Function at 0x4372c0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4536c0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46d020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x463178
call fcn.004361f0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov esi, dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov ebx, eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x48], 0
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x50], 0
push eax
push 8
push ebx
push 0
call esi
test eax, eax
je 0x4373b0
mov eax, dword [ebp - 0x48]
movsx eax, byte [eax]
test eax, eax
jne 0x4373b0
mov ecx, 0x463328
call fcn.004361f0
mov edx, ebx
lea ecx, [ebp - 0x28]
call fcn.004360f0
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x437355
mov eax, dword [eax]
mov ecx, eax
call fcn.004361f0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0x10
jb 0x437374
push dword [ebp - 0x28]
call fcn.0043a7c5
add esp, 4
lea eax, [ebp - 0x50]
mov dword [ebp - 0x14], 0xf
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x18], 0
push eax
push 5
push ebx
push 0
mov byte [ebp - 0x28], 0
call esi
test eax, eax
je 0x4373a1
mov ecx, dword [ebp - 0x48]
call fcn.004361f0
mov ecx, str.User_logged_on_to_WinStation
call fcn.004361f0
jmp 0x4374bb
mov ecx, 0x4631a4
call fcn.004361f0
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0
push eax
lea eax, [ebp - 0x44]
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x4374b2
xor edi, edi
cmp dword [ebp - 0x4c], edi
jbe 0x4374b2
xor esi, esi
lea ebx, [ebx]
mov eax, dword [ebp - 0x44]
mov ecx, dword [esi + eax + 8]
mov edx, dword [esi + eax]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x40]
call fcn.004360f0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x437414
mov eax, dword [eax]
mov ecx, eax
call fcn.004361f0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0x10
jb 0x437433
push dword [ebp - 0x40]
call fcn.0043a7c5
add esp, 4
mov eax, dword [ebp - 0x44]
mov eax, dword [esi + eax + 8]
cmp eax, 9
ja case.default.0x43743f
jmp dword [eax*4 + 0x4374e4]
mov ecx, str.User_logged_on_to_WinStation
jmp 0x43748a
mov ecx, str.WinStation_connected_to_client
jmp 0x43748a
mov ecx, str.In_the_process_of_connecting_to_clientt
jmp 0x43748a
mov ecx, str.Shadowing_another_WinStation
jmp 0x43748a
mov ecx, str.WinStation_logged_on_without_client
jmp 0x43748a
mov ecx, str.Waiting_for_client_to_connect
jmp 0x43748a
mov ecx, str.WinStation_is_listening_for_connection
jmp 0x43748a
mov ecx, str.WinStation_is_being_reset
jmp 0x43748a
mov ecx, str.WinStation_is_down_due_to_error
jmp 0x43748a
mov ecx, str.WinStation_in_initialization
call fcn.004361f0
cmp dword [ebp - 0x54], 0
jne 0x4374a5
mov ecx, 0x46330c
call fcn.004361f0
mov eax, dword [ebp - 0x44]
mov ebx, dword [esi + eax]
inc edi
add esi, 0xc
cmp edi, dword [ebp - 0x4c]
jb 0x4373f0
push dword [ebp - 0x44]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ecx, 0x463348
call fcn.004361f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439fce
mov esp, ebp
pop ebp
ret