Function at 0x40ebf0
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.00410e60
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x1464]
mov dword [ebp - 0x145c], 0
push eax
lea eax, [ebp - 0x1458]
mov dword [ebp - 0x1460], 0
push eax
push 0x18
xor esi, esi
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x1464], esi
mov dword [ebp - 0x1458], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40ecd2
mov esi, dword [ebp - 0x1458]
test esi, esi
je 0x40ed13
mov eax, dword [esi + 4]
mov dword [ebp - 0x145c], eax
lea eax, [esi + 0x82]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00409270
lea eax, [esi + 0x60]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00409270
push dword [ebp - 0x145c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.GetLoggedCreds_WTSSessionInfo__:_szUserName___s__szDomain___s__dwSessionId___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x30
lea eax, [ebp - 0xc34]
push eax
call edi
mov esi, 1
jmp 0x40ecfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetLoggedCreds_WTSSessionInfo__:_WTSQuerySessionInformation___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40ed0b
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
jne 0x40ee8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x145c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40ee3a
push dword [ebp - 0x145c]
lea eax, [ebp - 0xc34]
push str.GetProcessSession__:_ProcessIdToSessionId_____dwSessID___d_n
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
lea eax, [ebp - 0x1458]
mov dword [ebp - 0x1458], 0
push eax
push 5
push dword [ebp - 0x145c]
call fcn.0040f330
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40ee65
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40edbb
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00409270
mov eax, dword [ebp - 0x1458]
add esp, 0xc
test eax, eax
je 0x40edb1
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x1458], 0
lea eax, [ebp - 0x1458]
push eax
push 7
push dword [ebp - 0x145c]
call fcn.0040f330
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40ee65
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40ee0b
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00409270
mov eax, dword [ebp - 0x1458]
add esp, 0xc
test eax, eax
je 0x40ee0b
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x145c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.GetLoggedCreds_WTSUserDomain__:_szUserName___s__szDomain___s__dwSessionId___d_n
lea eax, [ebp - 0x1454]
push 0x410
push eax
call fcn.00409270
add esp, 0x18
jmp 0x40ee7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcessSession__:_ProcessIdToSessionId___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
xor esi, esi
push str.GetLoggedCreds_WTSUserDomain___failed._n
lea eax, [ebp - 0x1454]
push 0x410
push eax
call fcn.00409270
add esp, 0xc
lea eax, [ebp - 0x1454]
push eax
call edi
test esi, esi
je 0x40eebe
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x145c]
call fcn.0040ef00
add esp, 0x10
test eax, eax
je 0x40eebe
mov eax, dword [ebp - 0x1460]
cmp word [eax], 0
jne 0x40eee1
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040f3f0
mov eax, dword [ebp - 0x1460]
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00410b68
mov esp, ebp
pop ebp
ret