Function at 0x430fd0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485189
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a0
mov eax, dword [0x4ce19c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x230], ecx
push 1
push 1
push 1
push 0x173
push str.._tvt_logged_on_userinfo.cpp
push str.getUserTokenFromRunningProcess
xor edi, edi
push 0x493984
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], edi
call fcn.0040e269
lea ecx, [ebp - 0x248]
mov byte [ebp - 0x21d], 0
mov byte [ebp - 4], 2
mov dword [ebp - 0x228], edi
call fcn.00434530
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 3
xor bl, bl
call fcn.004341b0
lea ecx, [ebp - 0x248]
mov byte [ebp - 0x21e], al
call fcn.00434250
mov cl, byte [ebp - 0x21e]
test cl, cl
mov byte [ebp - 0x21f], al
jne 0x43107e
test al, al
je 0x4310cd
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x4310cd
push 0x493b24
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4310c6
call eax
cmp eax, 0xffffffff
je 0x4310c6
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x228]
push edx
push 5
push eax
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x26c]
call fcn.00434840
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x22c], edi
call fcn.00434e80
test al, al
je 0x431214
mov eax, dword [ebp - 0x22c]
cmp eax, edi
je 0x431214
push eax
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x431214
mov al, byte [ebp - 0x21e]
test al, al
jne 0x431139
mov al, byte [ebp - 0x21f]
test al, al
je 0x43113d
test bl, bl
jne 0x43114e
mov edx, dword [ebp + 0x14]
mov dword [edx], esi
mov byte [ebp - 0x21d], 1
jmp 0x431214
lea eax, [ebp - 0x224]
push eax
push 0xf01ff
push esi
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x431214
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4311d3
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x234], 0x208
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4311c8
mov ecx, dword [ebp - 0x228]
push ecx
lea edx, [ebp - 0x21c]
push edx
call sub.MSVCR71.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x4311c8
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov byte [ebp - 0x21d], 1
mov ecx, dword [ebp - 0x230]
call fcn.00430a20
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x431214
push 1
push 1
push 0x1bd
push str.._tvt_logged_on_userinfo.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.hUserToken
lea ecx, [ebp - 0x2ac]
call fcn.0042adf0
lea ecx, [ebp - 0x2ac]
call fcn.004027cc
mov eax, dword [ebp - 0x228]
cmp eax, edi
je 0x431224
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.004348d0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00434170
jmp 0x431291
mov ecx, dword [ebp - 0x238]
cmp ecx, edi
mov eax, 1
mov dword [ebp - 4], eax
je 0x4312af
mov dl, byte [ebp - 0x21d]
mov dword [ecx + 0x24], eax
mov byte [ecx + 0x2c], dl
cmp ecx, edi
mov byte [ebp - 4], 0
je 0x4312bc
mov edx, dword [ecx]
push eax
call dword [edx]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004034a5
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x21d]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00475533
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10