Function at 0x10068080
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x198
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
push ebp
push esi
xor ebp, ebp
cmp dword [0x1018cd3c], 0xffffffff
push edi
mov edi, dword [esp + 0x1b0]
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
jne 0x100680e1
push 0x1018cd3c
push str.ACDebug
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x1018cd3c], ebp
call fcn.10031670
cmp ebx, ebp
je 0x100680e7
mov dword [ebx], ebp
cmp esi, ebp
je 0x100680ed
mov dword [esi], ebp
cmp dword [0x101a2734], ebp
jne 0x10068116
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x101a2734], eax
cmp eax, ebp
je 0x10068b2b
cmp eax, 0xffffffff
je 0x10068b2b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x101a2750], ebp
jne 0x100681b8
mov ecx, str.Wtsapi32.dll
call fcn.10032000
mov dword [0x101a2750], eax
cmp eax, ebp
je 0x10068b2b
cmp eax, 0xffffffff
je 0x10068b2b
mov eax, dword [0x101a2734]
push str.WTSGetActiveConsoleSessionId
push eax
call esi
mov ecx, dword [0x101a2750]
push str.WTSQueryUserToken
push ecx
mov dword [0x101a2738], eax
call esi
mov edx, dword [0x101a2750]
push str.WTSQuerySessionInformationA
push edx
mov dword [0x101a273c], eax
call esi
mov dword [0x101a2740], eax
mov eax, dword [0x101a2750]
push str.WTSFreeMemory
push eax
call esi
mov ecx, dword [0x101a2750]
push str.WTSEnumerateSessionsA
push ecx
mov dword [0x101a2744], eax
call esi
mov edx, dword [0x101a2734]
push str.ProcessIdToSessionId
push edx
mov dword [0x101a274c], eax
call esi
mov dword [0x101a2748], eax
cmp ebx, ebp
je 0x10068b2b
cmp dword [0x101a2738], ebp
je 0x10068b2b
cmp dword [0x101a273c], ebp
je 0x10068b2b
cmp dword [0x101a2740], ebp
je 0x10068b2b
cmp dword [0x101a2744], ebp
je 0x10068b2b
xor esi, esi
mov dword [esp + 0x54], 1
cmp edi, ebp
je 0x10068203
cmp byte [edi], 0
jne 0x1006820d
cmp dword [esp + 0x1b4], 0xffffffff
je 0x10068212
mov esi, 1
cmp dword [0x1018cd3c], ebp
je 0x10068231
mov eax, dword [esp + 0x1b4]
push eax
push edi
push str._GAC__ActiveSessionOfUser:___s___ForSessionID:___d_
push ebp
call fcn.10053700
add esp, 0x10
mov eax, dword [0x101a274c]
cmp eax, ebp
je 0x1006858b
cmp esi, ebp
je 0x1006858b
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x30]
push edx
push 1
push ebp
or ebx, 0xffffffff
push ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x3c], ebx
call eax
test eax, eax
je 0x1006829f
cmp dword [0x1018cd3c], ebp
je 0x10068288
mov eax, dword [esp + 0x30]
push eax
push str._GAC__SessionsCount:___d_
push ebp
call fcn.10053700
add esp, 0xc
mov eax, dword [esp + 0x30]
cmp eax, ebp
jne 0x100682a9
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x1006829f
push eax
call dword [0x101a2744]
mov eax, 1
jmp 0x10068b2d
mov dword [esp + 0x48], ebp
cmp eax, ebp
jbe 0x1006855f
mov dword [esp + 0x3c], ebp
lea esp, [esp]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
lea esi, [ecx + edx]
cmp esi, ebp
je 0x100684eb
push 0x3f
lea eax, [esp + 0x5d]
push ebp
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ebp
mov byte [esp + 0x64], 0
call fcn.10116880
mov eax, dword [esi + 8]
add esp, 0xc
cmp eax, 9
ja case.default.0x100682fc
jmp dword [eax*4 + 0x10068b48]
push ebp
push str.WTSActive__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x1006838a
push 1
push str.WTSConnected__d_
jmp 0x10068385
push 2
push str.WTSConnectQuery__d_
lea eax, [esp + 0x60]
push eax
jmp 0x1006838a
push 3
push str.WTSShadow__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x1006838a
push 4
push str.WTSDisconnected__d_
jmp 0x10068385
push 5
push str.WTSIdle__d_
lea eax, [esp + 0x60]
push eax
jmp 0x1006838a
push 6
push str.WTSListen__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x1006838a
push 7
push str.WTSReset__d_
jmp 0x10068385
push 8
push str.WTSDown__d_
lea eax, [esp + 0x60]
push eax
jmp 0x1006838a
push 9
push str.WTSInit__d_
lea ecx, [esp + 0x60]
push ecx
jmp 0x1006838a
push eax
push str.WTS_Unknown__d_
lea edx, [esp + 0x60]
push edx
call fcn.1010d6a8
mov eax, dword [esp + 0x1c0]
add esp, 0xc
cmp eax, ebx
je 0x100683a5
cmp dword [esi], eax
je 0x10068505
cmp edi, ebp
je 0x100684eb
cmp byte [edi], 0
je 0x100684eb
mov edx, dword [esi]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 5
push edx
push ebp
call dword [0x101a2740]
cmp dword [0x1018cd3c], ebp
je 0x100683ec
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x58]
push eax
push ecx
push str._GAC__B___pDataUser:_s__state:_s
push ebp
call fcn.10053700
add esp, 0x10
cmp dword [esp + 0x20], ebp
je 0x100684eb
push 0x103
lea edx, [esp + 0x9d]
push ebp
push edx
mov dword [esp + 0x44], ebp
mov byte [esp + 0xa4], 0
call fcn.10116880
push 1
lea eax, [esp + 0x48]
push 0x2c
push eax
lea edx, [esp + 0xb0]
mov ecx, edi
call fcn.10045850
add esp, 0x18
cmp dword [esp + 0x38], ebx
je 0x100684d2
lea esp, [esp]
mov eax, dword [esp + 0x20]
cmp byte [eax], 0
je 0x10068489
lea ecx, [esp + 0x98]
push ecx
push eax
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x10068489
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x100684ab
cmp eax, 4
jne 0x10068489
cmp dword [0x1018cd3c], ebp
je 0x10068483
mov edx, dword [esi]
push edx
push str._GAC__B__SessionIdOfDisconnectedAdministrator:__d
push ebp
call fcn.10053700
add esp, 0xc
mov eax, dword [esi]
mov dword [esp + 0x28], eax
push 1
lea ecx, [esp + 0x3c]
push 0x2c
push ecx
lea edx, [esp + 0xa4]
mov ecx, edi
call fcn.10045850
add esp, 0xc
cmp dword [esp + 0x38], ebx
jne 0x10068440
jmp 0x100684d2
cmp dword [0x1018cd3c], ebp
je 0x100684c4
mov edx, dword [esi]
push edx
push str._GAC__B__Setting_dwSessionID_to__d
push ebp
call fcn.10053700
add esp, 0xc
mov eax, dword [esi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x100684e5
push eax
call dword [0x101a2744]
mov dword [esp + 0x20], ebp
cmp dword [esp + 0x34], ebp
jne 0x1006855f
mov eax, dword [esp + 0x48]
add dword [esp + 0x3c], 0xc
inc eax
mov dword [esp + 0x48], eax
cmp eax, dword [esp + 0x30]
jb 0x100682c0
jmp 0x1006855f
mov eax, dword [esi]
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x24]
push edx
push 5
push eax
push ebp
call dword [0x101a2740]
cmp dword [0x1018cd3c], ebp
je 0x1006853e
mov edx, dword [esp + 0x20]
mov eax, dword [esi]
lea ecx, [esp + 0x58]
push ecx
push edx
push eax
push str._GAC__A__Setting_dwSessionID_to__d__pDataUser:_s__state:_s
push ebp
call fcn.10053700
add esp, 0x14
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x10068551
push eax
call dword [0x101a2744]
mov dword [esp + 0x20], ebp
mov ecx, dword [esi]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x10068572
push eax
call dword [0x101a2744]
mov dword [esp + 0x2c], ebp
cmp dword [esp + 0x34], ebp
jne 0x100685b7
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x1006829f
mov dword [esp + 0x1c], eax
jmp 0x100685b7
call dword [0x101a2738]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp dword [0x1018cd3c], ebp
je 0x100685ae
push esi
push str._GAC__dwSessionID___d
push ebp
call fcn.10053700
add esp, 0xc
cmp esi, 0xffffffff
je 0x1006829f
mov edi, dword [esp + 0x1c]
cmp dword [0x1018cd3c], ebp
je 0x100685d2
push edi
push str._GAC__Post_dwSessionID___d
push ebp
call fcn.10053700
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 8
push edi
push ebp
xor bl, bl
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call dword [0x101a2740]
mov esi, eax
cmp dword [0x1018cd3c], ebp
je 0x1006861f
cmp esi, ebp
je 0x1006860c
cmp dword [esp + 0x18], 4
jne 0x1006860c
mov eax, 1
jmp 0x1006860e
xor eax, eax
push eax
push esi
push edi
push str._GAC__A__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.10053700
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebp
je 0x100687c6
cmp dword [esp + 0x18], 4
jne 0x100687c6
cmp dword [0x1018cd3c], ebp
je 0x1006865a
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [esp + 0x1c]
push edx
push eax
push str._GAC__A__dwSessionID:_d__wtsconnstate:_d
push ebp
call fcn.10053700
add esp, 0x10
cmp dword [0x101a274c], ebp
je 0x100686bf
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x10068692
cmp byte [eax], 0
je 0x10068692
mov bl, 1
cmp dword [0x1018cd3c], ebp
je 0x100688c1
push 1
push str._GAC__bActiveSession_A____d
push ebp
call fcn.10053700
add esp, 0xc
jmp 0x100687da
cmp dword [esp + 0x1b4], 0xffffffff
je 0x100686bf
mov bl, 1
cmp dword [0x1018cd3c], ebp
je 0x100688c1
push 1
push str._GAC__bActiveSession_A1____d
push ebp
call fcn.10053700
add esp, 0xc
jmp 0x100687da
mov ecx, dword [esp + 0x14]
cmp dword [ecx], ebp
sete bl
cmp dword [0x1018cd3c], ebp
je 0x100686e2
movzx edx, bl
push edx
push str._GAC__bActiveSession_B____d
push ebp
call fcn.10053700
add esp, 0xc
test bl, bl
jne 0x100687da
cmp dword [esp + 0x14], ebp
je 0x1006870a
call edi
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [0x101a2744]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x18], ebp
call fcn.1004fe90
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], ebp
push 8
test eax, eax
je 0x10068769
push 1
push ebp
mov dword [esp + 0x30], 1
call dword [0x101a2740]
mov esi, eax
cmp dword [0x1018cd3c], ebp
je 0x100687a4
cmp esi, ebp
je 0x1006875c
cmp dword [esp + 0x18], 4
jne 0x1006875c
mov eax, 1
push eax
push esi
push eax
push str._GAC__B__dwSessionID___d__WTSRet___d__Result___d
jmp 0x1006879b
xor eax, eax
push eax
push esi
push 1
push str._GAC__B__dwSessionID___d__WTSRet___d__Result___d
jmp 0x1006879b
push ebp
push ebp
mov dword [esp + 0x30], ebp
call dword [0x101a2740]
mov esi, eax
cmp dword [0x1018cd3c], ebp
je 0x100687a4
cmp esi, ebp
je 0x10068791
cmp dword [esp + 0x18], 4
jne 0x10068791
mov eax, 1
jmp 0x10068793
xor eax, eax
push eax
push esi
push ebp
push str._GAC__C__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.10053700
add esp, 0x14
cmp esi, ebp
je 0x100687da
cmp dword [esp + 0x18], 4
jne 0x100687da
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp eax, ebp
sete bl
test bl, bl
jne 0x100687da
cmp eax, 4
sete bl
jmp 0x100687da
call edi
cmp eax, 0x6a6
je 0x100687d8
call edi
cmp eax, 0x47f
jne 0x100687da
mov bl, 1
cmp dword [0x1018cd3c], ebp
je 0x100687f9
mov ecx, dword [esp + 0x1c]
push ecx
movzx edx, bl
push edx
push str._GAC__bActiveSession___d__dwSessionID___d_
push ebp
call fcn.10053700
add esp, 0x10
test bl, bl
jne 0x100688c1
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x14], ebp
je 0x10068829
call edi
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [0x101a2744]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebp
call fcn.1004cf90
mov esi, dword [esp + 0x28]
cmp dword [0x1018cd3c], ebp
je 0x10068851
push esi
push str._GAC__SessionIDOfFirstLoggedOnUser___d
push ebp
call fcn.10053700
add esp, 0xc
cmp esi, 0xffffffff
je 0x100688c1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 8
push esi
push ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebp
call dword [0x101a2740]
mov edi, eax
cmp dword [0x1018cd3c], ebp
je 0x100688a1
cmp edi, ebp
je 0x1006888e
cmp dword [esp + 0x18], 4
jne 0x1006888e
mov eax, 1
jmp 0x10068890
xor eax, eax
push eax
push edi
push esi
push str._GAC__D__dwSessionID___d__WTSRet___d__Result___d
push ebp
call fcn.10053700
add esp, 0x14
cmp edi, ebp
je 0x100688c1
cmp dword [esp + 0x18], 4
jne 0x100688c1
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp eax, ebp
sete bl
test bl, bl
jne 0x100688c1
cmp eax, 4
sete bl
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], ebp
je 0x100688e7
call edi
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [0x101a2744]
push esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
jne 0x1006890e
cmp dword [0x1018cd3c], ebp
je 0x10068904
call edi
push eax
push str._GAC__returning_rval4__le_u_
push ebp
call fcn.10053700
add esp, 0xc
mov eax, 4
jmp 0x10068b2d
push 0x2000000
push ebp
push str.WinSta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
cmp esi, ebp
je 0x10068b0b
mov edi, dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
call edi
push 0x2000000
push ebp
push ebp
call dword [sym.imp.USER32.dll_OpenInputDesktop]
cmp eax, ebp
jne 0x1006898d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebp, eax
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x1018cd3c], 0
je 0x10068983
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GAC__returning_rval6__le_u_
push 0
call fcn.10053700
add esp, 0xc
mov eax, 6
jmp 0x10068b2d
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
call edi
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push eax
call dword [0x101a273c]
mov esi, eax
cmp dword [0x1018cd3c], ebp
je 0x100689da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
push eax
push ecx
push esi
push edi
push str._GAC__A__e_WTSQueryUserToken_for_sessid:_d__eVal___d__hTok__0x_x__LE:_u_
push ebp
call fcn.10053700
add esp, 0x18
jmp 0x100689de
mov edi, dword [esp + 0x1c]
cmp esi, ebp
jne 0x10068a58
xor ebx, ebx
mov ecx, str.SeTcbPrivilege
call fcn.10048c40
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x40], 1
test eax, eax
je 0x10068a1d
lea edx, [esp + 0x40]
push edx
push ebx
push 1
push 7
call eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [0x101a273c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0x1018cd3c], ebp
je 0x10068a52
call ebx
mov ecx, dword [esp + 0x24]
push eax
push ecx
push esi
push edi
push str._GAC__B__e_WTSQueryUserToken_for_sessid:_d__eVal___d__hTok__0x_x__LE:_u_
push 0
call fcn.10053700
add esp, 0x18
test esi, esi
je 0x10068abf
xor ebp, ebp
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x10068b03
cmp dword [esp + 0x1ac], ebp
je 0x10068a81
mov edx, dword [esp + 0x44]
push edx
push 1
push 2
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x10068a8f
mov ecx, dword [esp + 0x44]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
cmp dword [0x1018cd3c], ebp
je 0x10068aac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GAC__returning_rval2__success___le_u_
push ebp
call fcn.10053700
add esp, 0xc
lea edx, [esp + 0x24]
push edx
mov esi, 2
call fcn.100673f0
mov eax, esi
jmp 0x10068b2d
call ebx
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x10068add
cmp eax, 0x4dd
je 0x10068ad7
cmp eax, 0x6d3
jne 0x10068add
mov dword [ecx], 1
cmp dword [0x1018cd3c], ebp
je 0x10068afa
mov eax, dword [ecx]
push eax
call ebx
push eax
push str._GAC__returning_rval7__le_u__SessionActiveButGetTokenFailed:_d
push 0
call fcn.10053700
add esp, 0x10
mov esi, 7
mov eax, esi
jmp 0x10068b2d
mov esi, dword [esp + 0x54]
mov eax, esi
jmp 0x10068b2d
cmp dword [0x1018cd3c], ebp
je 0x10068b24
call edi
push eax
push str._GAC__returning_rval5__le_u_
push ebp
call fcn.10053700
add esp, 0xc
mov eax, 5
jmp 0x10068b2d
xor eax, eax
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x198
ret