Function at 0x48332c
Capabilities:
Get session information
Get session user name
Prompt user for credentials

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.004c52c0
add esp, 0xc
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov esi, eax
cmp esi, 0x9ead
je 0x4832b0
cmp esi, 0x9eae
je 0x4832b0
cmp esi, 0x9eaf
je 0x4832b0
cmp esi, 0x9eb1
je 0x4832b0
cmp esi, 0x9f27
je 0x4832b0
cmp esi, 0x9f28
je 0x4832b0
push 0
push esi
push edi
push 0x53861c
call fcn.0045b300
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], 0x1c
push eax
push ebx
mov dword [ebp - 0x43c], 8
call dword [sym.imp.USER32.dll_GetMenuInfo]
add esi, 0xffff6153
cmp esi, 0x7b
ja case.0x4832e8.40624
movzx eax, byte [esi + 0x483598]
jmp dword [eax*4 + 0x48357c]
push 0
push dword [ebp - 0x428]
push 0
call sub.WTSAPI32.dll_WTSDisconnectSession
test eax, eax
jne case.0x4832e8.40624
push dword [0x555ec8]
push 0x51130c
call fcn.004aad00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push 5
push dword [ebp - 0x428]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x48340a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x450], edi
mov edi, dword [sym.imp.credui.dll_CredUIPromptForCredentialsW]
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x454], 0x14
mov dword [ebp - 0x44c], 0x511348
mov dword [ebp - 0x448], 0x511390
mov dword [ebp - 0x444], 0
nop word [eax + eax]
push 0x140082
lea eax, [ebp - 0x41c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x454]
push dword [ebp - 0x420]
push 0x52e
push 0
push 0x4fbd20
push eax
call edi
test eax, eax
jne 0x483401
mov eax, dword [0x55b1b4]
lea ecx, [ebp - 0x20c]
push 1
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x428]
push 0
call eax
test al, al
jne case.0x4832e8.40624
call esi
cmp eax, 0x52e
je 0x4833a0
jmp 0x483410
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je case.0x4832e8.40624
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x555ec8]
push 0x5113d4
call fcn.004aad00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, dword [ebp - 0x424]
jne 0x48348d
push dword [0x555ec8]
push 0x511410
call fcn.004aad00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, dword [0x55b1b8]
lea ecx, [ebp - 0x414]
push 2
push 0x70
push dword [ebp - 0x428]
push ecx
push 0
call eax
test al, al
jne case.0x4832e8.40624
push dword [0x555ec8]
push 0x511480
call fcn.004aad00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x428]
push 0
call sub.WTSAPI32.dll_WTSLogoffSession
test eax, eax
jne case.0x4832e8.40624
push dword [0x555ec8]
push 0x5114bc
call fcn.004aad00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x428]
push 0x48a170
push dword [0x555ec8]
push 0x5114f0
jmp 0x48355a
push dword [ebp - 0x428]
push 0x48a9e0
push dword [0x555ec8]
push 0x511508
push dword [0x5509e8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret