Function at 0x10003380
Capabilities:
Check os version
Get session information
Get session user name

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
push str._SessionMgr__find_Session_by_WTS
push 0xb9
movzx eax, al
push str..SessionMgr.c
push 2
mov ecx, str.CheckSessionByWTS
mov dword [esp + 0x34], eax
call fcn.1000be40
push str._SessionMgr__find_Session_by_WTS
push 0xb9
push str..SessionMgr.c
push 2
mov ecx, str.CheckSessionByWTS
call fcn.1000bb50
add esp, 0x20
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push 1
push ebx
push ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
test eax, eax
jne 0x10003446
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._SessionMgr__WTSEnumerateSessions_failed__Error_d
push 0xbe
push str..SessionMgr.c
push 1
mov ecx, str.CheckSessionByWTS
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str._SessionMgr__WTSEnumerateSessions_failed__Error_d
push 0xbe
push str..SessionMgr.c
push 1
mov ecx, str.CheckSessionByWTS
call fcn.1000bb50
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
jbe 0x100035a8
xor ebp, ebp
jmp 0x10003464
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
mov esi, dword [eax + ebp]
cmp esi, 0x1000
jae 0x1000358a
cmp dword [esp + 0x24], 6
jb 0x100034c6
cmp esi, ebx
jne 0x100034c6
push str._SessionMgr__Vista
push 0xce
push str..SessionMgr.c
push ebx
mov ecx, str.CheckSessionByWTS
call fcn.1000be40
push str._SessionMgr__Vista
push 0xce
push str..SessionMgr.c
push ebx
mov ecx, str.CheckSessionByWTS
call fcn.1000bb50
add esp, 0x20
jmp 0x1000358a
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x14]
push edx
push 5
push esi
push ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x100034e7
mov dword [esp + 0x14], 1
jmp 0x100034ef
cmp edi, ebx
je 0x1000357c
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x1000358a
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10003500
sub eax, edi
je 0x10003580
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x1000351b
mov dword [eax], 1
lea edi, [esi + esi*4]
cmp dword [edi*4 + 0x10057ee0], ebx
jne 0x10003580
push edx
push esi
push str._SessionMgr__WTS_find_Session:__d__is_Logon__UserName:__s_
push 0xdf
push str..SessionMgr.c
push 3
mov ecx, str.CheckSessionByWTS
call fcn.1000be40
mov eax, dword [esp + 0x28]
push eax
push esi
push str._SessionMgr__WTS_find_Session:__d__is_Logon__UserName:__s_
push 0xdf
push str..SessionMgr.c
push 3
mov ecx, str.CheckSessionByWTS
call fcn.1000bb50
add esp, 0x30
call fcn.10003de0
test eax, eax
je 0x1000357c
mov dword [edi*4 + 0x10057ee0], 1
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x1000358a
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 0x20]
add eax, 1
add ebp, 0xc
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
jb 0x10003460
cmp dword [esp + 0x14], ebx
jne 0x100035f7
push str._SessionMgr__WTS_is_not_working
push 0xea
push str..SessionMgr.c
push 1
mov ecx, str.CheckSessionByWTS
call fcn.1000be40
push str._SessionMgr__WTS_is_not_working
push 0xea
push str..SessionMgr.c
push 1
mov ecx, str.CheckSessionByWTS
call fcn.1000bb50
mov eax, dword [esp + 0x3c]
add esp, 0x20
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
xor esi, esi
xor edi, edi
jmp 0x10003600
cmp dword [edi + 0x10057ee0], 1
jne 0x100036a8
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x14]
push edx
push 5
push esi
push ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x3c], ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x1000364d
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x1000364d
mov eax, edx
lea ebp, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10003640
sub eax, ebp
jne 0x1000369e
push esi
push str._SessionMgr__WTS_find_Session:__d__is_Logoff
push pe_nt_image_headers32
push str..SessionMgr.c
push 3
mov ecx, str.CheckSessionByWTS
call fcn.1000be40
add esp, 0x14
push esi
push str._SessionMgr__WTS_find_Session:__d__is_Logoff
push pe_nt_image_headers32
push str..SessionMgr.c
push 3
mov ecx, str.CheckSessionByWTS
call fcn.1000bb50
add esp, 0x14
push esi
call fcn.10004020
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [edi + 0x10057ee0], ebx
cmp edx, ebx
je 0x100036a8
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
add edi, 0x14
add esi, 1
cmp edi, 0x14000
jb 0x10003600
mov eax, dword [esp + 0x1c]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret