Function at 0x4a4821
Capabilities:
Get session information

Disassembly:
push 0x3c
push 0x4fd498
call fcn.004fbd5c
mov edi, ecx
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x40], esi
push 2
pop ebx
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov eax, esi
mov dword [ebp - 0x34], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x4a4869
cmp word [edx], si
je 0x4a4869
mov ecx, edx
call fcn.004a7fd8
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x4a4977
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4a48e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a48c4
test byte [eax + 0x1c], 8
je 0x4a48c4
cmp byte [eax + 0x19], bl
jb 0x4a48c4
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x17
mov edx, 0x417cf0
pop ecx
call fcn.00421fda
test esi, esi
jle 0x4a48d3
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4a4e04
mov esi, 0x80004005
jmp 0x4a4e07
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp + 0xc], ecx
jne 0x4a4977
mov dword [edi + 0x84], 0xd
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x4a493a
test byte [eax + 0x1c], 1
je 0x4a493a
cmp byte [eax + 0x19], bl
jb 0x4a493a
call fcn.0042386b
mov ecx, dword [section..data]
push esi
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov edx, 0x417cf0
push 0x18
pop ecx
call fcn.00421fda
mov ecx, dword [ebp - 0x2c]
mov eax, dword [section..data]
cmp dword [ebp + 0xc], ecx
jne 0x4a497c
cmp eax, edi
je 0x4a48d9
test byte [eax + 0x1c], 8
je 0x4a48d9
cmp byte [eax + 0x19], bl
jb 0x4a48d9
call fcn.0042386b
mov esi, 0x80004005
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x19
mov edx, 0x417cf0
pop ecx
call fcn.00421fda
jmp 0x4a4e07
mov edi, section..data
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a4a02
cmp word [eax], si
je 0x4a4a02
push eax
call dword [sym.imp.WTSAPI32.dll_WTSOpenServerW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x80], eax
test eax, eax
jne 0x4a4a05
mov eax, dword [section..data]
cmp eax, edi
je 0x4a49e4
test byte [eax + 0x1c], 8
je 0x4a49e4
cmp byte [eax + 0x19], bl
jb 0x4a49e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4a49c5
movzx esi, si
or esi, 0x80070000
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x417cf0
push 0x1a
pop ecx
call fcn.00421fda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4a4e07
movzx esi, si
or esi, 0x80070000
jmp 0x4a4e07
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
push dword [ecx + 0x80]
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x4a4a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x4a48c4
test byte [eax + 0x1c], 8
je 0x4a48c4
cmp byte [eax + 0x19], bl
jb 0x4a48c4
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1b
jmp 0x4a48b9
cmp dword [ebp - 0x24], esi
jne 0x4a4aaa
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4aa0
test byte [eax + 0x1c], 8
je 0x4a4aa0
cmp byte [eax + 0x19], bl
jb 0x4a4aa0
call fcn.0042386b
mov esi, 0x8000ffff
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1c
jmp 0x4a4967
mov esi, 0x8000ffff
jmp 0x4a4e07
cmp dword [ebp - 0x30], 0xd8
je 0x4a4ae5
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4aa0
test byte [eax + 0x1c], 8
je 0x4a4aa0
cmp byte [eax + 0x19], bl
jb 0x4a4aa0
call fcn.0042386b
mov esi, 0x8000ffff
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1d
jmp 0x4a4967
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x20]
cmp dword [edx], esi
je 0x4a4b38
mov dword [eax + 0x84], 0xe
mov ecx, dword [section..data]
cmp ecx, edi
je 0x4a4b3e
test byte [ecx + 0x1c], 1
je 0x4a4b3e
cmp byte [ecx + 0x19], bl
jb 0x4a4b3e
mov esi, dword [edx]
call fcn.0042386b
mov ecx, dword [section..data]
push 0
push esi
push dword [ebp + 0xc]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.004a3fc3
xor esi, esi
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x44]
mov ecx, dword [section..data]
cmp dword [edx], esi
je 0x4a4b79
cmp ecx, edi
je 0x4a4b6f
test byte [ecx + 0x1c], 8
je 0x4a4b6f
cmp byte [ecx + 0x19], bl
jb 0x4a4b6f
call fcn.0042386b
mov esi, 0x80070015
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1f
jmp 0x4a4967
mov esi, 0x80070015
jmp 0x4a4e07
push edx
mov ecx, eax
call fcn.004a53ac
mov esi, eax
test esi, esi
jns 0x4a4bd0
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4e04
test byte [eax + 0x1c], 8
je 0x4a4e04
cmp byte [eax + 0x19], bl
jb 0x4a4e04
call fcn.0042386b
push esi
push 0x40f544
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x20
mov edx, 0x417cf0
pop ecx
call fcn.0042371b
jmp 0x4a4e07
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
call fcn.004a4e48
mov esi, eax
test esi, esi
jns 0x4a4c20
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4e04
test byte [eax + 0x1c], 8
je 0x4a4e04
cmp byte [eax + 0x19], bl
jb 0x4a4e04
call fcn.0042386b
push esi
push 0x40f544
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
jmp 0x4a4bc0
and dword [ebp - 4], 0
push 0x2000
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x20]
push dword [eax + 0x4c]
push dword [eax + 0x48]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
call fcn.004a3f85
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x20]
jmp 0x4a4d01
test esi, esi
jns 0x4a4d4e
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4e04
test byte [eax + 0x1c], 8
je 0x4a4e04
cmp byte [eax + 0x19], bl
jb 0x4a4e04
call fcn.0042386b
push esi
push 0x4176c0
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x417cf0
push 0x27
pop ecx
call fcn.0042371b
jmp 0x4a4e04
xor eax, eax
inc eax
mov edx, 0x501e14
xchg dword [edx], eax
test eax, eax
je 0x4a4d94
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4d90
test byte [eax + 0x1c], 8
je 0x4a4d90
cmp byte [eax + 0x19], bl
jb 0x4a4d90
call fcn.0042386b
push 0
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x417cf0
push 0x28
pop ecx
call fcn.00421fda
xor esi, esi
jmp 0x4a4e04
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x4a4df8
cmp edx, 7
jae 0x4a4db3
mov eax, dword [edx*4 + 0x417c24]
mov dword [ecx + 0x84], eax
test edx, edx
je 0x4a4df8
mov eax, dword [section..data]
cmp eax, edi
je 0x4a4df1
test byte [eax + 0x1c], 8
je 0x4a4df1
cmp byte [eax + 0x19], bl
jb 0x4a4df1
call fcn.0042386b
mov esi, 0x80070005
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov edx, 0x417cf0
push 0x29
pop ecx
call fcn.00421fda
jmp 0x4a4e04
mov esi, 0x80070005
jmp 0x4a4e04
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov word [eax + 0x3ffe], cx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4a4e15
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
js 0x4a4e1e
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [ebp - 0x28], 0
je 0x4a4e2e
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x14