Function at 0x140085270
Capabilities:
Get session information

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, r8
mov rbp, rdx
mov edi, ecx
test ecx, ecx
jne 0x1400852ad
call fcn.14001ef60
mov rcx, rax
call fcn.1400b1f70
cmp eax, 4
jb 0x1400852ad
xor al, al
jmp 0x14008543b
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r14
xor r14b, r14b
xor r12d, r12d
mov qword [rsp + 0x68], rbx
mov esi, r12d
nop word [rax + rax]
cmp esi, 0xa
jge 0x140085423
lea rdx, str.Trying_to_start_app_in_session
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
mov rcx, rax
lea rdx, str.__attempt:
call fcn.140034a00
mov edx, esi
mov rcx, rax
call fcn.140047c40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140035dd0
movzx edx, al
mov rcx, rbx
call fcn.140035860
mov rcx, rbx
call fcn.14002eff0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov dword [rsp + 0x38], r12d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x140085451
lea rdx, str.Session
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
mov rcx, rax
lea rdx, str._cannot_be_queried_because_it_is_closed_or_a_close_operation_is_pending.
call fcn.140034a00
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140035dd0
movzx edx, al
mov rcx, rbx
call fcn.140035860
mov rcx, rbx
call fcn.14002eff0
lea rdx, str.Did_not_start_app_in_session
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
lea rdx, str.___the_session_wasnt_ready.
mov rcx, rax
call fcn.140034a00
mov rbx, rax
mov dl, 0xa
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.140035dd0
movzx edx, al
mov rcx, rbx
call fcn.140035860
mov rcx, rbx
call fcn.14002eff0
mov ecx, 0x3e8
inc esi
call qword [sym.imp.KERNEL32.dll_Sleep]
test r14b, r14b
je 0x1400852d0
mov r12, qword [rsp + 0x58]
movzx eax, r14b
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x70
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test ebx, ebx
je 0x14008548e
lea rdx, str.Session
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
mov rcx, rax
lea rdx, str._is_not_active.
jmp 0x14008538e
mov ecx, edi
call fcn.140085f70
test al, al
je 0x1400853ba
mov r8, r15
mov rdx, rbp
mov ecx, edi
call fcn.140085530
test al, al
je 0x1400854fc
mov rdx, rbp
mov ecx, edi
call fcn.140085c80
lea rcx, [0x1404b5d00]
test al, al
je 0x1400854e1
lea rdx, str.Successfully_started_app_in_session
mov r14b, 1
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
jmp 0x1400853e6
lea rdx, str.Failed_to_start_starting_app_in_session
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
jmp 0x1400853e6
lea rdx, str.Did_not_start_app_in_session
lea rcx, [0x1404b5d00]
call fcn.140034a00
mov edx, edi
mov rcx, rax
call fcn.140033380
lea rdx, str.___it_is_possible_that_no_user_is_logged_in.
jmp 0x1400853de