Function at 0x41037630
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4114a5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x411bade8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.TPPCOIPW32.dll
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], 0
call fcn.410374a0
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
jne 0x410376c7
cmp dword [ebp - 0x2c], 0
jne 0x41037809
mov ecx, dword [ebp - 0x28]
call fcn.41003630
mov ecx, dword [ebp - 0x28]
call fcn.41003690
test eax, eax
je 0x410376b4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
push eax
call fcn.41003690
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x34], eax
jmp 0x410376bd
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41037803
jmp 0x410376cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 0x24], 0
jne 0x41037710
cmp dword [ebp - 0x1c], 0
jne 0x410377ff
mov ecx, dword [ebp - 0x18]
call fcn.41003630
mov ecx, dword [ebp - 0x18]
call fcn.41003690
test eax, eax
je 0x41037703
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.41003690
push eax
call esi
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x34]
je 0x410377ff
test eax, eax
jne 0x41037744
cmp dword [ebp - 0x2c], eax
jne 0x41037744
mov ecx, dword [ebp - 0x28]
call fcn.41003630
mov ecx, dword [ebp - 0x28]
call fcn.41003690
test eax, eax
je 0x41037741
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
push edx
call fcn.41003690
push eax
call esi
mov dword [ebp - 0x34], eax
jmp 0x41037744
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x10
push edi
push 0
call eax
add esp, 0x14
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str.PCoIP.VirtualChannelQuerySessionInformation_sessionID__d___returns__d_with_error__0x_x_.
push 0x1000001
push 0x1fa
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x1c
test esi, esi
je 0x41037865
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41037865
movzx eax, word [eax]
push eax
push str.PCoIP.Protocoltype:__d
push 0x1000001
push 0x201
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push ecx
lea ecx, [ebp - 0x40]
call fcn.410375c0
call eax
push str.VCProtokoll:_CHANNEL_VMWARE_PCOIP
push 0x1000001
push 0x203
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x14
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.41037510
mov eax, 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x41037809
cmp dword [ebp - 0x2c], 0
je 0x4103780d
mov esi, eax
jmp 0x41037836
mov ecx, dword [ebp - 0x28]
call fcn.41003630
mov ecx, dword [ebp - 0x28]
call fcn.41003690
test eax, eax
je 0x41037833
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
push edx
call fcn.41003690
push eax
call esi
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
call fcn.410035a0
push eax
lea ecx, [ebp - 0x40]
call fcn.41003690
push eax
push esi
push str.TPPCOIP32.dll_not_loaded__p___p___d.
push 0x1000001
push 0x209
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x1c
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.41037510
mov eax, dword [0x411bc458]
test eax, eax
jne 0x410378d9
cmp dword [0x411bc460], eax
jne 0x41037a3d
mov ecx, dword [0x411bc464]
call fcn.41003630
mov ecx, dword [0x411bc464]
call fcn.41003690
test eax, eax
je 0x410378c4
mov eax, dword [0x411bc45c]
mov ecx, dword [0x411bc464]
push eax
call fcn.41003690
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [0x411bc458], eax
jmp 0x410378cf
mov eax, dword [0x411bc458]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41037a34
jmp 0x410378df
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x411bc468], 0
jne 0x4103793b
cmp dword [0x411bc470], 0
jne 0x41037a30
mov ecx, dword [0x411bc474]
call fcn.41003630
mov ecx, dword [0x411bc474]
call fcn.41003690
test eax, eax
je 0x41037929
mov ecx, dword [0x411bc46c]
push ecx
mov ecx, dword [0x411bc474]
call fcn.41003690
push eax
call esi
mov dword [0x411bc468], eax
cmp dword [0x411bc468], 0
mov eax, dword [0x411bc458]
je 0x41037a30
test eax, eax
jne 0x41037982
cmp dword [0x411bc460], eax
jne 0x41037982
mov ecx, dword [0x411bc464]
call fcn.41003630
mov ecx, dword [0x411bc464]
call fcn.41003690
test eax, eax
je 0x4103797d
mov edx, dword [0x411bc45c]
mov ecx, dword [0x411bc464]
push edx
call fcn.41003690
push eax
call esi
mov dword [0x411bc458], eax
jmp 0x41037982
mov eax, dword [0x411bc458]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x10
push edi
push 0
call eax
add esp, 0x14
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str.ICA.VirtualChannelQuerySessionInformation_sessionID__d___returns__d_with_error__0x_x_.
push 0x1000001
push 0x219
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x1c
test esi, esi
je 0x41037aae
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41037aae
movzx eax, word [eax]
push eax
push str.Protocoltype:__d
push 0x1000001
push 0x220
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
mov ecx, dword [ebp - 0x10]
add esp, 0x14
push ecx
mov ecx, 0x411bc44c
call fcn.410375c0
call eax
push str.VCProtokoll:_CHANNEL_CITRIX_ICA
push 0x1000001
push 0x222
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x41037a3d
cmp dword [0x411bc460], 0
je 0x41037a41
mov esi, eax
jmp 0x41037a7b
mov ecx, dword [0x411bc464]
call fcn.41003630
mov ecx, dword [0x411bc464]
call fcn.41003690
test eax, eax
je 0x41037a75
mov edx, dword [0x411bc45c]
mov ecx, dword [0x411bc464]
push edx
call fcn.41003690
push eax
call esi
mov dword [0x411bc458], eax
mov esi, dword [0x411bc458]
mov ecx, 0x411bc44c
call fcn.410035a0
push eax
mov ecx, 0x411bc44c
call fcn.41003690
push eax
push esi
push str.no_ica_dll_or_old_dll_loaded__p___p___d.
push 0x1000001
push 0x228
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x1c
cmp dword [0x411bc484], 0
jne 0x41037b08
cmp dword [0x411bc48c], 0
jne 0x41037cab
mov ecx, dword [0x411bc490]
call fcn.41003630
mov ecx, dword [0x411bc490]
call fcn.41003690
test eax, eax
je 0x41037afb
mov eax, dword [0x411bc488]
mov ecx, dword [0x411bc490]
push eax
call fcn.41003690
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x411bc484], eax
cmp dword [0x411bc484], 0
je 0x41037cab
cmp dword [0x411bc494], 0
jne 0x41037b63
cmp dword [0x411bc49c], 0
jne 0x41037cab
mov ecx, dword [0x411bc4a0]
call fcn.41003630
mov ecx, dword [0x411bc4a0]
call fcn.41003690
test eax, eax
je 0x41037b56
mov ecx, dword [0x411bc498]
push ecx
mov ecx, dword [0x411bc4a0]
call fcn.41003690
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x411bc494], eax
cmp dword [0x411bc494], 0
je 0x41037cab
cmp dword [0x411bc484], 0
jne 0x41037bad
cmp dword [0x411bc48c], 0
jne 0x41037bad
mov ecx, dword [0x411bc490]
call fcn.41003630
mov ecx, dword [0x411bc490]
call fcn.41003690
test eax, eax
je 0x41037bad
mov edx, dword [0x411bc488]
mov ecx, dword [0x411bc490]
push edx
call fcn.41003690
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x411bc484], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x10
push 0xffffffffffffffff
push 0
call dword [0x411bc484]
test eax, eax
je 0x41037c86
mov eax, dword [ebp - 0x10]
movzx esi, word [eax]
push eax
mov ecx, 0x411bc478
call fcn.410375c0
call eax
mov ecx, esi
mov eax, esi
sub eax, 0
je 0x41037c75
dec eax
je 0x41037c43
dec eax
je 0x41037c11
push ecx
push str.VCProtokoll:_UNK__d_
push 0x1000001
push 0x245
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x14
jmp 0x41037cc7
push str.VCProtokoll:_CHANNEL_RDP
push 0x1000001
push 0x242
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
mov eax, 2
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.VCProtokoll:_CHANNEL_VC_UNKNOWN__internal_error_
push 0x2000001
push 0x23f
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
mov eax, 1
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.VCProtokoll:_CHANNEL_VC_UNKNOWN__console_
push 0x1000001
push 0x23c
jmp 0x41037cd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTS.WTSQuerySessionInformation_fails_with__d
push 0x1000001
push 0x24a
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x14
jmp 0x41037cc7
push str.WTSAPI32DLL_not_loaded.
push 0x1000001
push 0x250
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x10
push str.VCProtokoll:_CHANNEL_VC_UNKNOWN
push 0x1000001
push 0x253
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
mov eax, 4
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret