Function at 0x180096d10
Capabilities:
Get session information

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0xb0
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rcx + 0x20]
mov rbp, rcx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r12
mov r12d, 1
mov qword [r11 + 0x20], r13
xor r13b, r13b
mov rax, qword [rdx + 0x30]
mov rdi, qword [rdx + 0x2b0]
mov qword [r11 - 0x20], r14
mov r14, qword [rdx + 0x2b8]
mov qword [r11 - 0x28], r15
mov qword [rsp + 0x58], rcx
mov rcx, qword [rax + 0x10]
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movsd qword [rsp + 0x48], xmm7
mov r15, qword [rcx + 8]
mov rax, qword [r15 + 0x140]
mov esi, dword [rax + 0x1c0]
cmp rdi, r14
je 0x180096e54
movaps xmmword [r11 - 0x38], xmm6
nop dword [rax + rax]
mov rbx, qword [rdi]
mov rdx, qword [rbp + 0x20]
mov rcx, rbx
mov rax, qword [rbx]
mov rdx, qword [rdx + 0x2e0]
call qword [rax + 0x18]
test al, al
movzx r13d, r13b
cmove r13d, r12d
test esi, esi
je 0x180096df9
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2e0]
test rax, rax
je 0x180096df9
xor edx, edx
lea r8d, [rsi + rsi]
div r8
test rdx, rdx
jne 0x180096df9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x180096df9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test rax, rax
je 0x180096e35
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call fcn.18004e920
movaps xmm6, xmm0
call fcn.1803268a4
cmp ax, 0xffff
je 0x180096e31
xorps xmm6, xmm6
addsd xmm7, xmm6
add rdi, 8
cmp rdi, r14
jne 0x180096da0
mov rdx, qword [rbp + 0x20]
movaps xmm6, xmmword [rsp + 0x90]
movsd qword [rsp + 0x48], xmm7
mov eax, dword [rdx]
lea rcx, [rdx + 0x2a0]
mov dword [rsp + 0x34], eax
mov eax, dword [rdx]
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x38], eax
call fcn.180097240
mov rcx, qword [rbp + 0x20]
lea rbx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
comisd xmm7, xmmword [rax]
cmovbe rbx, rax
add rcx, 0x2a0
call fcn.180097240
mov rcx, qword [rbx]
movaps xmm7, xmmword [rsp + 0x80]
mov qword [rax], rcx
mov edx, dword [r15 + 0xe0]
test edx, edx
je 0x180096ecf
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx + 0x2e0]
test rax, rax
je 0x180096ecf
lea r8d, [rdx + rdx]
xor edx, edx
div r8
test rdx, rdx
jne 0x180096ecf
call fcn.180095d50
mov rax, qword [rbp + 0x20]
inc qword [rax + 0x2e0]
mov rax, qword [r15 + 0x140]
cmp byte [rax], 0
je 0x180096f7d
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
mov rbx, qword [rbp + 0x20]
test eax, eax
je 0x180096f19
cmp byte [rsp + 0x60], 0
movzx eax, byte [rbx + 0x21]
sete dil
add rbx, 0x21
test dil, dil
je 0x180096f24
test al, al
je 0x180096f28
jmp 0x180096f7d
movzx eax, byte [rbx + 0x21]
xor dil, dil
add rbx, 0x21
test al, al
je 0x180096f7d
lea rax, str.e_1_33mon_battery_powere_0m
test dil, dil
lea r9, str.e_1_32mon_AC_powere_0m
mov ecx, 6
cmovne r9, rax
lea r8, str.e_45_1me_1_37m_miner___e_0m
lea rdx, str._s__s
call fcn.180025c20
mov byte [rbx], dil
mov rcx, qword [rbp + 0x20]
movzx eax, dil
lea eax, [rax*2 - 1]
add dword [rcx + 0x24], eax
mov rcx, rbp
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x24], 0
sete dl
call fcn.180096850
mov rax, qword [r15 + 0x140]
xor ebx, ebx
imul r15d, dword [rax + 0x70], 0x3e8
test r15d, r15d
je 0x1800970c5
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, r12d
mov dword [rsp + 0x30], ebx
xor edx, edx
xor ecx, ecx
mov edi, ebx
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
lea r12d, [rbx - 1]
test eax, eax
jne 0x180096fcb
mov edi, r12d
jmp 0x180097045
mov rsi, rbx
cmp dword [rsp + 0x30], ebx
jbe 0x18009703a
mov r14, rbx
mov ebp, 1
nop dword [rax]
mov rax, qword [rsp + 0x40]
lea r9, [rsp + 0x50]
xor ecx, ecx
mov edx, dword [r14 + rax]
lea rax, [rsp + 0x3c]
lea r8d, [rcx + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x3c], ebx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x180097025
mov rcx, qword [rsp + 0x50]
mov ebx, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test ebx, ebx
cmove edi, ebp
xor ebx, ebx
mov eax, dword [rsp + 0x30]
inc rsi
add r14, 0x18
cmp rsi, rax
jb 0x180096fe0
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test edi, edi
mov esi, r15d
mov rdi, qword [rbp + 0x20]
setg bl
dec rbx
cmp rbx, rsi
movzx eax, byte [rdi + 0x22]
setb r14b
jae 0x180097067
test al, al
je 0x18009706b
jmp 0x1800970c3
test al, al
je 0x1800970c3
lea rax, str.e_1_33muser_activee_0m
cmp rbx, rsi
lea r9, str.e_1_32muser_inactivee_0m
mov ecx, 6
cmovb r9, rax
lea r8, str.e_45_1me_1_37m_miner___e_0m
lea rdx, str._s__s
call fcn.180025c20
mov byte [rdi + 0x22], r14b
cmp rbx, rsi
mov rax, qword [rbp + 0x20]
mov ecx, 1
cmovb r12d, ecx
mov rcx, rbp
add dword [rax + 0x24], r12d
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x24], 0
sete dl
call fcn.180096850
xor ebx, ebx
mov r15, qword [rsp + 0xa0]
test r13b, r13b
mov r13, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
je 0x180097148
mov eax, ebx
lea rcx, [0x1804bf350]
xchg byte [0x1804bf339], al
lea rdx, [0x1804bf368]
nop dword [rax + rax]
mov rax, rbx
xchg qword [rcx], rax
add rcx, 8
cmp rcx, rdx
jne 0x180097110
mov rax, qword [rbp + 0x20]
mov rdi, qword [rax + 0x2b8]
mov rbx, qword [rax + 0x2b0]
cmp rbx, rdi
je 0x180097148
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x68]
add rbx, 8
cmp rbx, rdi
jne 0x180097136
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0xb0
pop rdi
pop rbp
pop rbx
ret