dac
cmp byte [rbx + 1], 0
je 0x402dac
inc rbx
mov r8b, byte [rbx]
test r8b, r8b
je 0x402da4
cmp r8b, 0x63
je 0x402d97
jg 0x402d83
cmp r8b, 0x61
jne 0x402dcc
mov r14d, 1
jmp 0x402d62
cmp r8b, 0x73
je 0x402d9c
cmp r8b, 0x76
jne 0x402dcc
mov r13d, 1
jmp 0x402d62
xor r14d, r14d
jmp 0x402d62
mov r14d, 2
jmp 0x402d62
inc eax
add rcx, 8
jmp 0x402d4c
lea ecx, [rax + 1]
lea rdx, section..rdata
cmp ecx, ebp
cmovl eax, ecx
cmovge rbx, rdx
movsxd rdx, eax
inc eax
cmp eax, ebp
mov rsi, qword [rsi + rdx*8]
jge 0x402dda
lea rcx, str.wtssendmsg__Revision:_4120_____Display_a_message_box_on_client_desktops_nCopyright__C__2012_Christian_Franke__smartmontools.org_n_nUsage:_wtssendmsg___cas____v____Caption____Message___n_______wtssendmsg__v_n_n___c____Console_session__default__n___a____Active_sessions_n___s____Connected_sessions_n___v____List_sessions
call sub.msvcrt.dll_puts
jmp 0x402e21
lea rdx, [0x0040513d]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402e35
lea rsi, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll___iob_func]
mov r8d, 0x3ff
mov r9, rax
mov edx, 1
mov rcx, rsi
call sub.msvcrt.dll_fread
test eax, eax
jns 0x402e2b
lea rcx, str.stdin
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x40304c
cdqe
mov byte [rsp + rax + 0x80], 0
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
xor edx, edx
xor ecx, ecx
mov r8d, 1
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
test eax, eax
jne 0x402e6f
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.WTSEnumerateSessions___failed_n
lea rdx, [rax + 0x60]
call sub.msvcrt.dll_fputs
jmp 0x402e21
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
xor ebp, ebp
xor r15d, r15d
mov qword [rsp + 0x60], rax
cmp ebp, dword [rsp + 0x70]
mov dword [rsp + 0x5c], ebp
mov rcx, qword [rsp + 0x78]
jge 0x40302b
test r13d, r13d
je 0x402ee8
lea rax, [0x00405001]
lea rdx, [0x00405003]
test rsi, rsi
cmove rdx, rax
imul rax, rbp, 0x18
add rcx, rax
mov r9d, dword [rcx + 0x10]
mov r8, qword [rcx + 8]
lea rcx, str.Session__d____s___State_d__s
mov qword [rsp + 0x20], rdx
mov edx, ebp
call sub.msvcrt.dll_printf
test rsi, rsi
je 0x403023
mov rax, qword [rsp + 0x60]
call rax
lea rcx, [rax + 0x30]
call sub.msvcrt.dll_fflush
imul r12, rbp, 0x18
mov rax, qword [rsp + 0x78]
lea rdx, str.Console
mov rcx, qword [rax + r12 + 8]
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x402f2f
test r14d, r14d
je 0x403012
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + r12 + 0x10]
test eax, eax
je 0x402f2f
cmp r14d, 1
je 0x403012
dec eax
jne 0x403012
or rdx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rcx, rdx
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
mov r8, rcx
mov rcx, rdx
repne scasb al, byte [rdi]
add r8, rdx
mov rdx, qword [rsp + 0x78]
mov rax, rcx
lea rcx, [rsp + 0x74]
not rax
mov edx, dword [rdx + r12]
lea r9d, [rax - 1]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x28], r8d
xor ecx, ecx
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x30
mov r8, rbx
mov qword [rsp + 0x20], rsi
call sub.WTSAPI32.dll_WTSSendMessageA
test eax, eax
je 0x402fa9
test r13d, r13d
lea rcx, str.message_sent
je 0x403023
jmp 0x40301e
test r13d, r13d
je 0x402fc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WTSSendMessage___failed_with_error_d_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x40300a
call qword [sym.imp.KERNEL32.dll_GetLastError]
add r12, qword [rsp + 0x78]
mov r15d, eax
mov r9, qword [r12 + 8]
mov edi, dword [r12 + 0x10]
mov qword [rsp + 0x68], r9
call qword [sym.imp.msvcrt.dll___iob_func]
mov r9, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x5c]
lea rcx, [rax + 0x60]
lea rdx, str.Session__d____s___State_d_:_WTSSendMessage___failed_with_error_d_n
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
call sub.msvcrt.dll_fprintf
mov r15d, 1
jmp 0x403023
test r13d, r13d
je 0x403023
lea rcx, str.ignored
call sub.msvcrt.dll_puts
inc rbp
jmp 0x402e80
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, r15d
jmp 0x40304c
xor esi, esi
test r13d, r13d
lea rbx, section..rdata
jne 0x402e35
jmp 0x402dcc
add rsp, 0x488
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret