Function at 0x986890
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x198
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
push esi
xor ebp, ebp
cmp dword [0xb4c910], 0xffffffff
push edi
mov edi, ecx
mov esi, edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebp
jne 0x9868f1
push 0xb4c910
push str.ACDebug
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov dword [0xb4c910], ebp
call fcn.0094c0d0
cmp edi, ebp
je 0x9868f7
mov dword [edi], ebp
cmp esi, ebp
je 0x9868fd
mov dword [esi], ebp
cmp dword [0xc01394], ebp
jne 0x986926
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0xc01394], eax
cmp eax, ebp
je 0x987339
cmp eax, 0xffffffff
je 0x987339
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0xc013b0], ebp
jne 0x9869c8
mov ecx, str.Wtsapi32.dll
call fcn.0094c620
mov dword [0xc013b0], eax
cmp eax, ebp
je 0x987339
cmp eax, 0xffffffff
je 0x987339
mov eax, dword [0xc01394]
push str.WTSGetActiveConsoleSessionId
push eax
call esi
mov ecx, dword [0xc013b0]
push str.WTSQueryUserToken
push ecx
mov dword [0xc01398], eax
call esi
mov edx, dword [0xc013b0]
push str.WTSQuerySessionInformationA
push edx
mov dword [0xc0139c], eax
call esi
mov dword [0xc013a0], eax
mov eax, dword [0xc013b0]
push str.WTSFreeMemory
push eax
call esi
mov ecx, dword [0xc013b0]
push str.WTSEnumerateSessionsA
push ecx
mov dword [0xc013a4], eax
call esi
mov edx, dword [0xc01394]
push str.ProcessIdToSessionId
push edx
mov dword [0xc013ac], eax
call esi
mov dword [0xc013a8], eax
cmp edi, ebp
je 0x987339
cmp dword [0xc01398], ebp
je 0x987339
cmp dword [0xc0139c], ebp
je 0x987339
cmp dword [0xc013a0], ebp
je 0x987339
cmp dword [0xc013a4], ebp
je 0x987339
xor esi, esi
mov dword [esp + 0x54], 1
cmp ebx, ebp
je 0x986a13
cmp byte [ebx], 0
jne 0x986a1d
cmp dword [esp + 0x1b4], 0xffffffff
je 0x986a22
mov esi, 1
cmp dword [0xb4c910], ebp
je 0x986a41
mov eax, dword [esp + 0x1b4]
push eax
push ebx
push str._GAC__ActiveSessionOfUser:___s___ForSessionID:___d_
push ebp
call fcn.0096a780
add esp, 0x10
mov eax, dword [0xc013ac]
cmp eax, ebp
je 0x986daa
cmp esi, ebp
je 0x986daa
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x30]
push edx
push 1
push ebp
push ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x38], 0xffffffff
call eax
test eax, eax
je 0x986ab0
cmp dword [0xb4c910], ebp
je 0x986a99
mov eax, dword [esp + 0x34]
push eax
push str._GAC__SessionsCount:___d_
push ebp
call fcn.0096a780
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, ebp
jne 0x986aba
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x986ab0
push eax
call dword [0xc013a4]
mov eax, 1
jmp 0x98733b
mov dword [esp + 0x48], ebp
cmp eax, ebp
jbe 0x986d7e
mov dword [esp + 0x40], ebp
lea ebx, [ebx]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
lea esi, [ecx + edx]
cmp esi, ebp
je 0x986d0a
push 0x3f
lea eax, [esp + 0x5d]
push ebp
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ebp
mov byte [esp + 0x64], 0
call fcn.00a7ffb0
mov eax, dword [esi + 8]
add esp, 0xc
cmp eax, 9
ja case.default.0x986b0c
jmp dword [eax*4 + 0x987354]
push ebp
push str.WTSActive__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x986b9a
push 1
push str.WTSConnected__d_
jmp 0x986b95
push 2
push str.WTSConnectQuery__d_
lea eax, [esp + 0x60]
push eax
jmp 0x986b9a
push 3
push str.WTSShadow__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x986b9a
push 4
push str.WTSDisconnected__d_
jmp 0x986b95
push 5
push str.WTSIdle__d_
lea eax, [esp + 0x60]
push eax
jmp 0x986b9a
push 6
push str.WTSListen__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x986b9a
push 7
push str.WTSReset__d_
jmp 0x986b95
push 8
push str.WTSDown__d_
lea eax, [esp + 0x60]
push eax
jmp 0x986b9a
push 9
push str.WTSInit__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x986b9a
push eax
push str.WTS_Unknown__d_
lea edx, [esp + 0x60]
push edx
call fcn.00a78f30
mov eax, dword [esp + 0x1c0]
add esp, 0xc
cmp eax, 0xffffffff
je 0x986bb6
cmp dword [esi], eax
je 0x986d24
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x986d0a
cmp byte [eax], 0
je 0x986d0a
mov edx, dword [esi]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 5
push edx
push ebp
call dword [0xc013a0]
cmp dword [0xb4c910], ebp
je 0x986c01
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x58]
push eax
push ecx
push str._GAC__B___pDataUser:_s__state:_s
push ebp
call fcn.0096a780
add esp, 0x10
cmp dword [esp + 0x20], ebp
je 0x986d0a
push 0x103
lea edx, [esp + 0x9d]
push ebp
push edx
mov dword [esp + 0x48], ebp
mov byte [esp + 0xa4], 0
call fcn.00a7ffb0
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
push ecx
mov bl, 0x2c
lea edi, [esp + 0xa0]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x3c], 0xffffffff
je 0x986ceb
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp byte [eax], 0
je 0x986ca2
lea edx, [esp + 0x98]
push edx
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x986ca2
mov eax, dword [esi + 8]
test eax, eax
je 0x986cc2
cmp eax, 4
jne 0x986ca2
cmp dword [0xb4c910], 0
je 0x986c9c
mov eax, dword [esi]
push eax
push str._GAC__B__SessionIdOfDisconnectedAdministrator:__d
push 0
call fcn.0096a780
add esp, 0xc
mov ecx, dword [esi]
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x3c]
push edx
push ebp
mov bl, 0x2c
lea edi, [esp + 0xa0]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x3c], 0xffffffff
jne 0x986c57
jmp 0x986ceb
cmp dword [0xb4c910], 0
je 0x986cdd
mov eax, dword [esi]
push eax
push str._GAC__B__Setting_dwSessionID_to__d
push 0
call fcn.0096a780
add esp, 0xc
mov ecx, dword [esi]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x38], 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x986d02
push eax
call dword [0xc013a4]
mov dword [esp + 0x20], 0
xor ebp, ebp
cmp dword [esp + 0x38], ebp
jne 0x986d7e
mov eax, dword [esp + 0x48]
add dword [esp + 0x40], 0xc
inc eax
mov dword [esp + 0x48], eax
cmp eax, dword [esp + 0x34]
jb 0x986ad0
jmp 0x986d7e
mov ecx, dword [esi]
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x24]
push eax
push 5
push ecx
push ebp
call dword [0xc013a0]
cmp dword [0xb4c910], ebp
je 0x986d5d
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
lea edx, [esp + 0x58]
push edx
push eax
push ecx
push str._GAC__A__Setting_dwSessionID_to__d__pDataUser:_s__state:_s
push ebp
call fcn.0096a780
add esp, 0x14
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x986d70
push eax
call dword [0xc013a4]
mov dword [esp + 0x20], ebp
mov edx, dword [esi]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x38], 1
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x986d91
push eax
call dword [0xc013a4]
mov dword [esp + 0x2c], ebp
cmp dword [esp + 0x38], ebp
jne 0x986dd6
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x986ab0
mov dword [esp + 0x1c], eax
jmp 0x986dd6
call dword [0xc01398]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp dword [0xb4c910], ebp
je 0x986dcd
push esi
push str._GAC__dwSessionID___d
push ebp
call fcn.0096a780
add esp, 0xc
cmp esi, 0xffffffff
je 0x986ab0
mov edi, dword [esp + 0x1c]
cmp dword [0xb4c910], ebp
je 0x986df1
push edi
push str._GAC__Post_dwSessionID___d
push ebp
call fcn.0096a780
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 8
push edi
push ebp
xor bl, bl
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call dword [0xc013a0]
mov esi, eax
cmp dword [0xb4c910], ebp
je 0x986e3e
cmp esi, ebp
je 0x986e2b
cmp dword [esp + 0x18], 4
jne 0x986e2b
mov eax, 1
jmp 0x986e2d
xor eax, eax
push eax
push esi
push edi
push str._GAC__A__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.0096a780
add esp, 0x14
cmp esi, ebp
je 0x986fdc
cmp dword [esp + 0x18], 4
jne 0x986fdc
cmp dword [0xb4c910], ebp
je 0x986e6f
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
push edi
push str._GAC__A__dwSessionID:_d__wtsconnstate:_d
push ebp
call fcn.0096a780
add esp, 0x10
cmp dword [0xc013ac], ebp
je 0x986ed4
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x986ea7
cmp byte [eax], 0
je 0x986ea7
mov bl, 1
cmp dword [0xb4c910], ebp
je 0x9870dd
push 1
push str._GAC__bActiveSession_A____d
push ebp
call fcn.0096a780
add esp, 0xc
jmp 0x986ff6
cmp dword [esp + 0x1b4], 0xffffffff
je 0x986ed4
mov bl, 1
cmp dword [0xb4c910], ebp
je 0x9870dd
push 1
push str._GAC__bActiveSession_A1____d
push ebp
call fcn.0096a780
add esp, 0xc
jmp 0x986ff6
mov ecx, dword [esp + 0x14]
cmp dword [ecx], ebp
sete bl
cmp dword [0xb4c910], ebp
je 0x986ef7
movzx edx, bl
push edx
push str._GAC__bActiveSession_B____d
push ebp
call fcn.0096a780
add esp, 0xc
test bl, bl
jne 0x986ff6
cmp dword [esp + 0x14], ebp
je 0x986f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [0xc013a4]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x18], ebp
call fcn.00968d70
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], ebp
push 8
test eax, eax
je 0x986f7f
mov edi, 1
push edi
push ebp
mov dword [esp + 0x30], edi
call dword [0xc013a0]
mov esi, eax
cmp dword [0xb4c910], ebp
je 0x986fba
cmp esi, ebp
je 0x986f72
cmp dword [esp + 0x18], 4
jne 0x986f72
mov eax, edi
push eax
push esi
push edi
push str._GAC__B__dwSessionID___d__WTSRet___d__Result___d
jmp 0x986fb1
xor eax, eax
push eax
push esi
push 1
push str._GAC__B__dwSessionID___d__WTSRet___d__Result___d
jmp 0x986fb1
push ebp
xor edi, edi
push ebp
mov dword [esp + 0x30], edi
call dword [0xc013a0]
mov esi, eax
cmp dword [0xb4c910], ebp
je 0x986fba
cmp esi, ebp
je 0x986fa7
cmp dword [esp + 0x18], 4
jne 0x986fa7
lea eax, [edi + 1]
jmp 0x986fa9
xor eax, eax
push eax
push esi
push ebp
push str._GAC__C__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.0096a780
add esp, 0x14
cmp esi, ebp
je 0x986ff6
cmp dword [esp + 0x18], 4
jne 0x986ff6
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp eax, ebp
sete bl
test bl, bl
jne 0x986ff6
cmp eax, 4
sete bl
jmp 0x986ff6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x6a6
je 0x986ff4
call esi
cmp eax, 0x47f
jne 0x986ff6
mov bl, 1
cmp dword [0xb4c910], ebp
je 0x987011
movzx ecx, bl
push edi
push ecx
push str._GAC__bActiveSession___d__dwSessionID___d_
push ebp
call fcn.0096a780
add esp, 0x10
test bl, bl
jne 0x9870dd
mov dword [esp + 0x24], 0xffffffff
cmp dword [esp + 0x14], ebp
je 0x987045
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [0xc013a4]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.00964d30
mov esi, dword [esp + 0x24]
cmp dword [0xb4c910], ebp
je 0x98706d
push esi
push str._GAC__SessionIDOfFirstLoggedOnUser___d
push ebp
call fcn.0096a780
add esp, 0xc
cmp esi, 0xffffffff
je 0x9870dd
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 8
push esi
push ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebp
call dword [0xc013a0]
mov edi, eax
cmp dword [0xb4c910], ebp
je 0x9870bd
cmp edi, ebp
je 0x9870aa
cmp dword [esp + 0x18], 4
jne 0x9870aa
mov eax, 1
jmp 0x9870ac
xor eax, eax
push eax
push edi
push esi
push str._GAC__D__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.0096a780
add esp, 0x14
cmp edi, ebp
je 0x9870dd
cmp dword [esp + 0x18], 4
jne 0x9870dd
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
cmp eax, ebp
sete bl
test bl, bl
jne 0x9870dd
cmp eax, 4
sete bl
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], ebp
je 0x987103
call edi
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [0xc013a4]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
jne 0x98712a
cmp dword [0xb4c910], ebp
je 0x987120
call edi
push eax
push str._GAC__returning_rval4__le_u_
push ebp
call fcn.0096a780
add esp, 0xc
mov eax, 4
jmp 0x98733b
push 0x2000000
push ebp
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
cmp esi, ebp
je 0x987319
mov edi, dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
call edi
push 0x2000000
push ebp
push ebp
call dword [sym.imp.USER32.dll_OpenInputDesktop]
cmp eax, ebp
jne 0x9871a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebp, eax
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0xb4c910], 0
je 0x98719f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GAC__returning_rval6__le_u_
push 0
call fcn.0096a780
add esp, 0xc
mov eax, 6
jmp 0x98733b
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [0xc0139c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0xb4c910], ebp
je 0x9871f8
call ebx
mov edi, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
push str._GAC__A__e_WTSQueryUserToken_for_sessid:_d__eVal___d__hTok__0x_x__LE:_u_
push ebp
call fcn.0096a780
add esp, 0x18
jmp 0x9871fc
mov edi, dword [esp + 0x1c]
cmp esi, ebp
jne 0x98726b
mov ecx, str.SeTcbPrivilege
call fcn.0095fcc0
push str.RtlAdjustPrivilege
push 0xab713c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x24], 1
cmp eax, ebp
je 0x987239
lea ecx, [esp + 0x24]
push ecx
push ebp
push 1
push 7
call eax
lea edx, [esp + 0x28]
push edx
push edi
call dword [0xc0139c]
mov esi, eax
cmp dword [0xb4c910], ebp
je 0x987267
call ebx
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
push edi
push str._GAC__B__e_WTSQueryUserToken_for_sessid:_d__eVal___d__hTok__0x_x__LE:_u_
push ebp
call fcn.0096a780
add esp, 0x18
cmp esi, ebp
je 0x9872ce
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x987311
cmp dword [esp + 0x1ac], ebp
je 0x987294
mov ecx, dword [esp + 0x44]
push ecx
push 1
push 2
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x9872a2
mov edx, dword [esp + 0x44]
push edx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
cmp dword [0xb4c910], ebp
je 0x9872bb
call ebx
push eax
push str._GAC__returning_rval2__success___le_u_
push ebp
call fcn.0096a780
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov esi, 2
call fcn.00985290
mov eax, esi
jmp 0x98733b
call ebx
mov ecx, dword [esp + 0x50]
cmp ecx, ebp
je 0x9872ec
cmp eax, 0x4dd
je 0x9872e6
cmp eax, 0x6d3
jne 0x9872ec
mov dword [ecx], 1
cmp dword [0xb4c910], ebp
je 0x987308
mov ecx, dword [ecx]
push ecx
call ebx
push eax
push str._GAC__returning_rval7__le_u__SessionActiveButGetTokenFailed:_d
push ebp
call fcn.0096a780
add esp, 0x10
mov esi, 7
mov eax, esi
jmp 0x98733b
mov esi, dword [esp + 0x54]
mov eax, esi
jmp 0x98733b
cmp dword [0xb4c910], ebp
je 0x987332
call edi
push eax
push str._GAC__returning_rval5__le_u_
push ebp
call fcn.0096a780
add esp, 0xc
mov eax, 5
jmp 0x98733b
xor eax, eax
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x198
ret