Function at 0x14002a530
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x1400820c0]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov r15, rcx
xor r12d, r12d
mov esi, 0xffffffff
mov dword [rbp + 0x310], r12d
mov qword [rbp + 0x300], r12
xor r14b, r14b
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x300]
xor edx, edx
xor ecx, ecx
lea r8d, [r12 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
xorps xmm0, xmm0
xorps xmm1, xmm1
lea r8d, [r12 + 6]
lea rdx, [0x14006e87c]
test eax, eax
je 0x14002b01c
movups xmmword [rbp + 0x150], xmm0
movdqu xmmword [rbp + 0x160], xmm1
lea rcx, [rbp + 0x150]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x150]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140009620
nop
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
lea rax, str.Session_count_is_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x13
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rsp + 0x68]
movsd qword [rbp + 0x10], xmm1
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8d, [r12 + 1]
lea rdx, [rbp]
mov rcx, qword [rsp + 0x38]
call fcn.14002c760
nop
lea rdi, [r12 - 1]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002a68d
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002a68d
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14002a68d
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14002a6ce
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a6c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b164
call fcn.140038e94
mov edx, r12d
mov r8d, dword [rbp + 0x310]
test r8d, r8d
je 0x14002a70b
mov r9, qword [rbp + 0x300]
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea rcx, [rax + rax*2]
lea rax, [r9 + rcx*8]
cmp dword [rax + 0x10], 0
je 0x14002a709
inc edx
cmp edx, r8d
jb 0x14002a6f0
jmp 0x14002a70b
mov esi, dword [rax]
mov qword [rbp + 0x2f8], r12
lea rdx, [rbp + 0x2f8]
mov ecx, esi
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov r8d, 6
lea rdx, [0x14006e87c]
test eax, eax
je 0x14002aef0
movups xmmword [rbp + 0x110], xmm0
movdqu xmmword [rbp + 0x120], xmm1
lea rcx, [rbp + 0x110]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x110]
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.140009620
nop
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x68], r12
lea rax, str.Impersonate_token_is_
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 0x17
movups xmm0, xmmword [rbp + 0x58]
movaps xmmword [rbp + 0x230], xmm0
movsd xmm1, qword [rbp + 0x68]
movsd qword [rbp + 0x240], xmm1
lea rax, [rbp + 0x2f8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
lea rdx, [rbp + 0x230]
mov rcx, qword [rbp - 0x60]
call fcn.14002cac0
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14002a80a
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002a80a
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14002a80a
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x14002a84b
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b17c
call fcn.140038e94
mov dword [rbp + 0x314], r12d
mov qword [rbp + 0x2f0], r12
lea rax, [rbp + 0x314]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x2f0]
lea edx, [r9 + 0xb]
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov r8d, 6
lea rdx, [0x14006e87c]
test eax, eax
je 0x14002adc9
movups xmmword [rbp + 0x190], xmm0
movdqu xmmword [rbp + 0x1a0], xmm1
lea rcx, [rbp + 0x190]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x190]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140009620
nop
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x80], r12
lea rax, str.Real_token_is_
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 0x10
movups xmm0, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0x250], xmm0
movsd xmm1, qword [rbp + 0x80]
movsd qword [rbp + 0x260], xmm1
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe0]
lea rdx, [rbp + 0x250]
mov rcx, qword [rbp - 0x30]
call fcn.14002cac0
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14002a972
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002a972
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14002a972
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14002a9b3
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a9ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b17c
call fcn.140038e94
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rbp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14002ac73
mov dword [rbp + 0x318], r12d
lea rax, [rbp + 0x318]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x308]
mov r8d, 5
mov edx, esi
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14002ac3f
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c0], xmm1
mov r8d, 6
lea rdx, [0x14006e87c]
lea rcx, [rbp + 0x1b0]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x1b0]
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.140009620
nop
mov rdx, qword [rbp + 0x308]
xorps xmm0, xmm0
test rdx, rdx
jne 0x14002aa85
movups xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400721a0]
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp - 0x20], dl
jmp 0x14002ab09
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002aa94
lea rcx, [rbp + 0x20]
call fcn.140010310
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400254a0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14002aaf7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002aaf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b16a
call fcn.140038e94
movdqa xmm0, xmmword [0x140072190]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x98], r12
lea rax, str.User_name_is_
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0xf
movups xmm0, xmmword [rbp + 0x88]
movaps xmmword [rbp + 0x270], xmm0
movsd xmm1, qword [rbp + 0x98]
movsd qword [rbp + 0x280], xmm1
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xf0]
mov r8d, 1
lea rdx, [rbp + 0x270]
mov rcx, qword [rbp - 0x80]
call fcn.140025f90
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14002abb7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002abb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b170
call fcn.140038e94
movdqa xmm0, xmmword [0x1400721a0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14002abfe
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002abfe
mov rbx, qword [rbp - 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14002abfe
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x14002ac3f
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ac3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b176
call fcn.140038e94
mov rcx, qword [rbp + 0x308]
test rcx, rcx
je 0x14002ac51
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov r14b, 1
mov rcx, qword [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002b12f
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
mov r8d, 6
lea rdx, [0x14006e87c]
lea rcx, [rbp + 0x1d0]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x1d0]
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.140009620
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb0], r12
lea rax, str.DuplicateTokenEx_failed___
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], 0x1c
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x2d0], xmm0
movsd xmm1, qword [rbp + 0xb0]
movsd qword [rbp + 0x2e0], xmm1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x130]
lea rdx, [rbp + 0x2d0]
mov rcx, qword [rbp - 0x70]
call fcn.140019af0
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14002ad69
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002ad69
mov rbx, qword [rbp - 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14002ad69
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x14002adaa
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ada5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b17c
call fcn.140038e94
mov rcx, qword [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002b12f
movups xmmword [rbp + 0x1f0], xmm0
movdqu xmmword [rbp + 0x200], xmm1
lea rcx, [rbp + 0x1f0]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x1f0]
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.140009620
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x4c], eax
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x50], r12
lea rax, str.GetTokenInformation_failed___
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], 0x1f
movups xmm0, xmmword [rbp + 0x40]
movaps xmmword [rbp + 0x290], xmm0
movsd xmm1, qword [rbp + 0x50]
movsd qword [rbp + 0x2a0], xmm1
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x140]
lea rdx, [rbp + 0x290]
mov rcx, qword [rbp - 0x50]
call fcn.140019af0
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14002ae9d
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002ae9d
mov rbx, qword [rbp - 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14002ae9d
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x14002aede
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002aed9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b17c
call fcn.140038e94
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002b12f
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm1
lea rcx, [rbp + 0x210]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x210]
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.140009620
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc8], r12
lea rax, str.WTSQueryUserToken_failed___
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 0x1d
movups xmm0, xmmword [rbp + 0xb8]
movaps xmmword [rbp + 0x2b0], xmm0
movsd xmm1, qword [rbp + 0xc8]
movsd qword [rbp + 0x2c0], xmm1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x100]
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp - 0x40]
call fcn.140019af0
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14002afd3
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002afd3
mov rbx, qword [rbp - 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14002afd3
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x14002b12f
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b12a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b164
jmp 0x14002b12a
movups xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x180], xmm1
lea rcx, [rbp + 0x170]
call fcn.140010590
nop
call fcn.140009730
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140009620
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
lea rax, str.WTSEnumerateSessions_failed___
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x20
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rsp + 0x68]
movsd qword [rbp + 0x10], xmm1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea rdx, [rbp]
mov rcx, qword [rsp + 0x38]
call fcn.140019af0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002b0f2
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002b0f2
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14002b0f2
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x14002b12f
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b12a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b15e
call fcn.140038e94
movzx eax, r14b
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.140038a00
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140042e3c
int3
call fcn.140042e3c
nop
call fcn.140042e3c
nop
call fcn.140042e3c
nop
call fcn.140042e3c
int3
call fcn.140042e3c
int3