Function at 0x1400f7118
Capabilities:
Get logon sessions
Get session information

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor r14d, r14d
mov r13, rcx
test rcx, rcx
jne 0x1400f714a
mov eax, 0x80070057
jmp 0x1400f7395
mov qword [rcx], r14
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x48], r14d
mov qword [rbp - 0x20], r14
call qword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
mov esi, eax
test eax, eax
jle 0x1400f717a
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x1400f7384
mov rdi, r14
mov r15d, r14d
mov rbx, r14
mov r12d, r14d
cmp dword [rbp + 0x48], r14d
jbe 0x1400f737f
mov rax, qword [rbp - 0x20]
mov ecx, r12d
lea rcx, [rax + rcx*8]
cmp dword [rcx], 0x3e7
lea rax, [rcx + 4]
jne 0x1400f71ba
cmp dword [rax], r14d
je 0x1400f732a
jmp 0x1400f71c2
cmp dword [rcx], 0x3e5
je 0x1400f71ca
cmp dword [rcx], 0x3e4
jne 0x1400f71d3
cmp dword [rax], r14d
je 0x1400f732a
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x28], r14
call qword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
mov esi, eax
test eax, eax
jle 0x1400f71f8
movzx esi, ax
or esi, 0x80070000
mov rcx, qword [rbp - 0x28]
test esi, esi
js 0x1400f731f
cmp dword [rcx + 0x44], r14d
je 0x1400f7324
mov edx, dword [rcx + 0x40]
lea eax, [rdx - 2]
test eax, 0xfffffff5
jne 0x1400f7324
cmp edx, 0xc
je 0x1400f7324
mov rcx, qword [rcx + 0x48]
mov edx, 0x18
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x1400f731b
mov rcx, qword [rbp - 0x28]
lea edx, [rax + 0x17]
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x1400f731b
mov rcx, qword [rbp - 0x28]
lea edx, [rax + 0xc]
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x1400f731b
mov rax, qword [rbp - 0x28]
cmp word [rax + 0x20], 0x20
jne 0x1400f7298
mov rcx, qword [rax + 0x28]
lea rdx, str.Font_Driver_Host
call fcn.140005abc
test eax, eax
je 0x1400f731b
mov rax, qword [rbp - 0x28]
cmp word [rax + 0x20], 0x1c
jne 0x1400f72b7
mov rcx, qword [rax + 0x28]
lea rdx, str.Window_Manager
call fcn.140005abc
test eax, eax
je 0x1400f731b
mov rax, qword [rbp - 0x28]
lea rcx, [rbp + 0x60]
mov qword [rbp - 0x18], r14
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x18]
mov dword [rbp + 0x60], r14d
xor ecx, ecx
mov edx, dword [rax + 0x44]
mov r8d, 0x18
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x1400f731b
mov rcx, qword [rbp - 0x18]
mov r14d, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [rbp - 0x28]
cmp qword [rcx + 0x50], rdi
jle 0x1400f7310
test r14d, r14d
jne 0x1400f7310
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rcx + 0x50]
mov r15d, dword [rcx + 0x44]
mov eax, r12d
mov rbx, qword [rbx + rax*8]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
xor r14d, r14d
jmp 0x1400f732a
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400f732a
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
inc r12d
cmp r12d, dword [rbp + 0x48]
jb 0x1400f7198
test r15d, r15d
je 0x1400f737f
mov rdx, r13
mov ecx, r15d
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x1400f7361
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x1400f7361
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x1400f7384
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x1400f7371
mov dword [rax], r15d
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x1400f7384
mov qword [rax], rbx
jmp 0x1400f7384
mov esi, 0x80070490
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400f7393
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret