Function at 0x4014e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push str.LoadWtsFunctions___Begin._n
call fcn.00403b93
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 4
push str.Wtsapi32.dll
call ebx
push str.WfApi.dll
mov edi, eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
test edi, edi
je 0x4015a8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.LoadWtsFunctions___Wtsapi32.dll_loaded._n
call fcn.00403b93
add esp, 4
push str.WTSQuerySessionInformationW
push edi
call esi
push str.WTSFreeMemory
push edi
mov dword [0x418ef8], eax
call esi
push str.WTSDisconnectSession
push edi
mov dword [0x418ef4], eax
call esi
push str.WTSWaitSystemEvent
push edi
mov dword [0x418ef0], eax
call esi
push str.WTSEnumerateSessionsW
push edi
mov dword [0x418eec], eax
call esi
push str.WTSLogoffSession
push edi
mov dword [0x418ee8], eax
call esi
push str.WTSOpenServerW
push edi
mov dword [0x418ee4], eax
call esi
push str.WTSCloseServer
push edi
mov dword [0x418ee0], eax
call esi
push str.LoadWtsFunctions___Wtsapi32.dll_functions_initialized.
mov dword [0x418edc], eax
call fcn.00403b93
mov eax, dword [ebp - 4]
add esp, 4
test eax, eax
je 0x40164b
push str.LoadWtsFunctions___WfApi.dll_loaded._n
call fcn.00403b93
add esp, 4
push str.WFQuerySessionInformationW
push dword [ebp - 4]
call esi
push str.WFFreeMemory
push dword [ebp - 4]
mov dword [0x418f18], eax
call esi
push str.WFDisconnectSession
push dword [ebp - 4]
mov dword [0x418f14], eax
call esi
push str.WFWaitSystemEvent
push dword [ebp - 4]
mov dword [0x418f10], eax
call esi
push str.WFEnumerateSessionsW
push dword [ebp - 4]
mov dword [0x418f0c], eax
call esi
push str.WFLogoffSession
push dword [ebp - 4]
mov dword [0x418f08], eax
call esi
push str.WFOpenServerW
push dword [ebp - 4]
mov dword [0x418f04], eax
call esi
push str.WFCloseServer
push dword [ebp - 4]
mov dword [0x418f00], eax
call esi
push str.WFGetActiveProtocol
push dword [ebp - 4]
mov dword [0x418efc], eax
call esi
mov dword [0x418ec8], eax
push str.LoadWtsFunctions___WfApi.dll_functions_initialized._n
jmp 0x401650
push str.LoadWtsFunctions___WfApi.dll_not_loaded._n
call fcn.00403b93
add esp, 4
push str.Kernel32.dll_n
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x40168f
push str.LoadWtsFunctions___Kernel32.dll_loaded._n
call fcn.00403b93
add esp, 4
push 0x414814
push dword [ebp - 4]
call esi
push str.LoadWtsFunctions___Kernel32.dll_functions_initialized._n
mov dword [0x418ed8], eax
call fcn.00403b93
add esp, 4
push str.Advapi32.dll_n
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x4016c6
push str.LoadWtsFunctions___Advapi32.dll_loaded._n
call fcn.00403b93
add esp, 4
push str.GetEventLogInformation
push dword [ebp - 4]
call esi
push str.LoadWtsFunctions___Advapi32.dll_functions_initialized._n
mov dword [0x418ed4], eax
call fcn.00403b93
add esp, 4
push str.winsta.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x4016fd
push str.LoadWtsFunctions___winsta.dll_loaded.
call fcn.00403b93
add esp, 4
push str.WinStationQueryInformationW
push dword [ebp - 4]
call esi
push str.LoadWtsFunctions___winsta.dll_functions_initialized._n
mov dword [0x418ed0], eax
call fcn.00403b93
add esp, 4
test edi, edi
jne 0x40170e
push str.Wtsapi32.dll
call ebx
mov edi, eax
test edi, edi
je 0x401728
push str.WTSQueryUserToken
push edi
call esi
push str.LoadWtsFunctions___WTSQueryUserToken_initialized._n
mov dword [0x418ecc], eax
call fcn.00403b93
add esp, 4
push str.LoadWtsFunctions___End._n
call fcn.00403b93
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret