Function at 0x10083960
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x198
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
push esi
xor ebp, ebp
cmp dword [0x101a4784], 0xffffffff
push edi
mov edi, ecx
mov esi, edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
jne 0x100839c1
push 0x101a4784
push str.ACDebug
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.WS2_32.dll_bind
mov dword [0x101a4784], ebp
call fcn.10059e30
cmp edi, ebp
je 0x100839c7
mov dword [edi], ebp
cmp esi, ebp
je 0x100839cd
mov dword [esi], ebp
cmp dword [0x101cbe28], ebp
jne 0x100839f6
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x101cbe28], eax
cmp eax, ebp
je 0x1008440d
cmp eax, 0xffffffff
je 0x1008440d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x101cbe44], ebp
jne 0x10083a98
mov ecx, str.Wtsapi32.dll
call fcn.1005a380
mov dword [0x101cbe44], eax
cmp eax, ebp
je 0x1008440d
cmp eax, 0xffffffff
je 0x1008440d
mov eax, dword [0x101cbe28]
push str.WTSGetActiveConsoleSessionId
push eax
call esi
mov ecx, dword [0x101cbe44]
push str.WTSQueryUserToken
push ecx
mov dword [0x101cbe2c], eax
call esi
mov edx, dword [0x101cbe44]
push str.WTSQuerySessionInformationA
push edx
mov dword [0x101cbe30], eax
call esi
mov dword [0x101cbe34], eax
mov eax, dword [0x101cbe44]
push str.WTSFreeMemory
push eax
call esi
mov ecx, dword [0x101cbe44]
push str.WTSEnumerateSessionsA
push ecx
mov dword [0x101cbe38], eax
call esi
mov edx, dword [0x101cbe28]
push str.ProcessIdToSessionId
push edx
mov dword [0x101cbe40], eax
call esi
mov dword [0x101cbe3c], eax
cmp edi, ebp
je 0x1008440d
cmp dword [0x101cbe2c], ebp
je 0x1008440d
cmp dword [0x101cbe30], ebp
je 0x1008440d
cmp dword [0x101cbe34], ebp
je 0x1008440d
cmp dword [0x101cbe38], ebp
je 0x1008440d
xor esi, esi
mov dword [esp + 0x54], 1
cmp ebx, ebp
je 0x10083ae3
cmp byte [ebx], 0
jne 0x10083aed
cmp dword [esp + 0x1b4], 0xffffffff
je 0x10083af2
mov esi, 1
cmp dword [0x101a4784], ebp
je 0x10083b11
mov eax, dword [esp + 0x1b4]
push eax
push ebx
push str._GAC__ActiveSessionOfUser:___s___ForSessionID:___d_
push ebp
call fcn.1006ed90
add esp, 0x10
mov eax, dword [0x101cbe40]
cmp eax, ebp
je 0x10083e6e
cmp esi, ebp
je 0x10083e6e
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x30]
push edx
push 1
push ebp
or edi, 0xffffffff
push ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x3c], edi
call eax
test eax, eax
je 0x10083b7f
cmp dword [0x101a4784], ebp
je 0x10083b68
mov eax, dword [esp + 0x30]
push eax
push str._GAC__SessionsCount:___d_
push ebp
call fcn.1006ed90
add esp, 0xc
mov eax, dword [esp + 0x30]
cmp eax, ebp
jne 0x10083b89
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x10083b7f
push eax
call dword [0x101cbe38]
mov eax, 1
jmp 0x1008440f
mov dword [esp + 0x48], ebp
cmp eax, ebp
jbe 0x10083e42
mov dword [esp + 0x3c], ebp
lea esp, [esp]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
lea esi, [ecx + edx]
cmp esi, ebp
je 0x10083dce
push 0x3f
lea eax, [esp + 0x5d]
push ebp
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x58], ebp
mov byte [esp + 0x64], 0
call fcn.1012e060
mov eax, dword [esi + 8]
add esp, 0xc
cmp eax, 9
ja case.default.0x10083bdc
jmp dword [eax*4 + 0x10084428]
push ebp
push str.WTSActive__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x10083c6a
push 1
push str.WTSConnected__d_
jmp 0x10083c65
push 2
push str.WTSConnectQuery__d_
lea eax, [esp + 0x60]
push eax
jmp 0x10083c6a
push 3
push str.WTSShadow__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x10083c6a
push 4
push str.WTSDisconnected__d_
jmp 0x10083c65
push 5
push str.WTSIdle__d_
lea eax, [esp + 0x60]
push eax
jmp 0x10083c6a
push 6
push str.WTSListen__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x10083c6a
push 7
push str.WTSReset__d_
jmp 0x10083c65
push 8
push str.WTSDown__d_
lea eax, [esp + 0x60]
push eax
jmp 0x10083c6a
push 9
push str.WTSInit__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x10083c6a
push eax
push str.WTS_Unknown__d_
lea edx, [esp + 0x60]
push edx
call fcn.10127dc0
mov eax, dword [esp + 0x1c0]
add esp, 0xc
cmp eax, edi
je 0x10083c85
cmp dword [esi], eax
je 0x10083de8
cmp ebx, ebp
je 0x10083dce
cmp byte [ebx], 0
je 0x10083dce
mov edx, dword [esi]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 5
push edx
push ebp
call dword [0x101cbe34]
cmp dword [0x101a4784], ebp
je 0x10083ccc
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x58]
push eax
push ecx
push str._GAC__B___pDataUser:_s__state:_s
push ebp
call fcn.1006ed90
add esp, 0x10
cmp dword [esp + 0x1c], ebp
je 0x10083dce
push 0x103
lea edx, [esp + 0x9d]
push ebp
push edx
mov dword [esp + 0x44], ebp
mov byte [esp + 0xa4], 0
call fcn.1012e060
push 1
push 0x2c
lea eax, [esp + 0x4c]
lea ecx, [esp + 0xac]
push eax
push ecx
xor cl, cl
mov edx, ebx
call fcn.10061f00
add esp, 0x1c
cmp dword [esp + 0x38], edi
je 0x10083db5
lea esp, [esp]
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0
je 0x10083d69
lea edx, [esp + 0x98]
push edx
push eax
call fcn.10135887
add esp, 8
test eax, eax
jne 0x10083d69
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x10083d8e
cmp eax, 4
jne 0x10083d69
cmp dword [0x101a4784], ebp
je 0x10083d63
mov eax, dword [esi]
push eax
push str._GAC__B__SessionIdOfDisconnectedAdministrator:__d
push ebp
call fcn.1006ed90
add esp, 0xc
mov ecx, dword [esi]
mov dword [esp + 0x28], ecx
push 1
push 0x2c
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0xa4]
push eax
xor cl, cl
mov edx, ebx
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x38], edi
jne 0x10083d20
jmp 0x10083db5
cmp dword [0x101a4784], ebp
je 0x10083da7
mov ecx, dword [esi]
push ecx
push str._GAC__B__Setting_dwSessionID_to__d
push ebp
call fcn.1006ed90
add esp, 0xc
mov edx, dword [esi]
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x10083dc8
push eax
call dword [0x101cbe38]
mov dword [esp + 0x1c], ebp
cmp dword [esp + 0x34], ebp
jne 0x10083e42
mov eax, dword [esp + 0x48]
add dword [esp + 0x3c], 0xc
inc eax
mov dword [esp + 0x48], eax
cmp eax, dword [esp + 0x30]
jb 0x10083ba0
jmp 0x10083e42
mov edx, dword [esi]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
push ecx
push 5
push edx
push ebp
call dword [0x101cbe34]
cmp dword [0x101a4784], ebp
je 0x10083e21
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
lea eax, [esp + 0x58]
push eax
push ecx
push edx
push str._GAC__A__Setting_dwSessionID_to__d__pDataUser:_s__state:_s
push ebp
call fcn.1006ed90
add esp, 0x14
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x10083e34
push eax
call dword [0x101cbe38]
mov dword [esp + 0x1c], ebp
mov eax, dword [esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x10083e55
push eax
call dword [0x101cbe38]
mov dword [esp + 0x2c], ebp
cmp dword [esp + 0x34], ebp
jne 0x10083e9a
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x10083b7f
mov dword [esp + 0x20], eax
jmp 0x10083e9a
call dword [0x101cbe2c]
mov esi, eax
mov dword [esp + 0x20], esi
cmp dword [0x101a4784], ebp
je 0x10083e91
push esi
push str._GAC__dwSessionID___d
push ebp
call fcn.1006ed90
add esp, 0xc
cmp esi, 0xffffffff
je 0x10083b7f
cmp dword [0x101a4784], ebp
je 0x10083eb5
mov ecx, dword [esp + 0x20]
push ecx
push str._GAC__Post_dwSessionID___d
push ebp
call fcn.1006ed90
add esp, 0xc
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 8
push edi
push ebp
xor bl, bl
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call dword [0x101cbe34]
mov esi, eax
cmp dword [0x101a4784], ebp
je 0x10083f06
cmp esi, ebp
je 0x10083ef3
cmp dword [esp + 0x18], 4
jne 0x10083ef3
mov eax, 1
jmp 0x10083ef5
xor eax, eax
push eax
push esi
push edi
push str._GAC__A__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.1006ed90
add esp, 0x14
cmp esi, ebp
je 0x100840a4
cmp dword [esp + 0x18], 4
jne 0x100840a4
cmp dword [0x101a4784], ebp
je 0x10083f37
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edx
push edi
push str._GAC__A__dwSessionID:_d__wtsconnstate:_d
push ebp
call fcn.1006ed90
add esp, 0x10
cmp dword [0x101cbe40], ebp
je 0x10083f9c
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x10083f6f
cmp byte [eax], 0
je 0x10083f6f
mov bl, 1
cmp dword [0x101a4784], ebp
je 0x100841a5
push 1
push str._GAC__bActiveSession_A____d
push ebp
call fcn.1006ed90
add esp, 0xc
jmp 0x100840be
cmp dword [esp + 0x1b4], 0xffffffff
je 0x10083f9c
mov bl, 1
cmp dword [0x101a4784], ebp
je 0x100841a5
push 1
push str._GAC__bActiveSession_A1____d
push ebp
call fcn.1006ed90
add esp, 0xc
jmp 0x100840be
mov eax, dword [esp + 0x14]
cmp dword [eax], ebp
sete bl
cmp dword [0x101a4784], ebp
je 0x10083fbf
movzx ecx, bl
push ecx
push str._GAC__bActiveSession_B____d
push ebp
call fcn.1006ed90
add esp, 0xc
test bl, bl
jne 0x100840be
cmp dword [esp + 0x14], ebp
je 0x10083feb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [0x101cbe38]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x18], ebp
call fcn.1006bbf0
test eax, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x20], ebp
push 8
je 0x10084047
mov edi, 1
push edi
push ebp
mov dword [esp + 0x34], edi
call dword [0x101cbe34]
mov esi, eax
cmp dword [0x101a4784], ebp
je 0x10084082
cmp esi, ebp
je 0x1008403a
cmp dword [esp + 0x18], 4
jne 0x1008403a
mov eax, edi
push eax
push esi
push edi
push str._GAC__B__dwSessionID___d__WTSRet___d__Result___d
jmp 0x10084079
xor eax, eax
push eax
push esi
push 1
push str._GAC__B__dwSessionID___d__WTSRet___d__Result___d
jmp 0x10084079
push ebp
xor edi, edi
push ebp
mov dword [esp + 0x34], edi
call dword [0x101cbe34]
mov esi, eax
cmp dword [0x101a4784], ebp
je 0x10084082
cmp esi, ebp
je 0x1008406f
cmp dword [esp + 0x18], 4
jne 0x1008406f
lea eax, [edi + 1]
jmp 0x10084071
xor eax, eax
push eax
push esi
push ebp
push str._GAC__C__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.1006ed90
add esp, 0x14
cmp esi, ebp
je 0x100840be
cmp dword [esp + 0x18], 4
jne 0x100840be
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
cmp eax, ebp
sete bl
test bl, bl
jne 0x100840be
cmp eax, 4
sete bl
jmp 0x100840be
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x6a6
je 0x100840bc
call esi
cmp eax, 0x47f
jne 0x100840be
mov bl, 1
cmp dword [0x101a4784], ebp
je 0x100840d9
movzx eax, bl
push edi
push eax
push str._GAC__bActiveSession___d__dwSessionID___d_
push ebp
call fcn.1006ed90
add esp, 0x10
test bl, bl
jne 0x100841a5
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x14], ebp
je 0x1008410d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [0x101cbe38]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebp
call fcn.10068450
mov esi, dword [esp + 0x28]
cmp dword [0x101a4784], ebp
je 0x10084135
push esi
push str._GAC__SessionIDOfFirstLoggedOnUser___d
push ebp
call fcn.1006ed90
add esp, 0xc
cmp esi, 0xffffffff
je 0x100841a5
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 8
push esi
push ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], ebp
call dword [0x101cbe34]
mov edi, eax
cmp dword [0x101a4784], ebp
je 0x10084185
cmp edi, ebp
je 0x10084172
cmp dword [esp + 0x18], 4
jne 0x10084172
mov eax, 1
jmp 0x10084174
xor eax, eax
push eax
push edi
push esi
push str._GAC__D__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.1006ed90
add esp, 0x14
cmp edi, ebp
je 0x100841a5
cmp dword [esp + 0x18], 4
jne 0x100841a5
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
cmp eax, ebp
sete bl
test bl, bl
jne 0x100841a5
cmp eax, 4
sete bl
cmp dword [esp + 0x14], ebp
je 0x100841c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [0x101cbe38]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
jne 0x100841f4
cmp dword [0x101a4784], ebp
je 0x100841ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GAC__returning_rval4__le_u_
push ebp
call fcn.1006ed90
add esp, 0xc
mov eax, 4
jmp 0x1008440f
push 0x2000000
push 0
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebp, eax
test esi, esi
je 0x100843e7
mov edi, dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
call edi
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
test eax, eax
jne 0x10084276
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebx, eax
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x101a4784], 0
je 0x1008426c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GAC__returning_rval6__le_u_
push 0
call fcn.1006ed90
add esp, 0xc
mov eax, 6
jmp 0x1008440f
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebp
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
push edi
call dword [0x101cbe30]
cmp dword [0x101a4784], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
je 0x100842c1
call ebx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push esi
push edi
push str._GAC__A__e_WTSQueryUserToken_for_sessid:_d__eVal___d__hTok__0x_x__LE:_u_
push 0
call fcn.1006ed90
add esp, 0x18
test esi, esi
jne 0x10084332
mov ecx, str.SeTcbPrivilege
call fcn.10064c60
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x40], 1
test eax, eax
je 0x100842fe
lea edx, [esp + 0x40]
push edx
push esi
push 1
push 7
call eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [0x101cbe30]
cmp dword [0x101a4784], 0
mov esi, eax
je 0x1008432e
call ebx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push esi
push edi
push str._GAC__B__e_WTSQueryUserToken_for_sessid:_d__eVal___d__hTok__0x_x__LE:_u_
push 0
call fcn.1006ed90
add esp, 0x18
test esi, esi
je 0x1008439a
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100843df
cmp dword [esp + 0x1ac], 0
je 0x1008435e
mov edx, dword [esp + 0x44]
push edx
push 1
push 2
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x1008436c
mov ecx, dword [esp + 0x44]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
cmp dword [0x101a4784], 0
je 0x10084387
call ebx
push eax
push str._GAC__returning_rval2__success___le_u_
push 0
call fcn.1006ed90
add esp, 0xc
lea edx, [esp + 0x24]
push edx
mov esi, 2
call fcn.10082e10
mov eax, esi
jmp 0x1008440f
call ebx
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x100843b8
cmp eax, 0x4dd
je 0x100843b2
cmp eax, 0x6d3
jne 0x100843b8
mov dword [ecx], 1
cmp dword [0x101a4784], 0
je 0x100843d6
mov eax, dword [ecx]
push eax
call ebx
push eax
push str._GAC__returning_rval7__le_u__SessionActiveButGetTokenFailed:_d
push 0
call fcn.1006ed90
add esp, 0x10
mov esi, 7
mov eax, esi
jmp 0x1008440f
mov esi, dword [esp + 0x54]
mov eax, esi
jmp 0x1008440f
cmp dword [0x101a4784], 0
je 0x10084406
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GAC__returning_rval5__le_u_
push 0
call fcn.1006ed90
add esp, 0xc
mov eax, 5
jmp 0x1008440f
xor eax, eax
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x198
ret