Function at 0x4120f0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x5d1124]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x51c], 0
push eax
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x518], 0
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
jne 0x412143
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f768
mov esp, ebp
pop ebp
ret
push edi
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, 1
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x514], edi
mov dword [ebp - 0x524], 0
mov byte [eax], 0x1b
cmp dword [ebp - 0x518], 0
jbe 0x41255c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x528], ecx
mov eax, dword [ebp - 0x51c]
push 0x100
push 0
movq xmm0, qword [ecx + eax]
mov eax, dword [ecx + eax + 8]
mov dword [ebp - 0x520], eax
lea eax, [ebp - 0x208]
push eax
movq qword [ebp - 0x544], xmm0
call fcn.00552b90
mov edi, dword [ebp - 0x544]
lea eax, [ebp - 0x52c]
add esp, 0xc
mov dword [ebp - 0x50c], 0
push eax
lea eax, [ebp - 0x50c]
push eax
push 5
push edi
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x41220d
push dword [ebp - 0x50c]
lea eax, [ebp - 0x208]
push eax
call esi
push dword [ebp - 0x50c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
je 0x41252c
push 0x100
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.00552b90
add esp, 0xc
mov dword [ebp - 0x50c], 0
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x50c]
push eax
push 6
push edi
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x412276
push dword [ebp - 0x50c]
lea eax, [ebp - 0x508]
push eax
call esi
push dword [ebp - 0x50c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0x100
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.00552b90
add esp, 0xc
mov dword [ebp - 0x50c], 0
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0xe
push edi
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x4122ee
mov ecx, dword [ebp - 0x50c]
movzx eax, byte [ecx + 9]
push eax
movzx eax, byte [ecx + 8]
push eax
movzx eax, byte [ecx + 7]
push eax
movzx eax, byte [ecx + 6]
push eax
lea eax, [ebp - 0x408]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push dword [ebp - 0x50c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0x100
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.00552b90
add esp, 0xc
mov dword [ebp - 0x50c], 0
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x50c]
push eax
push 4
push edi
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x412346
push dword [ebp - 0x50c]
lea eax, [ebp - 0x308]
push eax
call esi
push dword [ebp - 0x50c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00552b90
mov eax, dword [ebp - 0x520]
add esp, 0xc
cmp eax, 9
ja case.default.0x412367
jmp dword [eax*4 + 0x412588]
push str.Active
jmp 0x4123b9
push str.Connected
jmp 0x4123b9
push str.ConnectQuery
jmp 0x4123b9
push str.Shadow
jmp 0x4123b9
push str.Disconnected
jmp 0x4123b9
push str.SIdle
jmp 0x4123b9
push str.Listen
jmp 0x4123b9
push str.Reset
jmp 0x4123b9
push str.Down
jmp 0x4123b9
push str.Init
jmp 0x4123b9
push str.error
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call ebx
mov edi, eax
lea eax, [ebp - 0x308]
push eax
call ebx
add edi, eax
lea eax, [ebp - 0x408]
push eax
call ebx
add edi, eax
lea eax, [ebp - 0x508]
push eax
call ebx
add edi, eax
lea eax, [ebp - 0x208]
push eax
call ebx
mov ecx, dword [ebp - 0x514]
add eax, edi
mov edi, dword [ebp - 0x510]
add ecx, 5
add eax, ecx
push edi
mov dword [ebp - 0x520], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x520]
cmp eax, ecx
jae 0x412433
push 0x42
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edi, eax
mov dword [ebp - 0x510], edi
lea eax, [ebp - 0x208]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp - 0x514]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call ebx
mov edi, dword [ebp - 0x514]
inc edi
add edi, eax
lea eax, [ebp - 0x308]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 0x510]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x308]
push eax
call ebx
inc eax
add edi, eax
lea eax, [ebp - 0x408]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebp - 0x510]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
call ebx
inc eax
add edi, eax
lea eax, [ebp - 0x508]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x508]
push eax
mov eax, dword [ebp - 0x510]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
call ebx
inc eax
add edi, eax
lea eax, [ebp - 0x108]
push eax
call ebx
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x510]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call ebx
inc edi
add edi, eax
mov dword [ebp - 0x514], edi
jmp 0x412532
mov edi, dword [ebp - 0x514]
mov eax, dword [ebp - 0x524]
mov ecx, dword [ebp - 0x528]
inc eax
add ecx, 0xc
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x528], ecx
cmp eax, dword [ebp - 0x518]
jb 0x412192
pop esi
pop ebx
push dword [ebp - 0x51c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0x42
push edi
push dword [ebp - 0x510]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0054f768
mov esp, ebp
pop ebp
ret