Function at 0x5450e400
Capabilities:
Create process on windows
Get session information

Disassembly:
sub esp, 0x68
push ebx
mov ebx, dword [esp + 0x70]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 8
push ebx
push 0
mov dword [esp + 0x18], 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
jne 0x5450e443
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSQuerySessionInformation_failed__d_r_n
call fcn.54517f46
add esp, 8
xor al, al
pop ebx
add esp, 0x68
ret
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [eax]
push edi
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
push esi
push str.TSConnectState__d_r_n
call fcn.54517f46
push ebx
push str.LogonUI.exe
call fcn.54507600
mov edi, eax
push edi
push str.sessionWelcomeScreen__d_r_n
call fcn.54517f46
add esp, 0x18
test esi, esi
jne 0x5450e642
test edi, edi
jne 0x5450e642
lea edx, [esp + 0xc]
push edx
push ebx
call dword [0x54545380]
test eax, eax
jne 0x5450e4c3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3f0
je 0x5450e64f
call esi
push eax
push str.WTSQueryUserToken_failed__d
call fcn.54517f46
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x68
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push 0
push 0x2000000
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x5450e512
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x54542850]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplicateTokenEx_failed__d
call fcn.54517f46
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x68
ret
mov edx, dword [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x5450e563
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x54542850]
mov edx, dword [esp + 0x10]
push edx
call dword [0x54542850]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEnvironmentBlock_failed__d
call fcn.54517f46
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x68
ret
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.54516b80
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x18]
push 0
push eax
push 0x400
push 0
push 0
push 0
push ecx
push 0
push edx
mov dword [esp + 0x5c], 0x44
mov word [esp + 0x8c], 5
mov dword [esp + 0x64], 0x54534088
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x54542850]
mov edx, dword [esp + 0x10]
push edx
call dword [0x54542850]
test esi, esi
jne 0x5450e603
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.0._CreateProcessAsUser_____d_n
call fcn.54517f46
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x68
ret
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.0._CreateProcessAsSessionUser_____d_n
call fcn.54517f46
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x68
ret
push str.TSConnectState___WTSActive__sessionWelcomeScreen
call fcn.54517f46
add esp, 4
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x7c]
push eax
push str.winsta0winlogon
push 0
push ecx
push ebx
push str.winlogon.exe
call fcn.54507600
add esp, 8
push eax
call fcn.54507bd0
add esp, 0x14
pop edi
test eax, eax
pop esi
setne al
pop ebx
add esp, 0x68
ret