Function at 0x1400832b0
Capabilities:
Get session information

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, r8
mov rbp, rdx
mov edi, ecx
test ecx, ecx
jne 0x1400832ed
call fcn.14001dd40
mov rcx, rax
call fcn.1400aad70
cmp eax, 4
jb 0x1400832ed
xor al, al
jmp 0x14008347b
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r14
xor r14b, r14b
xor r12d, r12d
mov qword [rsp + 0x68], rbx
mov esi, r12d
nop word [rax + rax]
cmp esi, 0xa
jge 0x140083463
lea rdx, str.Trying_to_start_app_in_session
lea rcx, [0x1404abb40]
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
mov rcx, rax
lea rdx, str.__attempt:
call fcn.1400337c0
mov edx, esi
mov rcx, rax
call fcn.140045c80
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140034b90
movzx edx, al
mov rcx, rbx
call fcn.140034620
mov rcx, rbx
call fcn.14002ddd0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, 8
mov dword [rsp + 0x38], r12d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x140083491
lea rdx, str.Session
lea rcx, [0x1404abb40]
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
mov rcx, rax
lea rdx, str._cannot_be_queried_because_it_is_closed_or_a_close_operation_is_pending.
call fcn.1400337c0
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140034b90
movzx edx, al
mov rcx, rbx
call fcn.140034620
mov rcx, rbx
call fcn.14002ddd0
lea rdx, str.Did_not_start_app_in_session
lea rcx, [0x1404abb40]
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
lea rdx, str.___the_session_wasnt_ready.
mov rcx, rax
call fcn.1400337c0
mov rbx, rax
mov dl, 0xa
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.140034b90
movzx edx, al
mov rcx, rbx
call fcn.140034620
mov rcx, rbx
call fcn.14002ddd0
mov ecx, 0x3e8
inc esi
call qword [sym.imp.KERNEL32.dll_Sleep]
test r14b, r14b
je 0x140083310
mov r12, qword [rsp + 0x58]
movzx eax, r14b
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x70
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rsp + 0x30]
mov ebx, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test ebx, ebx
je 0x1400834ce
lea rdx, str.Session
lea rcx, [0x1404abb40]
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
mov rcx, rax
lea rdx, str._is_not_active.
jmp 0x1400833ce
mov ecx, edi
call fcn.140083fb0
test al, al
je 0x1400833fa
mov r8, r15
mov rdx, rbp
mov ecx, edi
call fcn.140083570
test al, al
je 0x14008353c
mov rdx, rbp
mov ecx, edi
call fcn.140083cc0
lea rcx, [0x1404abb40]
test al, al
je 0x140083521
lea rdx, str.Successfully_started_app_in_session
mov r14b, 1
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
jmp 0x140083426
lea rdx, str.Failed_to_start_starting_app_in_session
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
jmp 0x140083426
lea rdx, str.Did_not_start_app_in_session
lea rcx, [0x1404abb40]
call fcn.1400337c0
mov edx, edi
mov rcx, rax
call fcn.140032140
lea rdx, str.___it_is_possible_that_no_user_is_logged_in.
jmp 0x14008341e