Function at 0x483430
Capabilities:
Get hostname
Get session information
Get session user name
Prompt user for credentials

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004c53a0
add esp, 0xc
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov esi, eax
cmp esi, 0x9ead
je 0x4834c8
cmp esi, 0x9eae
je 0x4834c8
cmp esi, 0x9eaf
je 0x4834c8
cmp esi, 0x9eb1
je 0x4834c8
cmp esi, 0x9f27
je 0x4834c8
cmp esi, 0x9f28
je 0x4834c8
push 0
push esi
push edi
push 0x53262c
call fcn.0045ab90
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], 0x1c
push eax
push ebx
mov dword [ebp - 0x43c], 8
call dword [sym.imp.USER32.dll_GetMenuInfo]
add esi, 0xffff6153
cmp esi, 0x7b
ja case.0x483500.40624
movzx eax, byte [esi + 0x4837a8]
jmp dword [eax*4 + 0x48378c]
push 0
push dword [ebp - 0x428]
push 0
call sub.WTSAPI32.dll_WTSDisconnectSession
test eax, eax
jne case.0x483500.40624
push dword [0x54fea0]
push str.Error_disconnecting_session
call fcn.004aae60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push 5
push dword [ebp - 0x428]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x48361a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x450], edi
mov edi, dword [sym.imp.credui.dll_CredUIPromptForCredentialsW]
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x454], 0x14
mov dword [ebp - 0x44c], str.Enter_the_selected_users_password
mov dword [ebp - 0x448], str.Process_Explorer_Connect_Password
mov dword [ebp - 0x444], 0
nop dword [eax]
push 0x140082
lea eax, [ebp - 0x41c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x454]
push dword [ebp - 0x420]
push 0x52e
push 0
push 0x4f9d20
push eax
call edi
test eax, eax
jne 0x483611
mov eax, dword [0x5551a0]
lea ecx, [ebp - 0x20c]
push 1
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x428]
push 0
call eax
test al, al
jne case.0x483500.40624
call esi
cmp eax, 0x52e
je 0x4835b0
jmp 0x483620
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je case.0x483500.40624
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x54fea0]
push str.Error_connecting_to_session
call fcn.004aae60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, dword [ebp - 0x424]
jne 0x48369d
push dword [0x54fea0]
push str.Remote_control_is_not_supported_from_a_console_session
call fcn.004aae60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, dword [0x5551a4]
lea ecx, [ebp - 0x414]
push 2
push 0x70
push dword [ebp - 0x428]
push ecx
push 0
call eax
test al, al
jne case.0x483500.40624
push dword [0x54fea0]
push str.Error_starting_remote_control
call fcn.004aae60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x428]
push 0
call sub.WTSAPI32.dll_WTSLogoffSession
test eax, eax
jne case.0x483500.40624
push dword [0x54fea0]
push str.Error_logging_off_session
call fcn.004aae60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x428]
push 0x48a380
push dword [0x54fea0]
push str.SENDMESSAGE
jmp 0x48376a
push dword [ebp - 0x428]
push 0x48abf0
push dword [0x54fea0]
push str.TSINFO
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret