Function at 0x1400a1040
Capabilities:
Get session information

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400ee0e8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r14, rcx
lea rdx, str.start
lea rcx, [rbp - 0x19]
call fcn.14000bac0
mov rdx, rax
call fcn.1400a18f0
xor edx, edx
call fcn.14007f630
xor edi, edi
mov ebx, edi
lea rcx, [r14 + 0x28]
call section..gxjmxw
test al, al
jne 0x1400a10c6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x1400a10a7
lea rdx, [rbp - 0x68]
lea rcx, [r14 + 0x28]
call fcn.1400a74a0
mov byte [rbp - 0x69], al
mov esi, edi
mov r12d, edi
xorps xmm7, xmm7
mov r15d, edi
call fcn.14000c5a0
mov rcx, rax
test rax, rax
jne 0x1400a10f9
mov ecx, 0x80004005
call fcn.14000c2c0
int3
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea r8, [0x1400de840]
cmp rax, r8
jne 0x1400a1116
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
jmp 0x1400a1118
call rdx
lea rbx, [rax + 0x18]
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x31], rdi
mov dword [rbp - 0x29], edi
lea rcx, [rbp - 0x31]
call fcn.1400900c0
mov eax, dword [rbp - 0x29]
cmp eax, 1
jne 0x1400a118f
mov ecx, 0x268
call fcn.140051bb8
mov rdi, rax
mov qword [rbp - 0x41], rax
lea rax, [0x1400de8c8]
mov qword [rdi], rax
call fcn.140001580
test eax, eax
je 0x1400a1189
lea rdx, [rdi + 0x208]
lea rcx, [rdi + 8]
call fcn.140001230
mov dword [rdi + 0x20c], 0x10048
mov dword [rdi + 0x260], 0
mov rcx, rdi
call section..x83if2
nop
mov qword [rbp - 0x31], rdi
jmp 0x1400a11b5
cmp eax, 2
jne 0x1400a11b1
lea ecx, [rax + 0x4e]
call fcn.140051bb8
mov qword [rbp - 0x41], rax
mov rcx, rax
call section..nkoo2u
mov rdi, rax
mov qword [rbp - 0x31], rax
jmp 0x1400a11b5
mov rdi, qword [rbp - 0x31]
cmp byte [r14 + 0x20], 0
jne 0x1400a1782
mov eax, esi
inc esi
mov dword [rbp - 0x41], esi
cmp eax, 0xc
jle 0x1400a121a
movzx ecx, byte [r14 + 0x38]
mov eax, dword [r14 + 0x3c]
movzx ebx, byte [r14 + 0x40]
movzx eax, byte [r14 + 0x41]
movzx eax, byte [r14 + 0x42]
movzx eax, byte [r14 + 0x44]
test cl, cl
je 0x1400a11ff
lea rcx, [r14 + 0x28]
call section..gxjmxw
test al, al
sete al
test al, al
jne 0x1400a1213
test bl, bl
je 0x1400a1213
lea rdx, [rbp - 0x68]
lea rcx, [r14 + 0x28]
call fcn.1400a74a0
mov byte [rbp - 0x69], al
xor esi, esi
mov dword [rbp - 0x41], esi
jmp 0x1400a121c
xor esi, esi
lea rcx, [r14 + 0x28]
call fcn.1400a6030
inc r15d
mov dword [rbp - 0x65], r15d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm7, xmm0
call fcn.14000c5a0
test rax, rax
je 0x1400a1777
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
lea rdi, [0x1400de840]
cmp rcx, rdi
jne 0x1400a1263
lock inc dword [rax + 0x20]
add rax, 0x10
jmp 0x1400a1268
mov rcx, rax
call rdx
add rax, 0x18
mov qword [rbp - 0x59], rax
mov eax, dword [r14 + 0x24]
cmp eax, 0xffffffff
je 0x1400a1381
movzx eax, byte [r14 + 0x48]
test al, al
je 0x1400a1381
mov r8d, dword [r14 + 0x24]
lea rdx, [rbp - 0x11]
lea rcx, [r14 + 0x28]
call fcn.1400a5280
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x59]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400a1326
cmp dword [rbx + 0x10], 0
jl 0x1400a1318
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400a1318
call fcn.14000bbe0
mov rdi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400a1307
mov r8, qword [rbx]
mov rcx, qword [r8]
mov r9, qword [rcx + 8]
lea rax, [0x1400de840]
cmp rcx, rax
jne 0x1400a12fe
mov rcx, qword [r8 + 8]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a1307
mov rdx, rbx
mov rcx, r8
call r9
lea rax, [rdi + 0x18]
mov qword [rbp - 0x59], rax
lea rdi, [0x1400de840]
jmp 0x1400a1326
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.14000bdc0
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a1362
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x1400a135f
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a1362
call r8
mov rdx, qword [rbp - 0x59]
test rdx, rdx
je 0x1400a1751
mov rcx, qword [rbp - 0x49]
call fcn.14005ef6c
test eax, eax
je 0x1400a1381
mov byte [r14 + 0x49], 1
mov eax, r12d
inc r12d
cmp eax, 0xc
jle 0x1400a16f3
mov dword [rbp - 0x5d], esi
xor r15b, r15b
xor r12b, r12b
mov eax, dword [r14 + 0x24]
cmp eax, 0xffffffff
je 0x1400a150c
movzx eax, byte [r14 + 0x48]
test al, al
jne 0x1400a148b
mov r8d, dword [r14 + 0x24]
lea rdx, [rbp - 0x21]
lea rcx, [r14 + 0x28]
call fcn.1400a5280
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x59]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400a1448
cmp dword [rbx + 0x10], 0
jl 0x1400a143a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400a143a
call fcn.14000bbe0
mov rdi, rax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400a1430
mov r8, qword [rbx]
mov rcx, qword [r8]
mov r9, qword [rcx + 8]
lea rax, [0x1400de840]
cmp rcx, rax
jne 0x1400a1427
mov rcx, qword [r8 + 8]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a1430
mov rdx, rbx
mov rcx, r8
call r9
lea rax, [rdi + 0x18]
mov qword [rbp - 0x59], rax
jmp 0x1400a1448
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.14000bdc0
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a148b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, [0x1400de840]
cmp rax, r9
jne 0x1400a1488
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a148b
call r8
cmp byte [rbp - 0x69], 0
je 0x1400a14fa
mov edx, dword [r14 + 0x24]
xor bl, bl
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x51], esi
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
xor ecx, ecx
lea r8d, [rcx + 0x19]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x1400a14fa
mov rcx, qword [rbp - 0x39]
cmp dword [rbp - 0x51], 0
jbe 0x1400a14e7
cmp dword [rcx], 1
jne 0x1400a14e7
mov eax, dword [rcx + 0x10]
cmp byte [rbp - 0x68], bl
je 0x1400a14da
cmp eax, 1
sete bl
jmp 0x1400a14e7
movzx ebx, bl
test eax, eax
mov eax, 1
cmove ebx, eax
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov qword [rbp - 0x39], rsi
test bl, bl
je 0x1400a14fa
mov r15b, 1
jmp 0x1400a14fd
xor r15b, r15b
mov edx, dword [r14 + 0x24]
call section..hpounb
test eax, eax
setne r12b
mov rdi, qword [rbp - 0x59]
test rdi, rdi
je 0x1400a1762
mov rdx, rdi
mov rbx, qword [rbp - 0x49]
mov rcx, rbx
call fcn.14005ef6c
test eax, eax
setne byte [rbp - 0x61]
lea rsi, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x1400a160e
cmp dword [rbx + 0x10], 0
jl 0x1400a15fe
mov rcx, qword [rsi]
cmp rcx, qword [rbx]
jne 0x1400a15fe
mov rax, qword [rcx]
lea rdx, [0x1400de840]
cmp rax, rdx
je 0x1400a156a
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x1400a157e
cmp rcx, qword [rsi]
jne 0x1400a157e
mov rdi, rsi
lock inc dword [rsi + 0x10]
jmp 0x1400a15b6
mov rax, qword [rcx]
mov r8d, 1
mov edx, dword [rsi + 8]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400a175c
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
lea r8, [rsi + 0x18]
lea rcx, [rax + 0x18]
mov r9, rdx
call fcn.14007dae0
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400a15f4
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rdx, [0x1400de840]
cmp rax, rdx
jne 0x1400a15ee
mov rcx, qword [rcx + 8]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a15f4
mov rdx, rbx
call r8
lea rax, [rdi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x1400a160e
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.14000bdc0
xorps xmm6, xmm6
mov eax, dword [rbp - 0x65]
test eax, eax
jle 0x1400a1627
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movaps xmm6, xmm7
divsd xmm6, xmm0
xorps xmm7, xmm7
xor esi, esi
xor bl, bl
lea rcx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test eax, eax
je 0x1400a1643
cmp byte [rbp - 1], sil
sete bl
cvttsd2si eax, xmm6
mov dword [r14], eax
movzx eax, byte [rbp - 0x61]
mov byte [r14 + 8], al
mov eax, dword [r14 + 0x24]
cmp eax, 0xffffffff
setne al
mov byte [r14 + 9], al
mov byte [r14 + 0xa], r15b
mov byte [r14 + 0xb], r12b
mov byte [r14 + 0xc], bl
mov dword [r14 + 4], esi
mov byte [r14 + 0xd], 1
inc dword [r14 + 0x10]
movzx eax, byte [r14 + 8]
test al, al
sete r8b
mov eax, dword [r14]
cmp eax, 0xa
setl dl
test r8b, r8b
je 0x1400a169a
test dl, dl
je 0x1400a169a
mov cl, 1
jmp 0x1400a169c
xor cl, cl
movzx eax, byte [r14 + 0xa]
test al, al
jne 0x1400a16d4
movzx eax, byte [r14 + 0xb]
test al, al
jne 0x1400a16d4
test cl, cl
je 0x1400a16b9
mov edx, 1
jmp 0x1400a16e7
test dl, dl
je 0x1400a16c4
mov edx, 8
jmp 0x1400a16e7
test r8b, r8b
je 0x1400a16d0
mov edx, 9
jmp 0x1400a16e7
xor edx, edx
jmp 0x1400a16e7
movzx eax, byte [r14 + 0xb]
test al, al
mov edx, 2
jne 0x1400a16e7
mov edx, 3
call fcn.14007f630
mov r12d, dword [rbp - 0x5d]
mov r15d, esi
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a1742
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, [0x1400de840]
cmp rax, r9
jne 0x1400a173f
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a1742
call r8
cmp byte [r14 + 0x20], 0
jne 0x1400a176d
mov esi, dword [rbp - 0x41]
jmp 0x1400a11c0
mov ecx, 0x80004005
call fcn.14000c2c0
int3
call fcn.14000bdb0
int3
mov ecx, 0x80004005
call fcn.14000c2c0
nop
mov rbx, qword [rbp - 0x49]
mov rdi, qword [rbp - 0x31]
jmp 0x1400a1784
mov ecx, 0x80004005
call fcn.14000c2c0
int3
xor esi, esi
mov rax, qword [r14 + 0x30]
test rax, rax
jne 0x1400a17b4
cmp qword [r14 + 0x28], rax
jne 0x1400a17b4
mov rax, qword [rax]
xor ecx, ecx
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [r14 + 0x30], rsi
mov rcx, qword [r14 + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [r14 + 0x28], rsi
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test rdi, rdi
je 0x1400a17c7
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400a1806
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, [0x1400de840]
cmp rax, r9
jne 0x1400a1803
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a1806
call r8
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400518f0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret