Function at 0x40ee60
Capabilities:
Get logon sessions
Print debug messages
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1278
call fcn.00410da0
mov eax, dword [0x441070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x1278], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1268], eax
lea eax, [ebp - 0x126c]
push edi
push eax
lea eax, [ebp - 0x1264]
mov dword [ebp - 0x1264], 0
push eax
mov dword [ebp - 0x126c], 0
mov dword [ebp - 0x1250], 0
mov dword [ebp - 0x1260], esi
mov dword [ebp - 0x1270], 1
mov dword [ebp - 0x1258], esi
mov dword [ebp - 0x1254], esi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40ef17
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409210
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
xor edi, edi
cmp dword [ebp - 0x1264], esi
jbe 0x40f246
nop word [eax + eax]
mov eax, dword [ebp - 0x126c]
test eax, eax
je 0x40f233
test esi, esi
jne 0x40f237
lea ecx, [ebp - 0x1250]
push ecx
lea eax, [eax + edi*8]
push eax
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
jne 0x40f1f4
mov eax, dword [ebp - 0x1250]
test eax, eax
je 0x40f1d0
cmp dword [eax + 0x2c], esi
je 0x40f19e
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x28], ecx
jne 0x40f19e
push dword [ebp - 0x1274]
push dword [eax + 0x10]
call fcn.0041deec
add esp, 8
test eax, eax
jne 0x40f198
mov eax, dword [ebp - 0x1250]
push dword [ebp - 0x1278]
push dword [eax + 0x18]
call fcn.0041deec
add esp, 8
test eax, eax
jne 0x40f198
push 0x410
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.00412cb0
add esp, 0xc
lea eax, [ebp - 0x1254]
push eax
mov eax, dword [ebp - 0x1250]
push dword [eax + 0x2c]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x40f16a
push dword [ebp - 0x1254]
lea eax, [ebp - 0x124c]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_s
push 0x208
push eax
call fcn.00409210
mov eax, dword [ebp - 0x1254]
add esp, 0x10
test eax, eax
je 0x40f01b
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x125c]
mov dword [ebp - 0x1254], 0
push eax
push 1
push 0
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x1258], 0x208
push eax
push 0x80000002
mov dword [ebp - 0x125c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f0d4
lea eax, [ebp - 0x1258]
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x1270]
push eax
push 0
push str.ProfileImagePath
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1270]
cmp eax, 2
je 0x40f092
cmp eax, 1
jne 0x40f0c8
push 0x104
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
mov dword [ebp - 0x1258], eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.0041f88e
add esp, 0xc
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc34]
push eax
push edi
push str.GetSidFromEnumSess__:_ProfileImagePath__d____s_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409210
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
lea eax, [ebp - 0xc34]
push 0x5c
push eax
call fcn.00412e0a
mov edx, eax
add esp, 8
test edx, edx
je 0x40f226
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f120
sub ecx, esi
sar ecx, 1
cmp ecx, 1
jbe 0x40f137
add edx, 2
test edx, edx
je 0x40f220
push dword [ebp - 0x1274]
push edx
call fcn.0041deec
add esp, 8
test eax, eax
jne 0x40f220
mov eax, dword [ebp - 0x1250]
mov esi, dword [eax + 0x2c]
mov dword [ebp - 0x1260], esi
jmp 0x40f226
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSidFromEnumSess__:_ConvertSidToStringSid___err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409210
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f226
mov eax, dword [ebp - 0x1250]
test eax, eax
je 0x40f1d0
push dword [eax + 0x28]
push dword [eax + 0x18]
push dword [eax + 0x10]
lea eax, [ebp - 0x824]
push edi
push str.GetSidFromEnumSess__:_i___d_:_szUserName___s__szDomain___s__dwSessionId___d_n
push 0x410
push eax
call fcn.00409210
add esp, 0x1c
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f226
push str.GetSidFromEnumSess__:_lpSessionData__NULL._n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409210
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f226
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push edi
push str.GetSidFromEnumSess__:_LsaGetLogonSessionData__i__err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00409210
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f226
mov esi, dword [ebp - 0x1260]
inc edi
cmp edi, dword [ebp - 0x1264]
jb 0x40ef30
test esi, esi
je 0x40f246
mov edi, dword [ebp - 0x1268]
push edi
push esi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
jmp 0x40f24c
mov edi, dword [ebp - 0x1268]
push dword [edi]
lea eax, [ebp - 0x824]
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___lpszSid___s_n
push 0x410
push eax
call fcn.00409210
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00410abf
mov esp, ebp
pop ebp
ret