Function at 0x140003420
Capabilities:
Get logon sessions

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x218], rbx
mov rax, qword [0x1401fdb90]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r13, r8
mov r12, rdx
mov rsi, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
js 0x140003671
xor r14d, r14d
mov ebx, r14d
cmp dword [rsp + 0x28], ebx
jbe 0x140003666
or r15, 0xffffffffffffffff
nop word [rax + rax]
mov qword [rsp + 0x20], r14
mov ecx, ebx
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rcx*8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
js 0x140003611
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x40], 3
je 0x140003606
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
mov r8d, 3
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140004a30
nop
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
xor eax, eax
mov rcx, r15
mov rdx, qword [rbp - 0x60]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.14000a0b0
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x140003534
call fcn.1401459a8
mov rax, qword [rsp + 0x20]
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.140001040
mov rdx, rax
lea rdi, [rsp + 0x50]
mov r11, qword [rsp + 0x50]
mov r10, qword [rsp + 0x68]
cmp r10, 8
cmovae rdi, r11
mov r9, qword [rax + 0x10]
cmp r9, r9
cmp qword [rax + 0x18], 8
jb 0x14000357c
mov rdx, qword [rax]
mov r8, qword [rsp + 0x60]
mov rcx, r8
cmp r9, r8
cmovb rcx, r9
test rcx, rcx
je 0x1400035b5
movzx eax, word [rdi]
cmp word [rdx], ax
jne 0x1400035a7
add rdx, 2
add rdi, 2
dec rcx
jne 0x140003590
jmp 0x1400035b5
mov ecx, 1
cmp word [rdx], ax
cmovb ecx, r15d
jmp 0x1400035b8
mov ecx, r14d
movsxd rax, ecx
test ecx, ecx
jne 0x1400035d2
cmp r9, r8
jae 0x1400035c9
mov eax, r15d
jmp 0x1400035d2
mov eax, r14d
cmp r9, r8
setne al
test eax, eax
sete dil
cmp qword [rbp - 0x70], 8
jb 0x1400035f3
mov rcx, qword [rsp + 0x78]
call fcn.14000b834
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x50]
test dil, dil
jne 0x14000361e
cmp r10, 8
jb 0x140003606
mov rcx, r11
call fcn.14000b834
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
inc ebx
cmp ebx, dword [rsp + 0x28]
jae 0x140003666
jmp 0x1400034a0
mov ecx, ebx
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rcx*8]
mov r8, r13
mov rdx, r12
call fcn.140003370
movzx edi, al
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
nop
cmp qword [rsp + 0x68], 8
jb 0x140003660
mov rcx, qword [rsp + 0x50]
call fcn.14000b834
movzx eax, dil
jmp 0x140003673
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov al, 1
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140144d50
mov rbx, qword [rsp + 0x218]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret