Function at 0x40513e
Capabilities:
Enumerate processes on remote desktop session host
Get session information
Get session user name
Get user security identifier

Disassembly:
push 0x144
mov eax, 0x4649b9
call fcn.0046049c
xor ebx, ebx
mov dword [ebp - 0x150], edi
mov dword [edi], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [ebp - 4], 2
cmp dword [edi], ebx
jne 0x405470
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x120], ebx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x14c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov esi, dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x11c]
push eax
push 5
push 0xffffffffffffffff
push ebx
call esi
test eax, eax
je 0x40543a
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x118]
push eax
push 7
push 0xffffffffffffffff
push ebx
call esi
test eax, eax
je 0x40543a
mov ecx, dword [ebp - 0x128]
add ecx, dword [ebp - 0x134]
push ecx
call fcn.0045010c
mov esi, eax
mov eax, dword [edi + 8]
pop ecx
cmp esi, eax
je 0x405214
push eax
call fcn.00450117
pop ecx
mov dword [edi + 8], esi
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x40543a
mov ecx, dword [ebp - 0x128]
dec ecx
push ecx
push dword [ebp - 0x118]
push eax
call fcn.004562c0
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x128]
mov byte [eax + ecx - 1], 0x5c
mov eax, dword [edi + 8]
add eax, dword [ebp - 0x128]
add esp, 0xc
push dword [ebp - 0x134]
push dword [ebp - 0x11c]
push eax
call fcn.004562c0
add esp, 0xc
push 0xff
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 0x130], ebx
mov byte [ebp - 0x114], bl
call fcn.00456240
mov eax, dword [edi + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
add esp, 0xc
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push ebx
push eax
push ebx
mov dword [ebp - 0x140], 0x100
mov dword [ebp - 0x13c], 7
call esi
push dword [ebp - 0x130]
call fcn.0045010c
pop ecx
mov dword [ebp - 0x12c], eax
mov byte [ebp - 4], 6
cmp eax, ebx
jne 0x4052e1
push ebx
jmp 0x405434
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x13c]
push edx
lea edx, [ebp - 0x140]
push edx
lea edx, [ebp - 0x114]
push edx
lea edx, [ebp - 0x130]
push edx
push eax
push ecx
push ebx
call esi
test eax, eax
je 0x40542e
mov dword [ebp - 0x124], ebx
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x12c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x405349
cmp dword [ebp - 0x124], ebx
je 0x405343
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
jmp 0x405434
lea eax, [edi + 4]
push eax
push dword [ebp - 0x124]
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40532f
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x120]
push eax
push 1
push ebx
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesA]
test eax, eax
je 0x40532f
push dword [ebp - 0x138]
lea eax, [ebp - 0x148]
push dword [ebp - 0x120]
push esi
push eax
call fcn.004047c3
mov ecx, dword [ebp - 0x148]
xor eax, eax
cmp dword [ebp - 0x144], ebx
jbe 0x4053bb
lea edx, [ecx + 0x20]
cmp dword [edx], 0xffffffff
jne 0x4053d8
inc eax
add edx, 0x28
cmp eax, dword [ebp - 0x144]
jb 0x4053aa
xor eax, eax
cmp eax, ebx
jne 0x4053e1
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x40541a
push fcn.004048de
lea esi, [ecx - 4]
push dword [esi]
push 0x28
push ecx
jmp 0x40540e
imul eax, eax, 0x28
mov eax, dword [eax + ecx + 0x14]
jmp 0x4053bd
push edi
push 1
push 2
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x148]
cmp eax, ebx
je 0x40541a
push fcn.004048de
lea esi, [eax - 4]
push dword [esi]
push 0x28
push eax
call fcn.0045160f
push esi
call fcn.00450117
pop ecx
cmp dword [ebp - 0x124], ebx
je 0x40542e
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x12c]
call fcn.00450117
pop ecx
mov esi, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x120], ebx
je 0x405450
push dword [ebp - 0x120]
call esi
cmp dword [ebp - 0x118], ebx
je 0x405460
push dword [ebp - 0x118]
call esi
cmp dword [ebp - 0x11c], ebx
je 0x405470
push dword [ebp - 0x11c]
call esi
mov eax, edi
call fcn.004604e6
ret