Function at 0x477950
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
push edi
mov edi, esi
push str._______Inside_GetShutDownPrivilegedSessionId_______n
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00423db0
add esp, 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
test eax, eax
je 0x477ae4
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x10], ebx
jbe 0x477aa5
jmp 0x4779b0
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx + eax + 8]
mov esi, dword [ebx + eax]
mov edx, dword [ebx + eax + 4]
push edi
push esi
push str.GetShutDownPrivilegedSessionId_:_The_State_of_the_Session_:__d_is_given_by__d__n
mov dword [ebp - 0x28], edx
call fcn.00423db0
add esp, 0xc
test edi, edi
je 0x477a15
cmp edi, 1
je 0x477a15
cmp edi, 4
jne 0x477a04
push esi
call fcn.00477720
add esp, 4
test eax, eax
je 0x4779fc
push esi
push str.Disconnected_Session_has_shutdown_privilege_:_session_id_:__d_n
call fcn.00423db0
add esp, 8
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
jmp 0x477a8a
push edi
push esi
push str.GetShutDownPrivilegedSessionId_:_The_detected_session_is_dummy_Session__its_value_is__d_with_state__d_._n
call fcn.00423db0
add esp, 0xc
jmp 0x477a8a
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 8]
push ecx
push 5
push esi
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x477a76
mov edi, dword [ebp - 8]
test edi, edi
je 0x477a8a
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x477a37
sub eax, edx
cmp eax, 1
jbe 0x477a8a
push edi
push str.Active_logged_on_userName_:__s_n
call fcn.00423db0
push esi
call fcn.00477720
add esp, 0xc
test eax, eax
jne 0x477ac4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], esi
test eax, eax
je 0x477a8a
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 8], 0
jmp 0x477a8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetShutDownPrivilegedSessionId_:_WTSQuerySessionInformation_Failed_with_errorcode__d__n
call fcn.00423ad0
add esp, 8
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0xc
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x10]
jb 0x4779b0
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 4], 0xffffffff
jne 0x477b2e
cmp edi, 0xffffffff
je 0x477b14
push edi
mov dword [ebp - 4], edi
push str.GetShutDownPrivilegedSessionId_:_No_shutdown_previleged_user___return_last_active_user:__d__n
jmp 0x477b26
push esi
push str.Session_has_shutdown_privilege_:_session_id_:__d_n
call fcn.00423db0
mov edx, dword [ebp - 0xc]
add esp, 8
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetShutDownPrivilegedSessionId_:_Unable_to_find_the_sessions_present_in_the_machine__with_error_code__d__n
call fcn.00423ad0
add esp, 8
push str.Microsoft_Windows_2000
call fcn.004623a0
push eax
call fcn.00493c91
add esp, 8
test eax, eax
jne 0x477b2e
mov dword [ebp - 4], ebx
jmp 0x477b2e
cmp esi, 0xffffffff
je 0x477b2e
cmp esi, ebx
je 0x477b2e
push esi
mov dword [ebp - 4], esi
push str.GetShutDownPrivilegedSessionId_:_No_shutdown_previleged_user__no_active_users___return_last_disconnected_user_:__d__n
call fcn.00423db0
add esp, 8
push str.________End_of_GetShutDownPrivilegedSessionId________n
call fcn.00423db0
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret