Function at 0x47d3d0
Capabilities:
Compare security identifiers
Enumerate processes on remote desktop session host
Get explorer pid
Get session information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4cdbb0]
sub esp, 0x20
push edi
xor edi, edi
cmp eax, 0xffffffff
jne 0x47d59e
push ebx
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x47d4d1
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], edi
call dword [sym.imp.USER32.dll_GetShellWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
push 1
push edi
push edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x47d4c7
mov ebx, dword [ebp - 4]
cmp ebx, edi
je 0x47d4c7
mov edx, dword [ebp - 0x18]
xor eax, eax
cmp edx, edi
jbe 0x47d4c0
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx]
mov esi, dword [ebp - 0x1c]
mov ecx, ebx
jmp 0x47d460
cmp dword [ecx], edi
jne 0x47d46d
cmp dword [ecx + 4], esi
jne 0x47d46d
test esi, esi
jne 0x47d477
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x47d460
jmp 0x47d4be
shl eax, 4
mov esi, eax
mov edx, dword [esi + ebx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, eax
push edi
call fcn.00487e0b
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [esi + eax + 0xc]
add esp, 4
push ecx
push ebx
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
jne 0x47d4bb
push ebx
call fcn.00488a62
add esp, 4
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp - 4]
xor edi, edi
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea eax, [ebp - 0xc]
push eax
push 8
xor esi, esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x47d554
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x47d554
lea ecx, [ebp - 8]
push ecx
push edi
push edi
push 1
mov dword [ebp - 8], edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x47d548
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x47d548
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push eax
push esi
push 1
push ecx
call edi
test eax, eax
jne 0x47d548
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov bl, 1
cmp esi, edi
je 0x47d580
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x47d571
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x47d571
xor bl, bl
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x47d590
push eax
call fcn.00488a62
add esp, 4
xor eax, eax
test bl, bl
setne al
pop esi
pop ebx
mov dword [0x4cdbb0], eax
cmp eax, edi
setne al
pop edi
mov esp, ebp
pop ebp
ret