Function at 0x1400487b8
Capabilities:
Get session information
Get session user name

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400bd288]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x34], r12d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8d, [r12 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x140048872
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test byte [0x1400be200], 8
je 0x14004884a
mov r8d, eax
lea rdx, [0x1400896e0]
lea rcx, [0x1400b7200]
call fcn.140012ae4
test byte [0x1400be340], 8
je 0x140048dfc
mov r8d, ebx
lea rdx, [0x1400896e0]
lea rcx, [0x1400b7320]
call fcn.140012ae4
jmp 0x140048dfc
mov rbx, qword [rsp + 0x40]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400663f8
mov qword [rsp + 0x38], rax
lea rcx, vtable.appv::utility::scope_guard_func_impl_class_std::_Binder_struct_std::_Unforced__void____cdecl___void____ptr64___struct__WTS_SESSION_INFOW____ptr64____ptr64__.0
mov qword [rax], rcx
mov rcx, qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
mov qword [rbp - 0x79], rax
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x30], r12d
mov r14d, r12d
cmp dword [rsp + 0x34], r12d
jbe 0x140048df3
mov edi, SafeArrayGetDim
lea r13, str.admin_appman_appvclienthostcommonusermanagerimpl.cpp
mov ebx, 7
mov eax, r14d
lea rsi, [rax + rax*2]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + rsi*8 + 0x10]
test ecx, ecx
je 0x140048a0f
call fcn.14004afc4
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rbx
mov word [rbp - 0x21], r12w
lea rdx, str.UserManager_processing_existing_logons__ignoring_session__1__in_state__2_
lea rcx, [rbp - 0x21]
call fcn.140003cac
nop
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
lea rdx, str.Client
lea rcx, [rbp - 0x41]
call fcn.140003cac
nop
call fcn.14000a10c
lea r8, [rbp - 0x21]
lea rdx, [rbp - 1]
call fcn.14003b330
mov rbx, rax
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea r9, str.AppV::Client::Host::UserManagerImpl::EnumSessions
mov edx, 0x31
lea rcx, [rbp - 0x69]
call fcn.14003b7cc
mov dword [rbp - 0x49], SysAllocStringByteLen
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rsi*8]
mov rcx, rbx
call fcn.14000c800
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001245c
mov r9, rbx
lea r8, [rbp - 0x41]
mov edx, 4
lea rcx, [rbp - 0x69]
call fcn.14003b4a0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x1400489d6
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400489d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048e29
call fcn.140066724
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea rax, vtable.AppV::LogFormatter.0
mov qword [rbp - 1], rax
lea rcx, [rbp + 0xf]
call fcn.140003c44
nop
lea rcx, [rbp - 0x41]
call fcn.140003c44
nop
lea rcx, [rbp - 0x21]
call fcn.140003c44
jmp 0x140048de5
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x30], r12d
mov edi, 5
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x48]
lea r8d, [rdi + 3]
mov edx, dword [rax + rsi*8]
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x140048ab3
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
test rax, rax
je 0x140048aa5
test rbx, rbx
je 0x140048a73
cmp rax, 4
ja 0x140048a73
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edi, dword [rsp + 0x38]
jmp 0x140048aa5
xor edi, edi
test rbx, rbx
jne 0x140048a88
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [rax], SafeArrayGetElement
jmp 0x140048a9a
cmp rax, 4
jbe 0x140048aa5
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ebx, 7
test edi, edi
je 0x140048be4
mov ecx, edi
call fcn.14004afc4
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
lea rdx, str.UserManager_processing_existing_logons__ignoring_session__1__in_state__2_
lea rcx, [rbp - 0x41]
call fcn.140003cac
nop
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rbx
mov word [rbp - 0x21], r12w
lea rdx, str.Client
lea rcx, [rbp - 0x21]
call fcn.140003cac
nop
call fcn.14000a10c
lea r8, [rbp - 0x41]
lea rdx, [rbp - 1]
call fcn.14003b330
mov rbx, rax
mov qword [rbp - 0x59], r12
mov edi, SafeArrayGetDim
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea r9, str.AppV::Client::Host::UserManagerImpl::EnumSessions
lea edx, [rdi + 0x22]
lea rcx, [rbp - 0x69]
call fcn.14003b7cc
mov dword [rbp - 0x49], 0xa9
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rsi*8]
mov rcx, rbx
call fcn.14000c800
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001245c
mov r9, rbx
lea r8, [rbp - 0x21]
lea edx, [rdi - 0xb]
lea rcx, [rbp - 0x69]
call fcn.14003b4a0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x140048bb0
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048e30
call fcn.140066724
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea rax, vtable.AppV::LogFormatter.0
mov qword [rbp - 1], rax
lea rcx, [rbp + 0xf]
call fcn.140003c44
nop
lea rcx, [rbp - 0x21]
call fcn.140003c44
nop
lea rcx, [rbp - 0x41]
jmp 0x140048a05
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
lea rdx, str.UserManager_processing_existing_logons__found_active_session__1_
lea rcx, [rbp - 0x41]
call fcn.140003cac
nop
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rbx
mov word [rbp - 0x21], r12w
lea rdx, str.Client
lea rcx, [rbp - 0x21]
call fcn.140003cac
nop
call fcn.14000a10c
lea r8, [rbp - 0x41]
lea rdx, [rbp - 1]
call fcn.14003b330
mov rbx, rax
mov qword [rbp - 0x59], r12
mov edi, SafeArrayGetDim
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea r9, str.AppV::Client::Host::UserManagerImpl::EnumSessions
lea edx, [rdi + 0x22]
lea rcx, [rbp - 0x69]
call fcn.14003b7cc
mov dword [rbp - 0x49], 0xaf
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rsi*8]
mov rcx, rbx
call fcn.14000c800
mov r9, rbx
lea r8, [rbp - 0x21]
lea edx, [rdi - 0xb]
lea rcx, [rbp - 0x69]
call fcn.14003b4a0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x140048cc0
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048cbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048e37
call fcn.140066724
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea rax, vtable.AppV::LogFormatter.0
mov qword [rbp - 1], rax
lea rcx, [rbp + 0xf]
call fcn.140003c44
nop
lea rcx, [rbp - 0x21]
call fcn.140003c44
nop
lea rcx, [rbp - 0x41]
call fcn.140003c44
mov rax, qword [rsp + 0x40]
mov r8b, 1
mov edx, dword [rax + rsi*8]
mov rcx, r15
call fcn.14004a084
mov rbx, rax
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140048d22
inc rax
jmp 0x140048d25
mov rax, r13
mov rdx, rax
lea rsi, [0x1400be678]
mov rcx, rsi
call fcn.140012a04
movabs rax, 0x8000000000
test rax, rbx
jne 0x140048de5
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140048d62
inc rax
jmp 0x140048d65
mov rax, r13
mov rdx, rax
mov rcx, rsi
call fcn.140012a04
movabs rax, 0x2000000000
test rax, rbx
jne 0x140048de5
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140048d97
inc rax
jmp 0x140048d9a
mov rax, r13
mov rdx, rax
mov rcx, rsi
call fcn.140012a04
mov rax, rbx
shr rax, 0x20
and al, 0x1f
cmp al, 0xe
jne 0x140048de5
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140048dca
inc rax
jmp 0x140048dcd
mov rax, r13
mov rdx, rax
mov rcx, rsi
call fcn.140012a04
shl rax, 0x34
or eax, 0x302
cmp ebx, eax
je 0x140048df3
inc r14d
cmp r14d, dword [rsp + 0x34]
jb 0x1400488c7
lea rcx, [rbp - 0x79]
call fcn.140006624
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400663d0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3