Function at 0x10002e5f
Capabilities:
Get session information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, dword [0x1002d1b8]
mov ecx, dword [0x1002d1bc]
xor esi, esi
mov ebp, esp
lea ebx, [esp + 4]
mov dword [esp + 0xc], 0
xor edx, edx
cmp edi, 0xffffffff
mov dword [esp + 0x14], edx
je 0x10002ef3
mov dword [esp + 4], esi
mov dword [esp], esi
push ebp
push ebx
push 8
push edi
push esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
cmp dword [0x1002d1bc], 0xa
jl 0x10002ed0
mov ecx, dword [0x1002d1b8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10002ed0
mov dword [esp + 4], esi
mov dword [esp], esi
push ebp
push ebx
push 8
push edi
push esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
jmp 0x10002e90
test eax, eax
je 0x10002f0d
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [eax], 0
sete cl
mov dword [esp + 8], ecx
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 8]
jmp 0x10002fb4
mov dword [esp + 4], 0
cmp ecx, 0xa
jl 0x10002f14
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10002f3c
jmp 0x10002f14
xor eax, eax
jmp 0x10002fb4
mov dword [esp], esi
push ebp
push ebx
push 1
push esi
push esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp dword [0x1002d1bc], 0xa
jl 0x10002f4c
mov ecx, dword [0x1002d1b8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10002f4c
mov dword [esp], esi
push ebp
push ebx
push 1
push esi
push esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
jmp 0x10002f14
test eax, eax
je 0x10002f76
mov ebp, dword [esp + 4]
mov eax, dword [esp]
test eax, eax
jle 0x10002f69
lea ecx, [ebp + 8]
cmp dword [ecx], 0
je 0x10002f7d
add ecx, 0xc
dec eax
jne 0x10002f5e
mov dword [esp + 8], 0
xor edi, edi
dec edi
jmp 0x10002f87
xor eax, eax
xor edi, edi
dec edi
jmp 0x10002fb4
mov edi, dword [ecx - 8]
xor eax, eax
inc eax
mov dword [esp + 8], eax
push ebp
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [0x1002d1bc], 0xa
jl 0x10002fae
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10002fae
push ebp
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x10002f87
mov ebp, esp
mov eax, dword [esp + 8]
test eax, eax
jne 0x10003010
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1002d1b8]
mov ecx, dword [0x1002d1bc]
cmp ecx, 0xa
jl 0x10002ff1
lea edx, [eax + 1]
imul edx, eax
and edx, 1
je 0x10002ff1
mov ebp, 0x1f4
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
push ebp
call ebx
jmp 0x10002fc3
mov edx, dword [esp + 0x14]
inc edx
cmp edx, 0x78
sete bl
mov dword [esp + 0xc], ebx
lea ebx, [esp + 4]
mov ebp, esp
jne 0x10002e87
xor esi, esi
jmp 0x10003019
xor esi, esi
test byte [esp + 0xc], 1
je 0x10003023
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], 0
push ebx
push edi
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp dword [0x1002d1bc], 0xa
jl 0x10003055
mov ecx, dword [0x1002d1b8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10003055
push ebx
push edi
call sub.WTSAPI32.dll_WTSQueryUserToken
jmp 0x1000302b
test eax, eax
je 0x1000300c
mov dword [esp], 0
mov esi, dword [esp + 4]
sub esp, 0x18
mov dword [esp + 0x14], ebp
movaps xmm0, xmmword [0x10024310]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [0x1002d1bc], 0xa
jl 0x100030ea
mov ecx, dword [0x1002d1b8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x100030ea
mov edi, dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
sub esp, 0x18
mov dword [esp + 0x14], ebp
movaps xmm0, xmmword [0x10024310]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call edi
sub esp, 0x18
mov dword [esp + 0x14], ebp
movaps xmm0, xmmword [0x10024310]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
call edi
cmp dword [0x1002d1bc], 0xa
jl 0x100030ea
mov ecx, dword [0x1002d1b8]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x100030a0
test eax, eax
je 0x1000300c
mov dword [esp + 0x18], 0
lea esi, [esp + 0x10]
push 4
push esi
call sub.NTDLL.dll_RtlZeroMemory
cmp dword [0x1002d1bc], 0xa
jl 0x1000316b
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000316b
push 4
push esi
call sub.NTDLL.dll_RtlZeroMemory
cmp dword [0x1002d1bc], 0xa
jl 0x10003140
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10003161
push 4
push esi
call sub.NTDLL.dll_RtlZeroMemory
cmp dword [0x1002d1bc], 0xa
jl 0x100030fe
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x100030fe
push 4
push esi
call sub.NTDLL.dll_RtlZeroMemory
jmp 0x10003140
lea eax, [esp + 0x18]
push eax
push 4
push esi
push 0x13
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000318e
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003195
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1bc], 0xa
jl 0x10003019
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10003019
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
cmp dword [0x1002d1bc], 0xa
jl 0x100031e7
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10003203
push edi
call ebx
cmp dword [0x1002d1bc], 0xa
jl 0x10003208
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10003208
push edi
call ebx
jmp 0x100031e7
push edi
call ebx
cmp dword [0x1002d1bc], 0xa
jl 0x10003019
mov eax, dword [0x1002d1b8]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100031cb
jmp 0x10003019