Function at 0x405650
Capabilities:
Get logon sessions
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x440068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x420], 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x430], 0
push esi
push eax
mov dword [ebp - 0x428], 0
xor edi, edi
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x438], 0
call fcn.00417b20
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00417b20
add esp, 0x18
mov dword [0x440890], esi
cmp dword [0x440894], 8
mov eax, 0x440880
cmovae eax, dword [0x440880]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x18
push 0xffffffffffffffff
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x40570f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
jmp 0x40578f
mov ebx, dword [ebp - 0x424]
test ebx, ebx
je 0x4057a0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x428], eax
lea eax, [ebx + 0x82]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004010a0
lea eax, [ebx + 0x60]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004010a0
lea edi, [ebp - 0x20c]
add esp, 0x18
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x405760
sub edi, ecx
lea esi, [ebp - 0x414]
sar edi, 1
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x405780
sub esi, ecx
sar esi, 1
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x4057a0
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x428], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x434], 0
je 0x4057e2
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
je 0x4057e2
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
mov dword [ebp - 0x420], eax
xor eax, eax
mov dword [ebp - 0x41c], 0
xor ebx, ebx
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x42c], eax
jbe 0x4058cb
test eax, eax
jne 0x405896
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x434]
lea eax, [eax + ebx*8]
push eax
call dword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
jne 0x40587f
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x40587f
mov ecx, dword [ebp - 0x428]
cmp dword [eax + 0x28], ecx
jne 0x40587f
push edi
lea ecx, [ebp - 0x20c]
push ecx
push dword [eax + 0x10]
call fcn.0041f0f1
add esp, 0xc
test eax, eax
jne 0x40587f
push esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x18]
call fcn.0041f0f1
add esp, 0xc
test eax, eax
jne 0x40587f
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x418], eax
jmp 0x405885
mov eax, dword [ebp - 0x418]
inc ebx
cmp ebx, dword [ebp - 0x42c]
jb 0x405802
test eax, eax
je 0x4058cb
lea ecx, [ebp - 0x430]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov edx, dword [ebp - 0x430]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4058b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x440880
call fcn.00404280
mov eax, dword [ebp - 0x430]
pop edi
pop esi
pop ebx
test eax, eax
je 0x4058df
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x4058f0
push eax
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
xor ecx, ebp
call fcn.00415024
mov esp, ebp
pop ebp
ret