Function at 0x1000a440
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1003ba64], 1
push ebx
push esi
push edi
mov dword [ebp - 0x660], ecx
jne 0x1000af8b
lea eax, [ebp - 0x674]
mov dword [ebp - 0x678], 0
push eax
lea eax, [ebp - 0x678]
mov dword [ebp - 0x674], 0
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
je 0x1000af8b
push 0x338
lea eax, [ebp - 0x658]
push 0
push eax
call fcn.1000ea10
mov edx, dword [ebp - 0x674]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x664], esi
xor ebx, ebx
mov dword [ebp - 0x658], ecx
add esp, 0xc
mov dword [ebp - 0x67c], ebx
mov edi, 0x104
test edx, edx
je 0x1000a94e
mov dword [ebp - 0x670], esi
nop word [eax + eax]
mov eax, dword [ebp - 0x678]
cmp dword [esi + eax + 8], 0
movq xmm0, qword [esi + eax]
movq qword [ebp - 0x688], xmm0
jne 0x1000a930
shl ecx, 5
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x65c], 0
mov byte [ebp + ecx - 0x58c], 0
mov eax, dword [ebp - 0x658]
lea eax, [eax + eax*4]
mov byte [ebp + eax*4 - 0x654], 0
mov ecx, dword [ebp - 0x658]
shl ecx, 4
sub ecx, dword [ebp - 0x658]
mov byte [ebp + ecx*2 - 0x44c], 0
mov ecx, dword [ebp - 0x658]
cmp ecx, 9
jg 0x1000a948
mov ebx, dword [ebp - 0x688]
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x668]
push eax
push 5
push ebx
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x1000a6ed
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1000ea10
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, 0x104
nop dword [eax]
cmp byte [eax], 0
je 0x1000a5bb
inc eax
sub ecx, 1
jne 0x1000a5b0
mov eax, edi
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000a606
mov edx, edi
lea ecx, [ebp - 0x218]
lea ecx, [ecx + esi]
sub edx, esi
je 0x1000a5fb
mov edi, dword [ebp - 0x668]
mov esi, bind
sub edi, ecx
test esi, esi
je 0x1000a5fb
mov al, byte [edi + ecx]
test al, al
je 0x1000a5fb
mov byte [ecx], al
dec esi
inc ecx
sub edx, 1
jne 0x1000a5e7
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100115e9
lea edx, [ebp - 0x218]
add esp, 8
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a623
sub edx, ecx
lea ecx, [ebp - 0x218]
call fcn.10009c80
push dword [0x10032358]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
lea ecx, [ebp - 0x58c]
mov eax, dword [ebp - 0x658]
mov edx, 0x20
jne 0x1000a696
shl eax, 5
mov esi, 0x10032258
add ecx, eax
sub esi, ecx
nop dword [eax + eax]
lea eax, [edx + 0x7fffffde]
test eax, eax
je 0x1000a729
mov al, byte [esi + ecx]
test al, al
je 0x1000a729
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a670
jmp 0x1000a729
mov edi, dword [ebp - 0x668]
shl eax, 5
add ecx, eax
cmp byte [edi], 0
je 0x1000a6cb
mov esi, edi
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7fffffde]
test eax, eax
je 0x1000a72f
mov al, byte [esi + ecx]
test al, al
je 0x1000a72f
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a6b0
jmp 0x1000a72f
mov esi, 0x1003225c
sub esi, ecx
lea eax, [edx + 0x7fffffde]
test eax, eax
je 0x1000a72f
mov al, byte [esi + ecx]
test al, al
je 0x1000a72f
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a6d2
jmp 0x1000a72f
mov eax, dword [ebp - 0x658]
lea ecx, [ebp - 0x58c]
shl eax, 5
mov esi, str.null
add ecx, eax
mov edx, 0x20
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7fffffde]
test eax, eax
je 0x1000a729
mov al, byte [esi + ecx]
test al, al
je 0x1000a729
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a710
mov edi, dword [ebp - 0x668]
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
test edi, edi
je 0x1000a74f
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov dword [ebp - 0x668], 0
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x668]
push eax
push 0x10
push ebx
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x1000a8f9
mov edi, dword [ebp - 0x668]
movsx eax, byte [edi]
sub eax, 0
je 0x1000a8b6
sub eax, 1
je 0x1000a870
sub eax, 1
jne 0x1000a8ff
mov eax, dword [ebp - 0x658]
lea ecx, [ebp - 0x654]
mov esi, 0x10032274
mov edx, 0x14
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
sub esi, ecx
lea eax, [edx + 0x7fffffea]
test eax, eax
je 0x1000a7cb
mov al, byte [esi + ecx]
test al, al
je 0x1000a7cb
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a7b2
test edx, edx
mov dword [ebp - 0x66c], 0
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x66c]
push eax
push 0xe
push ebx
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov ecx, dword [ebp - 0x66c]
test eax, eax
je 0x1000a854
cmp dword [ecx], 2
jne 0x1000a854
movzx eax, byte [ecx + 9]
push eax
movzx eax, byte [ecx + 8]
push eax
movzx eax, byte [ecx + 7]
push eax
movzx eax, byte [ecx + 6]
mov ecx, dword [ebp - 0x658]
push eax
shl ecx, 4
lea eax, [ebp - 0x44c]
sub ecx, dword [ebp - 0x658]
push 0x10032278
push 0x1e
lea eax, [eax + ecx*2]
push eax
call fcn.10001250
mov ecx, dword [ebp - 0x66c]
add esp, 0x1c
mov dword [ebp - 0x664], 1
test ecx, ecx
je 0x1000a8f9
mov ebx, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push ecx
call ebx
mov edi, dword [ebp - 0x668]
jmp 0x1000a905
mov eax, dword [ebp - 0x658]
lea ecx, [ebp - 0x654]
mov esi, 0x10032270
mov edx, 0x14
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
sub esi, ecx
nop
lea eax, [edx + 0x7fffffea]
test eax, eax
je 0x1000a8a9
mov al, byte [esi + ecx]
test al, al
je 0x1000a8a9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a890
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
jmp 0x1000a8ff
mov eax, dword [ebp - 0x658]
lea ecx, [ebp - 0x654]
mov esi, 0x1003226c
mov edx, 0x14
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
sub esi, ecx
lea eax, [edx + 0x7fffffea]
test eax, eax
je 0x1000a8a9
mov al, byte [esi + ecx]
test al, al
je 0x1000a8a9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a8d4
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], dl
jmp 0x1000a8ff
mov edi, dword [ebp - 0x668]
mov ebx, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test edi, edi
je 0x1000a90c
push edi
call ebx
mov ecx, dword [ebp - 0x658]
mov edi, 0x104
mov edx, dword [ebp - 0x674]
inc ecx
mov ebx, dword [ebp - 0x67c]
mov esi, dword [ebp - 0x670]
mov dword [ebp - 0x658], ecx
inc ebx
add esi, 0xc
mov dword [ebp - 0x67c], ebx
mov dword [ebp - 0x670], esi
cmp ebx, edx
jb 0x1000a4f0
mov esi, dword [ebp - 0x664]
shl ecx, 5
mov byte [ebp + ecx - 0x58c], 0
mov eax, dword [ebp - 0x658]
lea eax, [eax + eax*4]
mov byte [ebp + eax*4 - 0x654], 0
mov ecx, dword [ebp - 0x658]
shl ecx, 4
sub ecx, dword [ebp - 0x658]
mov byte [ebp + ecx*2 - 0x44c], 0
cmp esi, 1
jne 0x1000adeb
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1000ea10
mov esi, dword [str.zzwsl_lilz]
lea ecx, [ebp - 0x218]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1000a9ce
mov al, byte [esi + ecx]
test al, al
je 0x1000a9ce
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1000a9b5
test edx, edx
lea eax, [ecx - 1]
lea edx, [ebp - 0x218]
cmovne eax, ecx
lea ecx, [edx + 1]
mov byte [eax], 0
mov al, byte [edx]
inc edx
test al, al
jne 0x1000a9e2
sub edx, ecx
lea ecx, [ebp - 0x218]
call fcn.10009c80
lea ecx, [ebp - 0x218]
call fcn.10004f10
mov esi, eax
test esi, esi
je 0x1000ac4e
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1000ea10
lea eax, [ebp - 0x658]
mov ecx, esi
push eax
lea edx, [ebp - 0x110]
call fcn.1000a160
add esp, 0x10
mov dword [ebp - 0x670], eax
cmp byte [ebp - 0x58c], 0
mov dword [ebp - 0x664], 0
je 0x1000abca
lea ebx, [ebp - 0x654]
lea esi, [ebp - 0x58c]
mov dword [ebp - 0x65c], ebx
lea edi, [ebp - 0x44c]
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.1000ea10
cmp byte [edi], 0
lea eax, [ebp - 0x320]
je 0x1000ab13
push edi
push esi
push ebx
push 0x10032284
push 0x104
push eax
call fcn.10001250
mov eax, dword [ebp - 0x660]
add esp, 0x24
mov ecx, 0x104
cmp byte [eax], 0
je 0x1000aabe
inc eax
sub ecx, 1
jne 0x1000aab3
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000ab95
mov ecx, dword [ebp - 0x660]
lea ecx, [esi + ecx]
sub edx, esi
je 0x1000ab8a
lea esi, [ebp - 0x320]
mov eax, bind
sub esi, ecx
test eax, eax
je 0x1000ab84
mov bl, byte [esi + ecx]
test bl, bl
je 0x1000ab84
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1000aaf5
jmp 0x1000ab84
push esi
push ebx
push 0x10032290
push 0x104
push eax
call fcn.10001250
mov eax, dword [ebp - 0x660]
add esp, 0x20
mov ecx, 0x104
cmp byte [eax], 0
je 0x1000ab3e
inc eax
sub ecx, 1
jne 0x1000ab33
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000ab95
mov ecx, dword [ebp - 0x660]
lea ecx, [esi + ecx]
sub edx, esi
je 0x1000ab8a
lea esi, [ebp - 0x320]
mov eax, bind
sub esi, ecx
nop dword [eax]
test eax, eax
je 0x1000ab84
mov bl, byte [esi + ecx]
test bl, bl
je 0x1000ab84
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1000ab70
mov ebx, dword [ebp - 0x65c]
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov ecx, dword [ebp - 0x664]
lea esi, [ebp - 0x58c]
inc ecx
add ebx, 0x14
mov eax, ecx
mov dword [ebp - 0x664], ecx
shl eax, 5
add edi, 0x1e
add esi, eax
mov dword [ebp - 0x65c], ebx
cmp byte [esi], 0
jne 0x1000aa70
mov eax, dword [ebp - 0x670]
test eax, eax
je 0x1000af74
mov esi, dword [ebp - 0x660]
mov ecx, 0x104
mov eax, esi
nop
cmp byte [eax], 0
je 0x1000abeb
inc eax
sub ecx, 1
jne 0x1000abe0
mov ebx, 0x104
mov edx, ecx
mov eax, ebx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x1000af74
lea ecx, [edx + esi]
sub ebx, edx
je 0x1000ac2c
lea esi, [ebp - 0x110]
mov eax, bind
sub esi, ecx
test eax, eax
je 0x1000ac2c
mov dl, byte [ecx + esi]
test dl, dl
je 0x1000ac2c
mov byte [ecx], dl
dec eax
inc ecx
sub ebx, 1
jne 0x1000ac18
test ebx, ebx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov eax, dword [ebp - 0x658]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x58c], 0
mov dword [ebp - 0x664], 0
je 0x1000af74
lea ebx, [ebp - 0x654]
lea esi, [ebp - 0x58c]
mov dword [ebp - 0x65c], ebx
lea edi, [ebp - 0x44c]
nop dword [eax]
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1000ea10
cmp byte [edi], 0
lea eax, [ebp - 0x110]
je 0x1000ad23
push edi
push esi
push ebx
push 0x10032298
push 0x104
push eax
call fcn.10001250
mov eax, dword [ebp - 0x660]
add esp, 0x24
mov ecx, 0x104
cmp byte [eax], 0
je 0x1000acce
inc eax
sub ecx, 1
jne 0x1000acc3
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000ada5
mov ecx, dword [ebp - 0x660]
lea ecx, [esi + ecx]
sub edx, esi
je 0x1000ad9a
lea esi, [ebp - 0x110]
mov eax, bind
sub esi, ecx
test eax, eax
je 0x1000ad94
mov bl, byte [esi + ecx]
test bl, bl
je 0x1000ad94
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1000ad05
jmp 0x1000ad94
push esi
push ebx
push 0x100322a4
push 0x104
push eax
call fcn.10001250
mov eax, dword [ebp - 0x660]
add esp, 0x20
mov ecx, 0x104
cmp byte [eax], 0
je 0x1000ad4e
inc eax
sub ecx, 1
jne 0x1000ad43
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000ada5
mov ecx, dword [ebp - 0x660]
lea ecx, [esi + ecx]
sub edx, esi
je 0x1000ad9a
lea esi, [ebp - 0x110]
mov eax, bind
sub esi, ecx
nop dword [eax]
test eax, eax
je 0x1000ad94
mov bl, byte [esi + ecx]
test bl, bl
je 0x1000ad94
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1000ad80
mov ebx, dword [ebp - 0x65c]
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov ecx, dword [ebp - 0x664]
lea esi, [ebp - 0x58c]
inc ecx
add ebx, 0x14
mov eax, ecx
mov dword [ebp - 0x664], ecx
shl eax, 5
add edi, 0x1e
add esi, eax
mov dword [ebp - 0x65c], ebx
cmp byte [esi], 0
jne 0x1000ac80
mov eax, dword [ebp - 0x658]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x58c], 0
mov dword [ebp - 0x664], 0
je 0x1000af74
lea ebx, [ebp - 0x654]
lea esi, [ebp - 0x58c]
mov dword [ebp - 0x65c], ebx
lea edi, [ebp - 0x44c]
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1000ea10
cmp byte [edi], 0
lea eax, [ebp - 0x110]
je 0x1000aec3
push edi
push esi
push ebx
push str._s:_s:_s
push 0x104
push eax
call fcn.10001250
mov eax, dword [ebp - 0x660]
add esp, 0x24
mov ecx, 0x104
cmp byte [eax], 0
je 0x1000ae6e
inc eax
sub ecx, 1
jne 0x1000ae63
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000af45
mov ecx, dword [ebp - 0x660]
lea ecx, [esi + ecx]
sub edx, esi
je 0x1000af3a
lea esi, [ebp - 0x110]
mov eax, bind
sub esi, ecx
test eax, eax
je 0x1000af34
mov bl, byte [esi + ecx]
test bl, bl
je 0x1000af34
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1000aea5
jmp 0x1000af34
push esi
push ebx
push str._s:_s
push 0x104
push eax
call fcn.10001250
mov eax, dword [ebp - 0x660]
add esp, 0x20
mov ecx, 0x104
cmp byte [eax], 0
je 0x1000aeee
inc eax
sub ecx, 1
jne 0x1000aee3
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x1000af45
mov ecx, dword [ebp - 0x660]
lea ecx, [esi + ecx]
sub edx, esi
je 0x1000af3a
lea esi, [ebp - 0x110]
mov eax, bind
sub esi, ecx
nop dword [eax]
test eax, eax
je 0x1000af34
mov bl, byte [esi + ecx]
test bl, bl
je 0x1000af34
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1000af20
mov ebx, dword [ebp - 0x65c]
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov ecx, dword [ebp - 0x664]
lea esi, [ebp - 0x58c]
inc ecx
add ebx, 0x14
mov eax, ecx
mov dword [ebp - 0x664], ecx
shl eax, 5
add edi, 0x1e
add esi, eax
mov dword [ebp - 0x65c], ebx
cmp byte [esi], 0
jne 0x1000ae20
mov eax, dword [ebp - 0x658]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret