Function at 0x41037f40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x411bc440], 0
jne 0x41037f97
push str.CWTSAbstractionLayer::InitInstance_called
push 0x1000001
push 0x13a
push str.DLL_WTSAbstractionLayer.cpp
mov dword [0x411bc440], 1
call fcn.41002c10
add esp, 0x10
cmp dword [0x411bc414], 0
je 0x41037f99
push str.CWTSAbstractionLayer:_Already_successful_initialized_
push 0x1000001
push 0x142
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x10
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSAPI32.DLL
call edi
mov dword [0x411bc414], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x411bc414]
push eax
push str.HANDLE_x___d
push 0x1000001
push 0x147
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
mov eax, dword [0x411bc414]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x18
test eax, eax
jne 0x41038009
push 0x148
push str.DLL_WTSAbstractionLayer.cpp
push str.m_hWTSApi32
call fcn.41002b10
mov eax, dword [0x411bc414]
add esp, 0xc
test eax, eax
je 0x41038182
push str.WTSQuerySessionInformationW
push eax
call esi
mov dword [0x411bc420], eax
test eax, eax
jne 0x41038031
push 0x152
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSQuerySessionInformation
call fcn.41002b10
add esp, 0xc
mov ecx, dword [0x411bc414]
push str.WTSEnumerateSessionsW
push ecx
call esi
mov dword [0x411bc428], eax
test eax, eax
jne 0x4103805f
push 0x153
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSEnumerateSessions
call fcn.41002b10
add esp, 0xc
mov edx, dword [0x411bc414]
push str.WTSEnumerateProcessesW
push edx
call esi
mov dword [0x411bc42c], eax
test eax, eax
jne 0x4103808d
push 0x154
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSEnumerateProcesses
call fcn.41002b10
add esp, 0xc
mov eax, dword [0x411bc414]
push str.WTSFreeMemory
push eax
call esi
mov dword [0x411bc424], eax
test eax, eax
jne 0x410380ba
push 0x15a
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSFreeMemory
call fcn.41002b10
add esp, 0xc
mov ecx, dword [0x411bc414]
push str.WTSWaitSystemEvent
push ecx
call esi
mov dword [0x411bc430], eax
test eax, eax
jne 0x410380e8
push 0x15b
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSWaitSystemEvent
call fcn.41002b10
add esp, 0xc
mov edx, dword [0x411bc414]
push str.WTSQueryUserToken
push edx
call esi
mov dword [0x411bc434], eax
test eax, eax
jne 0x41038116
push 0x15c
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSQueryUserToken
call fcn.41002b10
add esp, 0xc
mov eax, dword [0x411bc414]
push str.WTSRegisterSessionNotification
push eax
call esi
mov dword [0x411bc438], eax
test eax, eax
jne 0x41038143
push 0x15d
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSRegisterSessionNotification
call fcn.41002b10
add esp, 0xc
mov ecx, dword [0x411bc414]
push str.WTSUnregisterSessionNotification
push ecx
call esi
mov dword [0x411bc43c], eax
test eax, eax
jne 0x41038171
push 0x15e
push str.DLL_WTSAbstractionLayer.cpp
push str.m_pWTSUnregisterSessionNotification
call fcn.41002b10
add esp, 0xc
push str.All_function_loaded_from_WTSAPI32.DLL...
push 0x1000001
push 0x15f
jmp 0x41038191
push str.no_Terminal_Serices_found_wtsapi32.dll_
push 0x1000001
push 0x163
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x10
call fcn.410371c0
test eax, eax
je 0x41038203
push 0x4116c5ac
call edi
push eax
push str.Get_Active_ConsoleSessionId_hXPKernel32___d
push 0x1000001
push 0x169
push str.DLL_WTSAbstractionLayer.cpp
mov dword [0x411bc418], eax
call fcn.41002c10
mov eax, dword [0x411bc418]
add esp, 0x14
test eax, eax
je 0x41038203
push str.WTSGetActiveConsoleSessionId
push eax
call esi
push eax
push str.Funktion_Pointer_Active_ConsoleSessionId___d
push 0x1000001
push 0x19a
push str.DLL_WTSAbstractionLayer.cpp
mov dword [0x411bc41c], eax
call fcn.41002c10
add esp, 0x14
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x41038219
push 0xffffffffffffffff
call fcn.41037630
add esp, 4
movzx esi, ax
jmp 0x41038235
push str.Force_protocol_to_Console.
push 0x1000001
push 0x1a9
push str.DLL_WTSAbstractionLayer.cpp
call fcn.41002c10
add esp, 0x10
movzx eax, si
dec eax
cmp eax, 5
ja case.0x4103823e.3
jmp dword [eax*4 + 0x41038288]
push str.TPICAW32.dll
jmp 0x4103825f
push str.TPRDPW32.dll
jmp 0x4103825f
push str.TPVMW32.dll
jmp 0x4103825f
push str.TPPCOIPW32.dll
mov ecx, 0x411bc4d4
call fcn.41037ed0
pop edi
cmp si, 1
pop esi
je 0x41037f97
cmp dword [ebp + 8], 0
jne 0x41037f97
pop ebp
jmp fcn.41037250