Function at 0x140049658
Capabilities:
Get session information
Get session user name

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400be278]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x34], r12d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8d, [r12 + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x140049712
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test byte [0x1400bf1c0], 8
je 0x1400496ea
mov r8d, eax
lea rdx, [0x14008a650]
lea rcx, [0x1400b81c0]
call fcn.140012dc4
test byte [0x1400bf300], 8
je 0x140049ca5
mov r8d, ebx
lea rdx, [0x14008a650]
lea rcx, [0x1400b8320]
call fcn.140012dc4
jmp 0x140049ca5
mov rax, qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov qword [rbp - 0x41], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x39], rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140067178
mov qword [rsp + 0x38], rax
lea rcx, vtable.appv::utility::scope_guard_func_impl_class_std::_Binder_struct_std::_Unforced__void____cdecl___void____ptr64___struct__WTS_SESSION_INFOW____ptr64____ptr64__.0
mov qword [rax], rcx
movups xmm0, xmmword [rbp - 0x41]
movdqu xmmword [rax + 8], xmm0
mov qword [rbp - 0x79], rax
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x30], r12d
mov r14d, r12d
cmp dword [rsp + 0x34], r12d
jbe 0x140049c9c
mov edi, SafeArrayGetDim
lea r13, str.admin_appman_appvclienthostcommonusermanagerimpl.cpp
mov ebx, 7
mov eax, r14d
lea rsi, [rax + rax*2]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + rsi*8 + 0x10]
test ecx, ecx
je 0x1400498b8
call fcn.14004bda8
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rbx
mov word [rbp - 0x21], r12w
lea rdx, str.UserManager_processing_existing_logons__ignoring_session__1__in_state__2_
lea rcx, [rbp - 0x21]
call fcn.140003c94
nop
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
lea rdx, str.Client
lea rcx, [rbp - 0x41]
call fcn.140003c94
nop
call fcn.14000a0ec
lea r8, [rbp - 0x21]
lea rdx, [rbp - 1]
call fcn.14003c360
mov rbx, rax
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea r9, str.AppV::Client::Host::UserManagerImpl::EnumSessions
mov edx, 0x31
lea rcx, [rbp - 0x69]
call fcn.14003c658
mov dword [rbp - 0x49], SysAllocStringByteLen
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rsi*8]
mov rcx, rbx
call fcn.14000ca90
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001274c
mov r9, rbx
lea r8, [rbp - 0x41]
mov edx, 4
lea rcx, [rbp - 0x69]
call fcn.14003c4d0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x14004987f
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004987a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049cd2
call fcn.1400674a4
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea rax, vtable.AppV::LogFormatter.0
mov qword [rbp - 1], rax
lea rcx, [rbp + 0xf]
call fcn.140003c2c
nop
lea rcx, [rbp - 0x41]
call fcn.140003c2c
nop
lea rcx, [rbp - 0x21]
call fcn.140003c2c
jmp 0x140049c8e
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x30], r12d
mov edi, 5
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x48]
lea r8d, [rdi + 3]
mov edx, dword [rax + rsi*8]
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14004995c
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
test rax, rax
je 0x14004994e
test rbx, rbx
je 0x14004991c
cmp rax, 4
ja 0x14004991c
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edi, dword [rsp + 0x38]
jmp 0x14004994e
xor edi, edi
test rbx, rbx
jne 0x140049931
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [rax], SafeArrayGetElement
jmp 0x140049943
cmp rax, 4
jbe 0x14004994e
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov ebx, 7
test edi, edi
je 0x140049a8d
mov ecx, edi
call fcn.14004bda8
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
lea rdx, str.UserManager_processing_existing_logons__ignoring_session__1__in_state__2_
lea rcx, [rbp - 0x41]
call fcn.140003c94
nop
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rbx
mov word [rbp - 0x21], r12w
lea rdx, str.Client
lea rcx, [rbp - 0x21]
call fcn.140003c94
nop
call fcn.14000a0ec
lea r8, [rbp - 0x41]
lea rdx, [rbp - 1]
call fcn.14003c360
mov rbx, rax
mov qword [rbp - 0x59], r12
mov edi, SafeArrayGetDim
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea r9, str.AppV::Client::Host::UserManagerImpl::EnumSessions
lea edx, [rdi + 0x22]
lea rcx, [rbp - 0x69]
call fcn.14003c658
mov dword [rbp - 0x49], 0xa9
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rsi*8]
mov rcx, rbx
call fcn.14000ca90
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001274c
mov r9, rbx
lea r8, [rbp - 0x21]
lea edx, [rdi - 0xb]
lea rcx, [rbp - 0x69]
call fcn.14003c4d0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x140049a59
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049a54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049cd9
call fcn.1400674a4
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea rax, vtable.AppV::LogFormatter.0
mov qword [rbp - 1], rax
lea rcx, [rbp + 0xf]
call fcn.140003c2c
nop
lea rcx, [rbp - 0x21]
call fcn.140003c2c
nop
lea rcx, [rbp - 0x41]
jmp 0x1400498ae
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
lea rdx, str.UserManager_processing_existing_logons__found_active_session__1_
lea rcx, [rbp - 0x41]
call fcn.140003c94
nop
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], rbx
mov word [rbp - 0x21], r12w
lea rdx, str.Client
lea rcx, [rbp - 0x21]
call fcn.140003c94
nop
call fcn.14000a0ec
lea r8, [rbp - 0x41]
lea rdx, [rbp - 1]
call fcn.14003c360
mov rbx, rax
mov qword [rbp - 0x59], r12
mov edi, SafeArrayGetDim
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea r9, str.AppV::Client::Host::UserManagerImpl::EnumSessions
lea edx, [rdi + 0x22]
lea rcx, [rbp - 0x69]
call fcn.14003c658
mov dword [rbp - 0x49], 0xaf
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rsi*8]
mov rcx, rbx
call fcn.14000ca90
mov r9, rbx
lea r8, [rbp - 0x21]
lea edx, [rdi - 0xb]
lea rcx, [rbp - 0x69]
call fcn.14003c4d0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x140049b69
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049b64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049ce0
call fcn.1400674a4
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rdi
mov byte [rbp - 0x69], r12b
lea rax, vtable.AppV::LogFormatter.0
mov qword [rbp - 1], rax
lea rcx, [rbp + 0xf]
call fcn.140003c2c
nop
lea rcx, [rbp - 0x21]
call fcn.140003c2c
nop
lea rcx, [rbp - 0x41]
call fcn.140003c2c
mov rax, qword [rsp + 0x40]
mov r8b, 1
mov edx, dword [rax + rsi*8]
mov rcx, r15
call fcn.14004ae68
mov rbx, rax
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140049bcb
inc rax
jmp 0x140049bce
mov rax, r13
mov rdx, rax
lea rsi, [0x1400bf638]
mov rcx, rsi
call fcn.140012ce4
movabs rax, 0x8000000000
test rax, rbx
jne 0x140049c8e
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140049c0b
inc rax
jmp 0x140049c0e
mov rax, r13
mov rdx, rax
mov rcx, rsi
call fcn.140012ce4
movabs rax, 0x2000000000
test rax, rbx
jne 0x140049c8e
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140049c40
inc rax
jmp 0x140049c43
mov rax, r13
mov rdx, rax
mov rcx, rsi
call fcn.140012ce4
mov rax, rbx
shr rax, 0x20
and al, 0x1f
cmp al, 0xe
jne 0x140049c8e
mov edx, 0x5c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140049c73
inc rax
jmp 0x140049c76
mov rax, r13
mov rdx, rax
mov rcx, rsi
call fcn.140012ce4
shl rax, 0x34
or eax, 0x302
cmp ebx, eax
je 0x140049c9c
inc r14d
cmp r14d, dword [rsp + 0x34]
jb 0x140049770
lea rcx, [rbp - 0x79]
call fcn.1400065e4
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140067150
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3