Function at 0x40ef00
Capabilities:
Get logon sessions
Print debug messages
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1278
call fcn.00410e60
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x1278], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1268], eax
lea eax, [ebp - 0x126c]
push edi
push eax
lea eax, [ebp - 0x1264]
mov dword [ebp - 0x1264], 0
push eax
mov dword [ebp - 0x126c], 0
mov dword [ebp - 0x1250], 0
mov dword [ebp - 0x1260], esi
mov dword [ebp - 0x1270], 1
mov dword [ebp - 0x1258], esi
mov dword [ebp - 0x1254], esi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40efb7
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
xor edi, edi
cmp dword [ebp - 0x1264], esi
jbe 0x40f2e6
nop word [eax + eax]
mov eax, dword [ebp - 0x126c]
test eax, eax
je 0x40f2d3
test esi, esi
jne 0x40f2d7
lea ecx, [ebp - 0x1250]
push ecx
lea eax, [eax + edi*8]
push eax
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
jne 0x40f294
mov eax, dword [ebp - 0x1250]
test eax, eax
je 0x40f270
cmp dword [eax + 0x2c], esi
je 0x40f23e
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x28], ecx
jne 0x40f23e
push dword [ebp - 0x1274]
push dword [eax + 0x10]
call fcn.0041d38c
add esp, 8
test eax, eax
jne 0x40f238
mov eax, dword [ebp - 0x1250]
push dword [ebp - 0x1278]
push dword [eax + 0x18]
call fcn.0041d38c
add esp, 8
test eax, eax
jne 0x40f238
push 0x410
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.00412cd0
add esp, 0xc
lea eax, [ebp - 0x1254]
push eax
mov eax, dword [ebp - 0x1250]
push dword [eax + 0x2c]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x40f20a
push dword [ebp - 0x1254]
lea eax, [ebp - 0x124c]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_s
push 0x208
push eax
call fcn.00409270
mov eax, dword [ebp - 0x1254]
add esp, 0x10
test eax, eax
je 0x40f0bb
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x125c]
mov dword [ebp - 0x1254], 0
push eax
push 1
push 0
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x1258], 0x208
push eax
push 0x80000002
mov dword [ebp - 0x125c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f174
lea eax, [ebp - 0x1258]
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x1270]
push eax
push 0
push str.ProfileImagePath
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1270]
cmp eax, 2
je 0x40f132
cmp eax, 1
jne 0x40f168
push 0x104
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
mov dword [ebp - 0x1258], eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.0041ed2e
add esp, 0xc
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc34]
push eax
push edi
push str.GetSidFromEnumSess__:_ProfileImagePath__d____s_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409270
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
lea eax, [ebp - 0xc34]
push 0x5c
push eax
call fcn.00412e2a
mov edx, eax
add esp, 8
test edx, edx
je 0x40f2c6
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f1c0
sub ecx, esi
sar ecx, 1
cmp ecx, 1
jbe 0x40f1d7
add edx, 2
test edx, edx
je 0x40f2c0
push dword [ebp - 0x1274]
push edx
call fcn.0041d38c
add esp, 8
test eax, eax
jne 0x40f2c0
mov eax, dword [ebp - 0x1250]
mov esi, dword [eax + 0x2c]
mov dword [ebp - 0x1260], esi
jmp 0x40f2c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSidFromEnumSess__:_ConvertSidToStringSid___err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f2c6
mov eax, dword [ebp - 0x1250]
test eax, eax
je 0x40f270
push dword [eax + 0x28]
push dword [eax + 0x18]
push dword [eax + 0x10]
lea eax, [ebp - 0x824]
push edi
push str.GetSidFromEnumSess__:_i___d_:_szUserName___s__szDomain___s__dwSessionId___d_n
push 0x410
push eax
call fcn.00409270
add esp, 0x1c
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f2c6
push str.GetSidFromEnumSess__:_lpSessionData__NULL._n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409270
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f2c6
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push edi
push str.GetSidFromEnumSess__:_LsaGetLogonSessionData__i__err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409270
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f2c6
mov esi, dword [ebp - 0x1260]
inc edi
cmp edi, dword [ebp - 0x1264]
jb 0x40efd0
test esi, esi
je 0x40f2e6
mov edi, dword [ebp - 0x1268]
push edi
push esi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
jmp 0x40f2ec
mov edi, dword [ebp - 0x1268]
push dword [edi]
lea eax, [ebp - 0x824]
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___lpszSid___s_n
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00410b68
mov esp, ebp
pop ebp
ret