Function at 0xc7048
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0xc7051
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0xc7396
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 8
lea eax, [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov edx, 0xc73b4
call fcn.00013ff4
xor eax, eax
mov dword [esi], eax
xor eax, eax
push ebp
push 0xc7349
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 8
push ebx
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
neg eax
sbb eax, eax
neg eax
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
test bl, bl
je 0xc727f
cmp dword [ebp - 0xc], 0
je 0xc71fa
cmp dword [ebp - 0x1c], 4
jne 0xc71fa
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
neg eax
sbb ebx, ebx
neg ebx
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
test bl, bl
je 0xc718f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0xc7124
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
jmp 0xc72f9
cmp dword [esi], 0
jne 0xc712f
mov dword [esi], 0x1e
push 0xc73c4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00027444
push dword [ebp - 0x24]
push 0xc73d8
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.00027444
push dword [ebp - 0x28]
push 0xc73d8
lea edx, [ebp - 0x2c]
mov eax, dword [esi]
call fcn.00027478
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.000c6c88
jmp 0xc72f9
cmp dword [esi], 0
jne 0xc719a
mov dword [esi], 0xc
push 0xc73e4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00027444
push dword [ebp - 0x34]
push 0xc73d8
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.00027444
push dword [ebp - 0x38]
push 0xc73d8
lea edx, [ebp - 0x3c]
mov eax, dword [esi]
call fcn.00027478
push dword [ebp - 0x3c]
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.000c6c88
jmp 0xc72f9
cmp dword [esi], 0
jne 0xc7205
mov dword [esi], 0x1f
push 0xc73f8
cmp dword [ebp - 0xc], 0
setne al
lea edx, [ebp - 0x144]
call fcn.000294b8
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x44]
call fcn.00013f4c
push dword [ebp - 0x44]
push 0xc73d8
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x148]
call fcn.00027444
push dword [ebp - 0x148]
push 0xc73d8
lea edx, [ebp - 0x14c]
mov eax, dword [esi]
call fcn.00027478
push dword [ebp - 0x14c]
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.000c6c88
jmp 0xc72f9
cmp dword [esi], 0
jne 0xc728a
mov dword [esi], 0x1f
cmp dword [esi], 2
jne 0xc72c5
lea edx, [ebp - 0x154]
mov eax, dword [esi]
call fcn.00027478
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 0xc740c
call fcn.00013ff4
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.000c6be0
jmp 0xc72f9
lea edx, [ebp - 0x15c]
mov eax, dword [esi]
call fcn.00027478
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 0xc740c
call fcn.00013ff4
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.000c6c88
xor eax, eax
push ebp
push 0xc7325
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0xc7316
mov eax, dword [ebp - 0xc]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xc733f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xc7363
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc739d
lea eax, [ebp - 0x15c]
mov edx, 6
call fcn.00013d3c
lea eax, [ebp - 0x44]
mov edx, 0xa
call fcn.00013d3c
lea eax, [ebp - 0x18]
call fcn.00013d18
ret