Function at 0x1400869b0
Capabilities:
Get logon sessions
List user accounts

Disassembly:
push rbp
sub rsp, 0x5c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x538], 0xfffffffffffffffe
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rcx
mov byte [rbp + 0x4eb], 0
mov byte [rbp + 0x4ea], 0
mov byte [rbp + 0x4e9], 0
mov byte [rbp + 0x4e8], 0
mov byte [rbp + 0x4eb], 1
lea rcx, [rbp + 0xd0]
call fcn.14006c330
mov dword [rbp + 0xec], 0
call fcn.1400864c0
mov qword [rbp + 0xb8], rax
jmp 0x140086a20
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xf8], 0
mov dword [rbp + 0xfc], 0
mov qword [rbp + 0x528], 0
mov qword [rbp + 0x530], 0
lea rcx, [rbp + 0xf0]
call fcn.1400865e0
mov qword [rbp + 0xb0], rax
jmp 0x140086a6d
mov r9, qword [rbp + 0xb0]
mov rax, rsp
lea rcx, [rbp + 0xec]
mov qword [rax + 0x38], rcx
lea rcx, [rbp + 0xfc]
mov qword [rax + 0x30], rcx
lea rcx, [rbp + 0xf8]
mov qword [rax + 0x28], rcx
mov dword [rax + 0x20], 0xffffffff
xor edx, edx
mov ecx, edx
mov r8d, 2
call sub.netapi32.dll_NetUserEnum
mov dword [rbp + 0xac], eax
jmp 0x140086ab6
mov eax, dword [rbp + 0xac]
mov dword [rbp + 0x4ec], eax
cmp eax, 0
je 0x140086ad4
mov eax, dword [rbp + 0xac]
cmp eax, 0xea
jne 0x140086af8
mov rcx, qword [rbp + 0xf0]
mov eax, dword [rbp + 0xf8]
mov edx, eax
call fcn.14007a6d0
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], rax
jmp 0x140086b0e
mov eax, dword [rbp + 0xac]
cmp eax, 0xea
jne 0x140086bca
jmp 0x140086bb9
mov rdx, qword [rbp + 0x98]
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x4f0], rcx
mov qword [rbp + 0x4f8], rdx
call fcn.140053490
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], rax
jmp 0x140086b3f
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x100]
call fcn.14007ded0
mov qword [rbp + 0x80], rax
jmp 0x140086b70
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
cmp rax, 0
sete al
test al, 1
jne 0x140086af8
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov rcx, qword [rax]
call fcn.1400559d0
mov byte [rbp + 0x7f], al
jmp 0x140086fe5
lea rcx, [rbp + 0xf0]
call fcn.140063070
jmp 0x140086a12
lea rcx, [rbp + 0xf0]
call fcn.140063070
jmp 0x140086bd8
mov dword [rbp + 0x254], 0
call fcn.1400866a0
mov qword [rbp + 0x70], rax
jmp 0x140086bed
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x258]
call fcn.1400866e0
mov qword [rbp + 0x68], rax
jmp 0x140086c0a
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x254]
call sub.secur32.dll_LsaEnumerateLogonSessions
mov dword [rbp + 0x64], eax
jmp 0x140086c1f
mov eax, dword [rbp + 0x64]
cmp eax, 0
jne 0x140086c45
mov rcx, qword [rbp + 0x258]
mov eax, dword [rbp + 0x254]
mov edx, eax
call fcn.14007a910
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x58], rax
jmp 0x140086c79
mov rax, qword [rbp + 0xc0]
mov byte [rbp + 0x4eb], 0
mov rcx, qword [rbp + 0xe0]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x258]
call fcn.140062e90
jmp 0x140086fce
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x500], rcx
mov qword [rbp + 0x508], rdx
call fcn.14005ac50
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rax
jmp 0x140086c9e
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x260], rcx
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x260]
call fcn.14007e700
mov qword [rbp + 0x38], rax
jmp 0x140086cc6
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
cmp rax, 0
sete al
test al, 1
jne 0x140086c45
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x510], rax
call fcn.1400866c0
mov qword [rbp + 0x30], rax
jmp 0x140086d04
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 0x278]
call fcn.140086720
mov qword [rbp + 0x20], rax
jmp 0x140086d21
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
call sub.secur32.dll_LsaGetLogonSessionData
mov dword [rbp + 0x1c], eax
jmp 0x140086d33
mov eax, dword [rbp + 0x1c]
cmp eax, 0
je 0x140086d4c
lea rcx, [rbp + 0x278]
call fcn.140060230
jmp 0x140086cb4
mov rcx, qword [rbp + 0x278]
call fcn.14006a7e0
mov byte [rbp + 0x1b], al
jmp 0x140086d5d
mov al, byte [rbp + 0x1b]
test al, 1
jne 0x140086d3b
jmp 0x140086d66
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x10], rax
and rax, 7
cmp rax, 0
jne 0x140086d9c
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x280]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x2c0], 3
je 0x140086dc6
jmp 0x140086db1
mov rdx, qword [rbp + 0x10]
lea r8, [0x14012b5c8]
mov ecx, 8
call fcn.1400eb1f0
mov rdx, qword [rbp + 0x2c8]
lea rcx, [rbp + 0x3a8]
call fcn.140057780
jmp 0x140086dd7
lea rcx, [rbp + 0x278]
call fcn.140060230
jmp 0x140086cb4
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x3a8], rax
sete al
test al, 1
jne 0x140086df1
jmp 0x140086dfa
mov byte [rbp + 0x4e9], 0
jmp 0x140086dc6
mov rax, qword [rbp + 0x3b8]
mov qword [rbp + 0x3d0], rax
movups xmm0, xmmword [rbp + 0x3a8]
movaps xmmword [rbp + 0x3c0], xmm0
mov byte [rbp + 0x4e9], 1
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3a0], rax
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmmword [rbp + 0x390], xmm0
lea rcx, [rbp + 0xd0]
call fcn.14006ee20
mov qword [rbp], rdx
mov qword [rbp + 8], rax
jmp 0x140086e4f
mov rdx, qword [rbp]
mov rcx, qword [rbp + 8]
call fcn.1400533d0
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rax
jmp 0x140086e66
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], rax
lea rcx, [rbp + 0x3e0]
lea rdx, [rbp + 0x390]
call fcn.14007d760
mov byte [rbp - 0x11], al
jmp 0x140086e94
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140086eb2
jmp 0x140086e9d
lea rcx, [rbp + 0x408]
lea rdx, [rbp + 0x390]
call fcn.1400579a0
jmp 0x140086ec3
lea rcx, [rbp + 0x390]
call fcn.1400617f0
jmp 0x140086df1
lea r9, [0x14012b5e0]
lea rcx, [rbp + 0x3f0]
lea rdx, [rbp + 0x408]
lea r8, [rbp + 0x280]
call fcn.14007ac40
jmp 0x140086ee6
mov byte [rbp + 0x4e9], 0
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x4a0], rax
movaps xmm0, xmmword [rbp + 0x390]
movaps xmmword [rbp + 0x490], xmm0
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x480], rax
movaps xmm0, xmmword [rbp + 0x490]
movaps xmmword [rbp + 0x470], xmm0
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x4c0], rax
movups xmm0, xmmword [rbp + 0x3f0]
movaps xmmword [rbp + 0x4b0], xmm0
lea rcx, [rbp + 0x4d0]
call fcn.14006c2d0
jmp 0x140086f4f
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x430], rax
movaps xmm0, xmmword [rbp + 0x470]
movaps xmmword [rbp + 0x420], xmm0
mov dword [rbp + 0x468], 0
mov rax, qword [rbp + 0x4c0]
mov qword [rbp + 0x448], rax
movaps xmm0, xmmword [rbp + 0x4b0]
movups xmmword [rbp + 0x438], xmm0
mov rax, qword [rbp + 0x4e0]
mov qword [rbp + 0x460], rax
movups xmm0, xmmword [rbp + 0x4d0]
movups xmmword [rbp + 0x450], xmm0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x420]
call fcn.14006d2d0
jmp 0x140086fc2
mov byte [rbp + 0x4e9], 0
jmp 0x140086d3b
mov rax, qword [rbp + 0xc8]
mov byte [rbp + 0x4eb], 0
add rsp, 0x5c0
pop rbp
ret
mov al, byte [rbp + 0x7f]
test al, 1
jne 0x140086b5b
jmp 0x140086ff2
call fcn.140086500
mov qword [rbp - 0x20], rax
jmp 0x140086ffd
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x518], 0
mov qword [rbp + 0x520], 0
mov rax, qword [rbp + 0x118]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x120]
call fcn.140086600
mov qword [rbp - 0x28], rax
jmp 0x14008703e
mov r9, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
xor eax, eax
mov ecx, eax
mov r8d, 0x17
call sub.netapi32.dll_NetUserGetInfo
mov dword [rbp - 0x34], eax
jmp 0x14008705a
mov eax, dword [rbp - 0x34]
cmp eax, 0
je 0x140087073
lea rcx, [rbp + 0x120]
call fcn.140060150
jmp 0x140086b5b
mov rax, qword [rbp + 0x120]
mov qword [rbp - 0x40], rax
and rax, 7
cmp rax, 0
jne 0x14008709e
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax + 0x20]
lea rcx, [rbp + 0x128]
call fcn.140057780
jmp 0x1400870b3
mov rdx, qword [rbp - 0x40]
lea r8, [0x14012b5f8]
mov ecx, 8
call fcn.1400eb1f0
mov byte [rbp + 0x4e8], 1
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x128], rdx
cmove rax, rcx
cmp rax, 1
jne 0x14008711b
mov byte [rbp + 0x4e8], 0
mov byte [rbp + 0x4ea], 1
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x150], rax
movups xmm0, xmmword [rbp + 0x128]
movaps xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0x178]
lea rdx, [rbp + 0x140]
call fcn.1400579a0
jmp 0x140087146
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x128], rdx
cmove rax, rcx
cmp rax, 1
je 0x14008725b
jmp 0x140087264
lea r9, [0x14012b610]
lea rcx, [rbp + 0x160]
lea rdx, [rbp + 0x178]
lea r8, [rbp + 0x118]
call fcn.14007aba0
jmp 0x140087169
mov byte [rbp + 0x4ea], 0
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x210], rax
movaps xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x200], xmm0
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x1f0], rax
movaps xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0x1e0], xmm0
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x230], rax
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x220], xmm0
mov rax, qword [rbp + 0x118]
mov rdx, qword [rax]
lea rcx, [rbp + 0x238]
call fcn.140086760
jmp 0x1400871dc
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1a0], rax
movaps xmm0, xmmword [rbp + 0x1e0]
movaps xmmword [rbp + 0x190], xmm0
mov dword [rbp + 0x1d8], 0
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x1b8], rax
movaps xmm0, xmmword [rbp + 0x220]
movups xmmword [rbp + 0x1a8], xmm0
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x1d0], rax
movups xmm0, xmmword [rbp + 0x238]
movups xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x190]
call fcn.14006d2d0
jmp 0x14008724f
mov byte [rbp + 0x4ea], 0
jmp 0x14008711b
test byte [rbp + 0x4e8], 1
jne 0x140087270
mov byte [rbp + 0x4e8], 0
jmp 0x140087062
lea rcx, [rbp + 0x128]
call fcn.1400617f0
jmp 0x140087264