Function at 0x180117e8
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov byte [eax], 0
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
xor esi, esi
inc ebx
push ebx
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov edi, eax
cmp edi, esi
jne 0x18011acf
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x18011acf
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
mov edi, 0x180fbba0
and ecx, edi
mov dword [ebp - 0x88], eax
je 0x18011870
push 3
pop esi
push esi
push ebx
mov dword [ebp - 0x34], ecx
call fcn.18001d8a
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
push dword [eax]
mov dword [ebp - 0x2c], esi
push dword [eax + 4]
lea eax, [ebp - 0x34]
push str._wks_domain_s__wks_user_s_
push eax
mov dword [ebp - 0x28], ebx
call fcn.18001000
add esp, 0x10
xor esi, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x180118e0
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, edi
mov dword [ebp - 8], eax
je 0x180118cb
push 0xfffffffffffffffe
pop esi
push esi
push ebx
mov dword [ebp - 0x34], ecx
call fcn.18001d8a
push dword [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push str._WTSEnumerateSessions_failed__0x_08x_
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
call fcn.18001000
add esp, 0xc
mov esi, dword [ebp - 8]
push dword [ebp - 0x88]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, esi
jmp 0x18011b1e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], esi
jbe 0x18011ab7
push 0xfffffffffffffffe
mov dword [ebp - 0xc], esi
pop esi
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0xc]
xor eax, eax
push 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], eax
push dword [ecx + edx]
push eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x18011964
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, edi
mov dword [ebp - 8], eax
je 0x18011aa4
push esi
push ebx
mov dword [ebp - 0x74], ecx
call fcn.18001d8a
push dword [ebp - 8]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x74]
push str._WTSQuerySessionInformation_failed__0x_08x_
push eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], ebx
call fcn.18001000
add esp, 0xc
jmp 0x18011aa4
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
xor eax, eax
push 5
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], eax
push dword [edx + ecx]
push eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x180119dc
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, edi
mov dword [ebp - 8], eax
je 0x18011a9c
push esi
push ebx
mov dword [ebp - 0x84], ecx
call fcn.18001d8a
push dword [ebp - 8]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x84]
push str._WTSQuerySessionInformation_failed__0x_08x_
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], ebx
call fcn.18001000
add esp, 0xc
jmp 0x18011a9c
movzx ecx, byte [0x180fb8f9]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
and ecx, edi
mov dword [ebp - 0x5c], eax
je 0x18011a2a
push 3
push ebx
mov dword [ebp - 0x44], ecx
call fcn.18001d8a
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
push dword [ecx + eax + 4]
lea eax, [ebp - 0x44]
push dword [ebp - 0x18]
mov dword [ebp - 0x3c], 3
push dword [ebp - 0x1c]
mov dword [ebp - 0x38], ebx
push str._ts_domain_s__ts_user_s__station_s_
push eax
call fcn.18001000
add esp, 0x14
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x18011a8d
cmp word [eax], 0
je 0x18011a8d
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x18011a8d
cmp word [ecx], 0
je 0x18011a8d
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call fcn.1809dd43
pop ecx
pop ecx
test eax, eax
jne 0x18011a94
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
push dword [eax]
call fcn.1809dd43
pop ecx
pop ecx
test eax, eax
jne 0x18011a94
mov eax, dword [ebp + 8]
push dword [ebp - 0x5c]
mov byte [eax], bl
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x50]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x28]
call sub.WTSAPI32.dll_WTSFreeMemory
xor esi, esi
jmp 0x180118ce
mov dword [ebp - 8], 0x80004005
push dword [ebp - 0x5c]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x50]
call sub.WTSAPI32.dll_WTSFreeMemory
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add dword [ebp - 0xc], 0xc
cmp eax, dword [ebp - 0x20]
jb 0x180118f8
push dword [ebp - 0x28]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x88]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - 8]
jmp 0x18011b1e
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18011b0c
push 0xfffffffffffffffe
pop esi
push esi
push ebx
mov dword [ebp - 0x44], ecx
call fcn.18001d8a
push edi
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push str._NetWkstaUserGetInfo_failed___u_
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], ebx
call fcn.18001000
add esp, 0xc
xor esi, esi
cmp edi, esi
jle 0x18011b1c
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret