Function at 0x40eb50
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.00410da0
mov eax, dword [0x441070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x1464]
mov dword [ebp - 0x145c], 0
push eax
lea eax, [ebp - 0x1458]
mov dword [ebp - 0x1460], 0
push eax
push 0x18
xor esi, esi
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x1464], esi
mov dword [ebp - 0x1458], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40ec32
mov esi, dword [ebp - 0x1458]
test esi, esi
je 0x40ec73
mov eax, dword [esi + 4]
mov dword [ebp - 0x145c], eax
lea eax, [esi + 0x82]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00409210
lea eax, [esi + 0x60]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00409210
push dword [ebp - 0x145c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x430600
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409210
add esp, 0x30
lea eax, [ebp - 0xc34]
push eax
call edi
mov esi, 1
jmp 0x40ec5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetLoggedCreds_WTSSessionInfo__:_WTSQuerySessionInformation___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409210
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40ec6b
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
jne 0x40edeb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x145c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40ed9a
push dword [ebp - 0x145c]
lea eax, [ebp - 0xc34]
push str.GetProcessSession__:_ProcessIdToSessionId_____dwSessID___d_n
push 0x410
push eax
call fcn.00409210
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
lea eax, [ebp - 0x1458]
mov dword [ebp - 0x1458], 0
push eax
push 5
push dword [ebp - 0x145c]
call fcn.0040f290
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40edc5
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40ed1b
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00409210
mov eax, dword [ebp - 0x1458]
add esp, 0xc
test eax, eax
je 0x40ed11
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x1458], 0
lea eax, [ebp - 0x1458]
push eax
push 7
push dword [ebp - 0x145c]
call fcn.0040f290
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40edc5
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40ed6b
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00409210
mov eax, dword [ebp - 0x1458]
add esp, 0xc
test eax, eax
je 0x40ed6b
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x145c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.GetLoggedCreds_WTSUserDomain__:_szUserName___s__szDomain___s__dwSessionId___d_n
lea eax, [ebp - 0x1454]
push 0x410
push eax
call fcn.00409210
add esp, 0x18
jmp 0x40edde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcessSession__:_ProcessIdToSessionId___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409210
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
xor esi, esi
push str.GetLoggedCreds_WTSUserDomain___failed._n
lea eax, [ebp - 0x1454]
push 0x410
push eax
call fcn.00409210
add esp, 0xc
lea eax, [ebp - 0x1454]
push eax
call edi
test esi, esi
je 0x40ee1e
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x145c]
call fcn.0040ee60
add esp, 0x10
test eax, eax
je 0x40ee1e
mov eax, dword [ebp - 0x1460]
cmp word [eax], 0
jne 0x40ee41
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040f350
mov eax, dword [ebp - 0x1460]
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00410abf
mov esp, ebp
pop ebp
ret