Function at 0x40ee70
Capabilities:
Get logon sessions
Print debug messages

Disassembly:
mov eax, 0x106c
call fcn.00416800
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x1068], eax
mov eax, dword [esp + 0x1074]
push ebx
push ebp
push esi
push edi
mov ebx, edx
xor edi, edi
lea edx, [esp + 0x24]
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x3c], 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], edi
call sub.Secur32.dll_LsaEnumerateLogonSessions
cmp eax, edi
je 0x40ef03
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push 0x4303c0
lea ecx, [esp + 0x40]
push 0x410
push ecx
call fcn.004142eb
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0x10
lea edx, [esp + 0x38]
push edx
call esi
jmp 0x40ef09
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor ebp, ebp
cmp dword [esp + 0x18], edi
jbe 0x40f17d
jmp 0x40ef20
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40f0b4
test edi, edi
jne 0x40f0bc
lea ecx, [esp + 0x10]
push ecx
lea edx, [eax + ebp*8]
push edx
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
jne 0x40f14e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40f12b
cmp dword [eax + 0x2c], edi
je 0x40f0f7
mov ecx, dword [esp + 0x1080]
cmp dword [eax + 0x28], ecx
jne 0x40f0f7
mov edx, dword [esp + 0x20]
mov eax, dword [eax + 0x10]
push edx
push eax
call fcn.0041441a
add esp, 8
test eax, eax
jne 0x40f0f3
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x18]
push ecx
push eax
call fcn.0041441a
add esp, 8
test eax, eax
jne 0x40f0f3
push 0x410
push eax
lea ecx, [esp + 0x860]
push ecx
call fcn.00411440
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x2c]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push ecx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x40f0cc
mov edx, dword [esp + 0x14]
push edx
push 0x430438
lea eax, [esp + 0xc70]
push 0x208
push eax
call fcn.004142eb
mov eax, dword [esp + 0x24]
add esp, 0x10
test eax, eax
je 0x40f003
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0xc68]
push ecx
lea ecx, [esp + 0x38]
lea ebx, [esp + 0x2c]
lea edi, [esp + 0x85c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x2c], 0x208
call fcn.0040edc0
mov edx, edi
push edx
push ebp
push 0x4304d8
lea eax, [esp + 0x48]
push 0x410
push eax
call fcn.004142eb
add esp, 0x18
lea ecx, [esp + 0x38]
push ecx
call esi
mov edx, edi
push 0x5c
push edx
call fcn.00416899
add esp, 8
test eax, eax
je 0x40f0a5
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40f067
sub ecx, esi
sar ecx, 1
cmp ecx, 1
jbe 0x40f07e
add eax, 2
test eax, eax
je 0x40f09f
mov ecx, dword [esp + 0x20]
push ecx
push eax
call fcn.0041441a
add esp, 8
test eax, eax
jne 0x40f09f
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x2c]
mov dword [esp + 0x1c], eax
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [esp + 0x1c]
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x40ef20
test edi, edi
je 0x40f179
mov ebx, dword [esp + 0x2c]
push ebx
push edi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
jmp 0x40f17d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430540
lea ecx, [esp + 0x40]
push 0x410
push ecx
call fcn.004142eb
add esp, 0x10
lea edx, [esp + 0x38]
push edx
call esi
jmp 0x40f0a5
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40f12b
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x10]
push ecx
push edx
push eax
push ebp
push 0x4305b0
lea ecx, [esp + 0x4c]
push 0x410
push ecx
call fcn.004142eb
add esp, 0x1c
lea eax, [esp + 0x38]
push eax
call esi
jmp 0x40f0a5
push 0x430658
lea edx, [esp + 0x3c]
push 0x410
push edx
call fcn.004142eb
add esp, 0xc
lea eax, [esp + 0x38]
push eax
call esi
jmp 0x40f0a5
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push ebp
push 0x4306b8
lea ecx, [esp + 0x44]
push 0x410
push ecx
call fcn.004142eb
add esp, 0x14
lea edx, [esp + 0x38]
push edx
call esi
jmp 0x40f0a5
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx]
push eax
push 0x430730
lea ecx, [esp + 0x40]
push 0x410
push ecx
call fcn.004142eb
add esp, 0x10
lea edx, [esp + 0x38]
push edx
call esi
mov ecx, dword [esp + 0x1078]
pop edi
xor eax, eax
cmp dword [ebx], eax
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.00411220
add esp, 0x106c
ret