Function at 0x180013ba4
Capabilities:
Get logon sessions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x180035478]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
mov qword [rsp + 0x48], rdx
mov r12, rcx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x24]
mov r14, r8
mov dil, 1
call qword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
xor ebx, ebx
test eax, eax
js 0x180013fb9
mov r13d, ebx
mov dword [rsp + 0x20], ebx
cmp dword [rsp + 0x24], ebx
jbe 0x180013fac
mov r15d, ebx
mov qword [rsp + 0x38], rbx
lea esi, [rbx + 7]
test dil, dil
je 0x180013fac
mov rax, qword [rsp + 0x28]
mov ecx, r13d
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rcx
lea rcx, [rax + rcx*8]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
js 0x180013f50
mov rcx, qword [rsp + 0x30]
cmp dword [rcx + 0x40], 3
je 0x180013f48
lea rcx, [rbp - 0x80]
call fcn.1800053dc
mov rax, qword [rsp + 0x30]
lea rcx, [rbp - 0x80]
mov edx, 0xa
movups xmm0, xmmword [rax + 0x20]
movups xmm1, xmmword [rax + 0x10]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax + 0x30]
movdqu xmmword [rsp + 0x50], xmm0
call fcn.18000836c
lea rcx, [rbp - 0x80]
call fcn.18000361c
mov rbx, qword [rsp + 0x28]
lea rdx, str.Authentification_Id_________:
lea rcx, [rbp - 0x80]
call fcn.180007278
mov edx, dword [r15 + rbx + 4]
mov rcx, rax
call fcn.1800081c4
lea rdx, [0x18002dc9c]
mov rcx, rax
call fcn.180007278
mov edx, dword [r15 + rbx]
mov rcx, rax
call fcn.180005234
mov edx, 0xa
mov rcx, rax
mov rdi, rax
call fcn.18000836c
mov rcx, rdi
call fcn.18000361c
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1b0]
call fcn.180008190
lea rdx, str.Package_dauthentification__:
mov rcx, rdi
mov rbx, rax
call fcn.180007278
mov rdx, rbx
mov rcx, rax
call fcn.18000bcd8
mov edx, 0xa
mov rcx, rax
mov rdi, rax
call fcn.18000836c
mov rcx, rdi
call fcn.18000361c
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.180008190
lea rdx, str.Utilisateur_principal_______:
mov rcx, rdi
mov rbx, rax
call fcn.180007278
mov rdx, rbx
mov rcx, rax
call fcn.18000bcd8
mov edx, 0xa
mov rcx, rax
mov rdi, rax
call fcn.18000836c
mov rcx, rdi
call fcn.18000361c
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x188]
call fcn.180008190
lea rdx, str.Domaine_dauthentification__:
mov rcx, rdi
mov rbx, rax
call fcn.180007278
mov rdx, rbx
mov rcx, rax
call fcn.18000bcd8
mov edx, 0xa
mov rcx, rax
mov rbx, rax
call fcn.18000836c
mov rcx, rbx
call fcn.18000361c
cmp qword [rbp + 0x1c8], 8
jb 0x180013dd9
mov rcx, qword [rbp + 0x1b0]
call fcn.180015b04
xor ebx, ebx
cmp qword [rbp + 0x178], 8
mov qword [rbp + 0x1c8], rsi
mov qword [rbp + 0x1c0], rbx
mov word [rbp + 0x1b0], bx
jb 0x180013e06
mov rcx, qword [rbp + 0x160]
call fcn.180015b04
cmp qword [rbp + 0x1a0], 8
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x170], rbx
mov word [rbp + 0x160], bx
jb 0x180013e31
mov rcx, qword [rbp + 0x188]
call fcn.180015b04
lea rdx, [rbp + 0x188]
lea rcx, [rbp - 0x78]
call fcn.1800054a8
lea rdx, [rbp + 0x188]
mov rcx, r12
call fcn.1800015e4
mov rbx, qword [r14]
mov dil, al
cmp rbx, qword [r14 + 8]
je 0x180013f38
mov r13, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
lea rcx, [rbp + 0x70]
call fcn.1800053dc
lea rcx, [rbp + 0x70]
mov edx, 9
lea rdi, [rbx + 8]
call fcn.1800074ec
mov rdx, rdi
mov rcx, rax
call fcn.18000bcd8
lea rdx, str._:__t
mov rcx, rax
call fcn.180007278
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x78]
call fcn.1800054a8
lea rdx, [rbp + 0x188]
mov rcx, r12
call fcn.1800015e4
mov r11, qword [r15 + 8]
mov rax, qword [rsp + 0x28]
cmp qword [r15], r11
lea rcx, [rax + r13*8]
mov rdx, r12
sete r8b
call qword [rbx]
xor eax, eax
lea rdx, [0x18002cde4]
lea rcx, [rbp + 0x160]
lea r8d, [rax + 1]
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x170], rax
mov word [rbp + 0x160], ax
call fcn.180001e20
lea rdx, [rbp + 0x160]
mov rcx, r12
call fcn.1800015e4
lea rcx, [rbp + 0x70]
mov dil, al
call fcn.1800051c8
add rbx, 0x30
cmp rbx, qword [r14 + 8]
jne 0x180013e6a
mov r13d, dword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.1800051c8
mov rcx, qword [rsp + 0x30]
xor ebx, ebx
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
jmp 0x180013f90
lea rdx, str.Erreur_:_Impossible_dobtenir_les_donn
lea rcx, [rbp + 0x160]
mov r8d, 0x35
mov qword [rbp + 0x178], rsi
mov qword [rbp + 0x170], rbx
mov word [rbp + 0x160], bx
call fcn.180001e20
lea rdx, [rbp + 0x160]
mov rcx, r12
call fcn.1800015e4
mov dil, al
inc r13d
add r15, 8
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x38], r15
cmp r13d, dword [rsp + 0x24]
jb 0x180013c18
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
jmp 0x180013ffc
mov esi, 7
lea rdx, str.Erreur_:_Impossible_d
lea rcx, [rbp + 0x160]
lea r8d, [rsi + 0x2f]
mov qword [rbp + 0x170], rbx
mov word [rbp + 0x160], bx
mov qword [rbp + 0x178], rsi
call fcn.180001e20
lea rdx, [rbp + 0x160]
mov rcx, r12
call fcn.1800015e4
mov dil, al
mov al, dil
mov rcx, qword [rbp + 0x1d8]
xor rcx, rsp
call fcn.1800155b0
mov rbx, qword [rsp + 0x338]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret