Function at 0x41121b
Capabilities:
Get session information
Get session user name
Get token membership

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x204c
call fcn.0040a0e0
mov dword [ebp - 0x204c], ecx
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
mov byte [ebp - 0x2048], 0
mov byte [ebp - 0x2047], 0
mov byte [ebp - 0x2046], 0
mov byte [ebp - 0x2045], 0
mov byte [ebp - 0x2044], 0
mov byte [ebp - 0x2043], 5
and dword [ebp - 0x1c], 0
and dword [ebp - 0x202c], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x2020]
mov dword [ebp - 8], eax
and dword [ebp - 0x2038], 0
mov dword [ebp - 0x2034], 0x104
mov dword [ebp - 0x2028], 0x100
and dword [ebp - 0x2030], 0
mov eax, dword [ebp - 0x2030]
mov dword [ebp - 0x2024], eax
mov eax, dword [ebp - 0x2024]
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp - 0x203c]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp - 0x2040]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x204c]
cmp dword [eax + 0x58bc], 0xffffffff
jne 0x4115b5
push 0x200
push 0x431ca0
call fcn.0040103d
pop ecx
pop ecx
mov eax, dword [ebp - 0x204c]
and dword [eax + 0x58bc], 0
mov dword [ebp - 0x10], 0x100
lea eax, [ebp - 0x10]
push eax
push 0x431ca0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x41134a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 5
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x41134a
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x431ca0
call fcn.00402b50
add esp, 0xc
push dword [ebp - 0x14]
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x223
push 0x20
push 2
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x2040]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x222
push 0x20
push 2
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x203c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x2024]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x13
push 1
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [ebp - 0x2030]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x14
push 1
lea eax, [ebp - 0x2048]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0x14
cmp dword [ebp - 0xc], 0
je 0x411479
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x411470
cmp dword [ebp - 4], 0
je 0x411470
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0x28
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x20], 0
je 0x4114b1
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x4114a8
cmp dword [ebp - 4], 0
je 0x4114a8
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0x1e
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x2040], 0
je 0x4114f2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x2040]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x4114e6
cmp dword [ebp - 4], 0
je 0x4114e6
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0xa
push dword [ebp - 0x2040]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x203c], 0
je 0x411533
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x203c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x411527
cmp dword [ebp - 4], 0
je 0x411527
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0x32
push dword [ebp - 0x203c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x2024], 0
je 0x411574
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x2024]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x411568
cmp dword [ebp - 4], 0
je 0x411568
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0x34
push dword [ebp - 0x2024]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x2030], 0
je 0x4115b5
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x2030]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x4115a9
cmp dword [ebp - 4], 0
je 0x4115a9
mov eax, dword [ebp - 0x204c]
mov dword [eax + 0x58bc], 0x36
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x204c]
mov eax, dword [eax + 0x58bc]
leave
ret