Function at 0x180009634
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x118
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
mov r8d, 8
mov edx, dword [rsp + 0x120]
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x180009717
jmp 0x180009b37
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [rsp + 0x60], 0
je 0x18000974b
cmp dword [rsp + 0x60], 4
je 0x18000974b
jmp 0x180009b37
cmp dword [rsp + 0x120], 0
jne 0x18000975f
jmp 0x1800097fe
lea rdx, [rsp + 0x78]
mov ecx, dword [rsp + 0x120]
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x180009793
cmp dword [rsp + 0x54], 0
je 0x180009789
jmp 0x1800097fe
jmp 0x180009906
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x68], 8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
lea r8, [rsp + 0xa8]
mov edx, 0x13
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1800097fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x520
jne 0x1800097f4
mov qword [rsp + 0xa8], 0
jmp 0x1800097fe
jmp 0x180009b37
cmp dword [rsp + 0x54], 0
je 0x180009906
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
mov edx, 0x2000000
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800098fc
mov dword [rsp + 0xd8], 0x18
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0xe8], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1800098aa
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009b37
cmp dword [rsp + 0x50], 0
je 0x1800098ef
mov r9d, 4
lea r8, [rsp + 0x120]
mov edx, 0xc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1800098ef
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009b37
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009906
jmp 0x180009b37
cmp dword [rsp + 0x54], 0
jne 0x180009a4b
cmp dword [rsp + 0x120], 0
je 0x180009a4b
mov dword [rsp + 0x64], 0
mov edx, dword [rsp + 0x120]
lea rcx, str.explorer.exe
call fcn.18000955c
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
jbe 0x180009a41
mov r8d, dword [rsp + 0x64]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0xffffffffffffffff
je 0x180009a35
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0x98], 0
lea r8, [rsp + 0x98]
mov edx, 0x2000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180009a0d
mov dword [rsp + 0xf0], 0x18
mov qword [rsp + 0xf8], 0
mov dword [rsp + 0x100], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009a25
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009b37
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180009a3f
jmp 0x180009b37
jmp 0x180009a4b
jmp 0x180009b37
cmp dword [rsp + 0x50], 0
jne 0x180009a5c
jmp 0x180009b37
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov qword [rsp + 0xa0], 0
mov r8d, 1
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x180009b27
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x138]
lea r8, [rsp + 0xb0]
mov edx, dword [rsp + 0x54]
mov ecx, 1
call fcn.180008628
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0xb0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
test eax, eax
jne 0x1800097fe
cmp qword [rsp + 0x58], 0
je 0x180009b4a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x78], 0
je 0x180009b5d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x6c]
add rsp, 0x118
ret