Function at 0x14003ed38
Capabilities:
Get session information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r13, rcx
mov rsi, r9
lea rcx, [rbp - 0x41]
mov r12, r8
mov r14, rdx
call fcn.14003e770
mov r15b, 1
xor edi, edi
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x79], edi
call qword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
test eax, eax
js 0x14003ed9a
mov eax, dword [rbp - 0x79]
dec eax
test eax, 0xfffffffb
jne 0x14003efdb
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
jne 0x14003edae
mov qword [rbp - 0x61], rdi
jmp 0x14003eea0
lea rcx, [rbp - 0x75]
mov qword [rbp - 0x59], rdi
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x59]
xor ecx, ecx
mov dword [rbp - 0x75], edi
mov r8d, 0x18
mov edx, eax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14003eda5
mov rbx, qword [rbp - 0x59]
mov ecx, 0x30
call fcn.140111b94
lea rcx, [0x140039410]
mov rdx, rax
mov dword [rax], 1
mov qword [rax + 8], rcx
lea rcx, [0x140031640]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400322e0]
mov qword [rax + 0x18], rcx
mov rcx, qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov qword [rax + 0x20], rcx
lea rcx, [rbp - 0x51]
mov qword [rax + 0x28], rbx
call fcn.14006ad00
cmp dword [rbp - 0x75], 0xd8
mov rax, qword [rbp - 0x51]
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x51], rdi
jae 0x14003ee4a
lea rcx, [rbp - 0x71]
mov qword [rbp - 0x61], rdi
call fcn.14006ff40
jmp 0x14003eea0
mov rcx, qword [rbp - 0x59]
mov eax, dword [rcx + 0xc8]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0xcc]
lea rcx, [rbp - 0x61]
mov dword [rbp - 0x45], eax
mov rdx, qword [rbp - 0x49]
call fcn.140066ac0
lea rcx, [rbp - 0x71]
call fcn.14006ff40
mov rbx, qword [rbp - 0x61]
test rbx, rbx
je 0x14003eea0
lea rcx, [rbp - 0x31]
call fcn.140066980
mov rcx, qword [rax]
sub rcx, rbx
cmp rcx, 0x11e1a300
setge al
test al, al
je 0x14003efdb
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x79], edi
call qword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
test eax, eax
jns 0x14003eeb6
mov al, dil
jmp 0x14003eec2
mov eax, dword [rbp - 0x79]
add eax, 0xfffffffd
cmp eax, 1
setbe al
test al, al
jne 0x14003efdb
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
test rax, rax
je 0x14003ef8b
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14003ef8b
xor edx, edx
lea rcx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_MonitorFromRect]
mov rbx, rax
test rax, rax
je 0x14003ef8b
xor edx, edx
mov dword [rbp - 0x19], 0x28
lea rcx, [rbp - 0x15]
lea r8d, [rdx + 0x24]
call fcn.140113400
lea rdx, [rbp - 0x19]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x14003ef8b
test byte [rbp + 0xb], 1
je 0x14003ef8b
lea r8, [rbp - 0x15]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
je 0x14003ef8b
lea rdx, [rbp - 0x15]
lea rcx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x14003ef8b
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0xffffffec
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowLongW]
test ebx, 0x440000
jne 0x14003ef8b
test eax, 0x180
je 0x14003efd9
xor edi, edi
mov dword [rbp - 0x71], edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp - 0x71]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rbp - 0x71]
test ecx, ecx
je 0x14003efd2
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x14003efd2
lea rcx, [rbp - 0x69]
mov dword [rbp - 0x69], edi
call qword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
test byte [rbp - 0x69], 3
setne al
test al, al
jne 0x14003efdb
mov al, 1
jmp 0x14003f089
xor edi, edi
test r15b, r15b
je 0x14003eff8
mov eax, 8
mov rdx, r14
mov dword [r14 + 0x24], eax
mov dword [r14 + 4], eax
call fcn.1400a9360
mov r15b, dil
mov rbx, qword [rsi]
mov qword [rsi], rdi
test rbx, rbx
je 0x14003f017
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call fcn.140111e78
lea rcx, [r13 + 0x10]
lea rdx, [rbp - 0x41]
call fcn.14006b130
test al, al
lea rdx, [rbp - 0x39]
mov rcx, r12
sete dil
call fcn.1400a949c
cmp rsi, rax
je 0x14003f061
mov rdx, qword [rax]
and qword [rax], 0
mov rbx, qword [rsi]
mov qword [rsi], rdx
test rbx, rbx
je 0x14003f061
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call fcn.140111e78
mov rbx, qword [rbp - 0x39]
test rbx, rbx
je 0x14003f07e
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call fcn.140111e78
test dil, dil
jne 0x14003ed77
xor al, al
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140111850
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret