Function at 0x40fe90
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.00412e10
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x1464]
mov dword [ebp - 0x145c], 0
push eax
lea eax, [ebp - 0x1458]
mov dword [ebp - 0x1460], 0
push eax
push 0x18
xor esi, esi
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x1464], esi
mov dword [ebp - 0x1458], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40ff72
mov esi, dword [ebp - 0x1458]
test esi, esi
je 0x40ffb3
mov eax, dword [esi + 4]
mov dword [ebp - 0x145c], eax
lea eax, [esi + 0x82]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004092a0
lea eax, [esi + 0x60]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004092a0
push dword [ebp - 0x145c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.GetLoggedCreds_WTSSessionInfo__:_szUserName___s__szDomain___s__dwSessionId___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.004092a0
add esp, 0x30
lea eax, [ebp - 0xc34]
push eax
call edi
mov esi, 1
jmp 0x40ff9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetLoggedCreds_WTSSessionInfo__:_WTSQuerySessionInformation___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.004092a0
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x40ffab
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
jne 0x41012b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x145c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4100da
push dword [ebp - 0x145c]
lea eax, [ebp - 0xc34]
push str.GetProcessSession__:_ProcessIdToSessionId_____dwSessID___d_n
push 0x410
push eax
call fcn.004092a0
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
lea eax, [ebp - 0x1458]
mov dword [ebp - 0x1458], 0
push eax
push 5
push dword [ebp - 0x145c]
call fcn.00410850
mov esi, eax
add esp, 0xc
test esi, esi
je 0x410105
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x41005b
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004092a0
mov eax, dword [ebp - 0x1458]
add esp, 0xc
test eax, eax
je 0x410051
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x1458], 0
lea eax, [ebp - 0x1458]
push eax
push 7
push dword [ebp - 0x145c]
call fcn.00410850
mov esi, eax
add esp, 0xc
test esi, esi
je 0x410105
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x4100ab
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004092a0
mov eax, dword [ebp - 0x1458]
add esp, 0xc
test eax, eax
je 0x4100ab
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x145c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str.GetLoggedCreds_WTSUserDomain__:_szUserName___s__szDomain___s__dwSessionId___d_n
lea eax, [ebp - 0x1454]
push 0x410
push eax
call fcn.004092a0
add esp, 0x18
jmp 0x41011e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcessSession__:_ProcessIdToSessionId___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.004092a0
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call edi
xor esi, esi
push str.GetLoggedCreds_WTSUserDomain___failed._n
lea eax, [ebp - 0x1454]
push 0x410
push eax
call fcn.004092a0
add esp, 0xc
lea eax, [ebp - 0x1454]
push eax
call edi
test esi, esi
je 0x41015e
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x145c]
call fcn.00410420
add esp, 0x10
test eax, eax
je 0x41015e
mov eax, dword [ebp - 0x1460]
cmp word [eax], 0
jne 0x410181
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004109c0
mov eax, dword [ebp - 0x1460]
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00412b32
mov esp, ebp
pop ebp
ret