Function at 0x42afb0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
push edi
mov edi, esi
push str._______Inside_GetShutDownPrivilegedSessionId_______n
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0043d7e0
add esp, 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 1
push ebx
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
je 0x42b148
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x10], ebx
jbe 0x42b107
jmp 0x42b010
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx + eax + 8]
mov esi, dword [ebx + eax]
mov edx, dword [ebx + eax + 4]
push edi
push esi
push str.GetShutDownPrivilegedSessionId_:_The_State_of_the_Session_:__d_is_given_by__d__n
mov dword [ebp - 0x28], edx
call fcn.0043d7e0
add esp, 0xc
test edi, edi
je 0x42b075
cmp edi, 1
je 0x42b075
cmp edi, 4
jne 0x42b064
push esi
call fcn.0042b1b0
add esp, 4
test eax, eax
je 0x42b05c
push esi
push str.Disconnected_Session_has_shutdown_privilege_:_session_id_:__d_n
call fcn.0043d7e0
add esp, 8
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
jmp 0x42b0ec
push edi
push esi
push str.GetShutDownPrivilegedSessionId_:_The_detected_session_is_dummy_Session__its_value_is__d_with_state__d_._n
call fcn.0043d7e0
add esp, 0xc
jmp 0x42b0ec
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 8]
push ecx
push 5
push esi
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x42b0d8
mov edi, dword [ebp - 8]
test edi, edi
je 0x42b0ec
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b098
sub eax, edx
cmp eax, 1
jbe 0x42b0ec
push edi
push str.Active_logged_on_userName_:__s_n
call fcn.0043d7e0
push esi
call fcn.0042b1b0
add esp, 0xc
test eax, eax
jne 0x42b127
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], esi
test eax, eax
je 0x42b0ec
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov dword [ebp - 8], 0
jmp 0x42b0ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetShutDownPrivilegedSessionId_:_WTSQuerySessionInformation_Failed_with_errorcode__d__n
call fcn.0043d500
add esp, 8
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0xc
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp - 0x10]
jb 0x42b010
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 4], 0xffffffff
jne 0x42b192
cmp edi, 0xffffffff
je 0x42b178
push edi
mov dword [ebp - 4], edi
push str.GetShutDownPrivilegedSessionId_:_No_shutdown_previleged_user___return_last_active_user:__d__n
jmp 0x42b18a
push esi
push str.Session_has_shutdown_privilege_:_session_id_:__d_n
call fcn.0043d7e0
mov edx, dword [ebp - 0xc]
add esp, 8
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetShutDownPrivilegedSessionId_:_Unable_to_find_the_sessions_present_in_the_machine__with_error_code__d__n
call fcn.0043d500
add esp, 8
push str.Microsoft_Windows_2000
call fcn.0043ec60
push eax
call fcn.0058021f
add esp, 8
test eax, eax
jne 0x42b192
mov dword [ebp - 4], ebx
jmp 0x42b192
cmp esi, 0xffffffff
je 0x42b192
cmp esi, ebx
je 0x42b192
push esi
mov dword [ebp - 4], esi
push str.GetShutDownPrivilegedSessionId_:_No_shutdown_previleged_user__no_active_users___return_last_disconnected_user_:__d__n
call fcn.0043d7e0
add esp, 8
push str.________End_of_GetShutDownPrivilegedSessionId________n
call fcn.0043d7e0
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret