Function at 0x1000dae0
Capabilities:
Check os version
Get session information
Get session user name

Disassembly:
sub esp, 0x458
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x454], eax
push ebx
push ebp
mov ebp, dword [esp + 0x464]
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x155]
push ebx
push eax
mov edi, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x15c], bl
call fcn.1001f410
add esp, 0xc
push 0x7f
lea ecx, [esp + 0xd5]
push ebx
push ecx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0xdc], bl
call fcn.1001f410
add esp, 0xc
push 0x7f
lea edx, [esp + 0x55]
push ebx
push edx
mov byte [esp + 0x5c], bl
call fcn.1001f410
mov eax, 0x80
add esp, 0xc
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
push edi
movzx eax, al
push ebx
push 0x40
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
jne 0x1000dbd7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push edi
push str.OpenProcess__d_failed__d
push 0x2e2
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x18
call esi
push eax
push edi
push str.OpenProcess__d_failed__d
push 0x2e2
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x18
jmp 0x1000e397
push 2
push 1
push ebx
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1000dc4a
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push edi
push str.Duplicate_Process__d_Handle_failed__d
push 0x2e9
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x18
call ebx
push eax
push edi
push str.Duplicate_Process__d_Handle_failed__d
push 0x2e9
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e397
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push 1
push 2
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1000dcc3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.DuplicateTokenEx_failed__d
push 0x2f2
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.DuplicateTokenEx_failed__d
push 0x2f2
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
mov ecx, dword [esp + 0x30]
add esp, 0x14
push ecx
jmp 0x1000e395
mov edx, dword [esp + 0x1c]
push edx
call ebp
mov esi, dword [esp + 0x470]
cmp esi, 0xffffffff
je 0x1000dd4d
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000dcf9
cmp dword [esp + 0x24], esi
je 0x1000dd4d
mov eax, dword [esp + 0x14]
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.GetTokenInformation_TokenSessionId_failed___d
push 0x2ff
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.GetTokenInformation_TokenSessionId_failed___d
push 0x2ff
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x14
jmp 0x1000e397
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push 0x100
lea edx, [esp + 0x158]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1000ddc2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.GetTokenInformation_TokenUser_failed__d
push 0x307
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.GetTokenInformation_TokenUser_failed__d
push 0x307
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ecx
jmp 0x1000e395
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x15c]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0xe0]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
jne 0x1000de3e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.LookupAccountSid_failed__d
push 0x30e
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.LookupAccountSid_failed__d
push 0x30e
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x14
jmp 0x1000e390
lea eax, [esp + 0x50]
push str.Window_Manager
push eax
call fcn.10019a8f
add esp, 8
test eax, eax
jne 0x1000dea8
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.lpDomain_is_Window_Manager__d
push 0x316
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.lpDomain_is_Window_Manager__d
push 0x316
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x14
jmp 0x1000e397
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x1c]
push eax
push 5
push esi
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x50], ebx
mov edi, 1
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x1000df55
mov edx, dword [esp + 0x18]
cmp edx, ebx
je 0x1000dfb1
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1000dee1
sub eax, esi
je 0x1000df59
push edx
lea ecx, [esp + 0xd4]
push ecx
push str.lpUser__s__lpSessionUserName__s
push 0x327
push str..Cutil_Process.c
push 2
mov ecx, str.IsTokenAvailable
call fcn.1000be40
mov edx, dword [esp + 0x30]
push edx
lea eax, [esp + 0xec]
push eax
push str.lpUser__s__lpSessionUserName__s
push 0x327
push str..Cutil_Process.c
push 2
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x104]
push edx
call fcn.10019a8f
add esp, 0x38
test eax, eax
je 0x1000df55
xor edi, edi
mov edx, dword [esp + 0x18]
cmp edx, ebx
je 0x1000df63
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
cmp edi, ebx
jne 0x1000dfaa
push str._bUserNameIsSame
push 0x331
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
push str._bUserNameIsSame
push 0x331
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
mov eax, dword [esp + 0x34]
add esp, 0x20
push eax
jmp 0x1000e395
mov esi, dword [esp + 0x470]
push 0x103
lea ecx, [esp + 0x35d]
push ebx
push ecx
mov byte [esp + 0x364], bl
call fcn.1001f410
add esp, 0xc
push 0x103
lea edx, [esp + 0x255]
push ebx
push edx
mov byte [esp + 0x25c], bl
call fcn.1001f410
add esp, 0xc
lea eax, [esp + 0x358]
push eax
push esi
call fcn.1000ee70
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
test eax, eax
je 0x1000e0d1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x250]
push ecx
push edx
call fcn.1000ed80
add esp, 8
test eax, eax
je 0x1000e0a1
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x35c]
push ecx
call fcn.10019a8f
add esp, 8
test eax, eax
je 0x1000e113
lea edx, [esp + 0x250]
push edx
lea eax, [esp + 0x35c]
push eax
push str.szSessionLogonSid__s__szTokenLogonSid__s
push 0x344
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
lea ecx, [esp + 0x268]
push ecx
lea edx, [esp + 0x374]
push edx
push str.szSessionLogonSid__s__szTokenLogonSid__s
push 0x344
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x30
jmp 0x1000e397
call esi
push eax
push str.cutil_process_get_logonsid_of_token_failed__d
push 0x34a
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.cutil_process_get_logonsid_of_token_failed__d
push 0x34a
jmp 0x1000e0ff
call esi
push eax
push str.cutil_process_get_logonsid_of_session_failed__d
push 0x34f
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.cutil_process_get_logonsid_of_session_failed__d
push 0x34f
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x14
mov eax, dword [esp + 0x474]
cmp eax, 0x4000
jne 0x1000e187
lea eax, [esp + 0x50]
push str.NT_AUTHORITY
push eax
call fcn.10019a8f
add esp, 8
test eax, eax
je 0x1000e1b3
lea ecx, [esp + 0x50]
push ecx
push str.lpDomain___s__is_not_NT_AUTHORITY
push 0x35c
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
lea edx, [esp + 0x50]
push edx
push str.lpDomain___s__is_not_NT_AUTHORITY
push 0x35c
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
mov eax, dword [esp + 0x28]
add esp, 0x14
push eax
jmp 0x1000e395
cmp dword [esp + 0x30], 6
jae 0x1000e1bc
cmp eax, 0x4000
jae 0x1000e357
lea ecx, [esp + 0x50]
push str.NT_AUTHORITY
push ecx
call fcn.10019a8f
add esp, 8
test eax, eax
je 0x1000e357
mov eax, dword [esp + 0x14]
jmp 0x1000e399
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 0x100
lea eax, [esp + 0x158]
push eax
push 0x19
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000e315
mov edx, dword [esp + 0x150]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov edi, dword [eax]
cmp edi, 0x1000
je 0x1000e25c
cmp edi, 0x2000
je 0x1000e25c
cmp edi, 0x3000
je 0x1000e25c
cmp edi, 0x4000
je 0x1000e25c
push edi
push str.rid_error__d
push 0x37a
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
push edi
push str.rid_error__d
push 0x37a
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
mov eax, dword [esp + 0x28]
add esp, 0x14
push eax
jmp 0x1000e395
mov eax, dword [esp + 0x474]
cmp edi, eax
je 0x1000e1b3
jbe 0x1000e357
add edi, 0xfffff000
cmp edi, 0x2000
ja 0x1000e357
lea ecx, [esp + 0x44]
mov edx, ecx
mov dword [esp + 0x2c], ebx
push edx
mov byte [esp + 0x48], 1
mov byte [esp + 0x49], 1
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], 0x10
mov dword [esp + 0x50], eax
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [esp + 0x14]
add eax, 8
push eax
lea eax, [esp + 0x2c]
push eax
push 0x19
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1000e1b3
call esi
push eax
push str.SetTokenInformation_failed__d
push 0x395
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.SetTokenInformation_failed__d
push 0x395
jmp 0x1000e343
call esi
push eax
push str.GetTokenInformation_failed__d
push 0x39b
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.GetTokenInformation_failed__d
push 0x39b
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x14
push str.IsTokenAvailable_return_NULL
push 0x39f
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000be40
push str.IsTokenAvailable_return_NULL
push 0x39f
push str..Cutil_Process.c
push 1
mov ecx, str.IsTokenAvailable
call fcn.1000bb50
add esp, 0x20
mov edx, dword [esp + 0x14]
push edx
call ebp
xor eax, eax
mov ecx, dword [esp + 0x464]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x458
ret