Function at 0x410420
Capabilities:
Get logon sessions
Print debug messages
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1278
call fcn.00412e10
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x1278], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1268], eax
lea eax, [ebp - 0x126c]
push edi
push eax
lea eax, [ebp - 0x1264]
mov dword [ebp - 0x1264], 0
push eax
mov dword [ebp - 0x126c], 0
mov dword [ebp - 0x1250], 0
mov dword [ebp - 0x1260], esi
mov dword [ebp - 0x1270], 1
mov dword [ebp - 0x1258], esi
mov dword [ebp - 0x1254], esi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x4104d7
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.004092a0
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
xor edi, edi
cmp dword [ebp - 0x1264], esi
jbe 0x410806
nop word [eax + eax]
mov eax, dword [ebp - 0x126c]
test eax, eax
je 0x4107f3
test esi, esi
jne 0x4107f7
lea ecx, [ebp - 0x1250]
push ecx
lea eax, [eax + edi*8]
push eax
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
jne 0x4107b4
mov eax, dword [ebp - 0x1250]
test eax, eax
je 0x410790
cmp dword [eax + 0x2c], esi
je 0x41075e
mov ecx, dword [ebp + 8]
cmp dword [eax + 0x28], ecx
jne 0x41075e
push dword [ebp - 0x1274]
push dword [eax + 0x10]
call fcn.00420a4c
add esp, 8
test eax, eax
jne 0x410758
mov eax, dword [ebp - 0x1250]
push dword [ebp - 0x1278]
push dword [eax + 0x18]
call fcn.00420a4c
add esp, 8
test eax, eax
jne 0x410758
push 0x410
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.00414fa0
add esp, 0xc
lea eax, [ebp - 0x1254]
push eax
mov eax, dword [ebp - 0x1250]
push dword [eax + 0x2c]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x41072a
push dword [ebp - 0x1254]
lea eax, [ebp - 0x124c]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_s
push 0x208
push eax
call fcn.004092a0
mov eax, dword [ebp - 0x1254]
add esp, 0x10
test eax, eax
je 0x4105db
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x125c]
mov dword [ebp - 0x1254], 0
push eax
push 1
push 0
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x1258], 0x208
push eax
push 0x80000002
mov dword [ebp - 0x125c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410694
lea eax, [ebp - 0x1258]
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x1270]
push eax
push 0
push str.ProfileImagePath
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1270]
cmp eax, 2
je 0x410652
cmp eax, 1
jne 0x410688
push 0x104
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
mov dword [ebp - 0x1258], eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.004223fe
add esp, 0xc
push dword [ebp - 0x125c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc34]
push eax
push edi
push str.GetSidFromEnumSess__:_ProfileImagePath__d____s_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.004092a0
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
lea eax, [ebp - 0xc34]
push 0x5c
push eax
call fcn.004150fa
mov edx, eax
add esp, 8
test edx, edx
je 0x4107e6
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4106e0
sub ecx, esi
sar ecx, 1
cmp ecx, 1
jbe 0x4106f7
add edx, 2
test edx, edx
je 0x4107e0
push dword [ebp - 0x1274]
push edx
call fcn.00420a4c
add esp, 8
test eax, eax
jne 0x4107e0
mov eax, dword [ebp - 0x1250]
mov esi, dword [eax + 0x2c]
mov dword [ebp - 0x1260], esi
jmp 0x4107e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSidFromEnumSess__:_ConvertSidToStringSid___err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.004092a0
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x4107e6
mov eax, dword [ebp - 0x1250]
test eax, eax
je 0x410790
push dword [eax + 0x28]
push dword [eax + 0x18]
push dword [eax + 0x10]
lea eax, [ebp - 0x824]
push edi
push str.GetSidFromEnumSess__:_i___d_:_szUserName___s__szDomain___s__dwSessionId___d_n
push 0x410
push eax
call fcn.004092a0
add esp, 0x1c
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x4107e6
push str.GetSidFromEnumSess__:_lpSessionData__NULL._n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.004092a0
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x4107e6
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
push eax
push edi
push str.GetSidFromEnumSess__:_LsaGetLogonSessionData__i__err___d_n
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.004092a0
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x4107e6
mov esi, dword [ebp - 0x1260]
inc edi
cmp edi, dword [ebp - 0x1264]
jb 0x4104f0
test esi, esi
je 0x410806
mov edi, dword [ebp - 0x1268]
push edi
push esi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
jmp 0x41080c
mov edi, dword [ebp - 0x1268]
push dword [edi]
lea eax, [ebp - 0x824]
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___lpszSid___s_n
push 0x410
push eax
call fcn.004092a0
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00412b32
mov esp, ebp
pop ebp
ret