Function at 0x40ece0
Capabilities:
Get session information
Get session user name
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.00412130
mov eax, dword [0x442074]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x105c], edx
mov ebx, ecx
mov dword [ebp - 0x1058], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40eede
push dword [ebx]
lea eax, [ebp - 0x82c]
push str.GetProcessSession__:_ProcessIdToSessionId_____dwSessID___d_n
push 0x410
push eax
call fcn.0040af70
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x82c]
add esp, 0x10
push eax
call esi
lea eax, [ebp - 0x1054]
mov dword [ebp - 0x1050], 0
push eax
lea eax, [ebp - 0x1050]
xor edi, edi
push eax
push 5
push dword [ebx]
mov dword [ebp - 0x1054], edi
push edi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x40ed9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation___err___d_n
lea eax, [ebp - 0x82c]
push 0x410
push eax
call fcn.0040af70
add esp, 0x10
jmp 0x40ee70
push dword [ebp - 0x1050]
lea eax, [ebp - 0x82c]
push 5
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation__d____s_n
push 0x410
push eax
call fcn.0040af70
add esp, 0x14
lea eax, [ebp - 0x82c]
push eax
call esi
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x40ee03
mov ecx, dword [ebp - 0x105c]
test ecx, ecx
je 0x40ee03
push eax
push 0x104
push ecx
call fcn.0040af70
mov eax, dword [ebp - 0x1050]
add esp, 0xc
test eax, eax
je 0x40edfd
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov dword [ebp - 0x1050], edi
lea eax, [ebp - 0x1054]
xor edi, edi
push eax
lea eax, [ebp - 0x1050]
mov dword [ebp - 0x1054], edi
push eax
push 7
push dword [ebx]
push edi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x40ee4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation___err___d_n
lea eax, [ebp - 0x82c]
push 0x410
push eax
call fcn.0040af70
add esp, 0x10
jmp 0x40ee70
push dword [ebp - 0x1050]
lea eax, [ebp - 0x82c]
mov edi, 1
push 7
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation__d____s_n
push 0x410
push eax
call fcn.0040af70
add esp, 0x14
lea eax, [ebp - 0x82c]
push eax
call esi
test edi, edi
je 0x40ef0f
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x40eeb5
mov ecx, dword [ebp - 0x1058]
test ecx, ecx
je 0x40eeb5
push eax
push 0x104
push ecx
call fcn.0040af70
mov eax, dword [ebp - 0x1050]
add esp, 0xc
test eax, eax
je 0x40eeb5
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push dword [ebx]
lea eax, [ebp - 0x104c]
push dword [ebp - 0x1058]
push dword [ebp - 0x105c]
push str.GetLoggedCreds_WTSUserDomain__:_szUserName___s__szDomain___s__dwSessionId___d_n
push 0x410
push eax
call fcn.0040af70
add esp, 0x18
jmp 0x40ef28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcessSession__:_ProcessIdToSessionId___err___d_n
lea eax, [ebp - 0x82c]
push 0x410
push eax
call fcn.0040af70
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x82c]
add esp, 0x10
push eax
call esi
xor edi, edi
push str.GetLoggedCreds_WTSUserDomain___failed._n
lea eax, [ebp - 0x104c]
push 0x410
push eax
call fcn.0040af70
add esp, 0xc
lea eax, [ebp - 0x104c]
push eax
call esi
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411e49
mov esp, ebp
pop ebp
ret