Function at 0x1800015d0
Capabilities:
Get logon sessions

Disassembly:
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xc8
mov rax, qword [0x180018008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rcx, qword [0x180019ba0]
xor esi, esi
mov r14, qword [0x180019cb0]
mov dword [rbp - 0x69], esi
mov qword [rbp - 0x59], rsi
test rcx, rcx
je 0x180001645
mov ebx, esi
cmp dword [rcx], esi
jbe 0x18000163d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rcx + 8]
mov eax, ebx
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ProcessHacker.exe_PhFree]
mov rcx, qword [0x180019ba0]
inc ebx
cmp ebx, dword [rcx]
jb 0x180001620
call qword [sym.imp.ProcessHacker.exe_PhClearList]
jmp 0x180001657
mov ecx, 0x28
call qword [sym.imp.ProcessHacker.exe_PhCreateList]
mov qword [0x180019ba0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call qword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
js 0x180001839
cmp dword [rbp - 0x69], esi
jbe 0x18000182f
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xc0], r15
nop word [rax + rax]
mov rax, qword [rbp - 0x59]
lea rdx, [rbp - 0x61]
mov ecx, esi
lea rcx, [rax + rcx*8]
call qword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
js 0x180001804
mov rcx, qword [rbp - 0x61]
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.ntdll.dll_RtlValidSid]
test al, al
je 0x1800017c8
mov rcx, qword [rbp - 0x61]
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov edi, eax
mov rax, qword [rbp - 0x61]
mov ecx, edi
mov rbx, qword [rax + 0x48]
call qword [sym.imp.ProcessHacker.exe_PhAllocate]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
mov r15, rax
call fcn.180004580
mov rcx, qword [0x180019ba0]
mov rdx, r15
call qword [sym.imp.ProcessHacker.exe_PhAddItemList]
mov rcx, qword [rbp - 0x61]
lea rdx, [rbp - 0x45]
mov r8d, 0x10
mov ecx, dword [rcx + 4]
mov dword [rbp - 0x49], 0x780030
call fcn.180004e24
mov r9, r15
lea r8, [rbp - 0x49]
mov edx, 0x7fffffff
mov rcx, r14
call qword [sym.imp.ProcessHacker.exe_PhAddListViewItem]
xor r8d, r8d
mov dl, 1
mov rcx, r15
mov ebx, eax
call qword [sym.imp.ProcessHacker.exe_PhGetSidFullName]
mov rcx, rax
call qword [sym.imp.ProcessHacker.exe_PhAutoDereferenceObject]
test rax, rax
je 0x180001779
mov r9, qword [rax + 8]
jmp 0x180001780
lea r9, str._unknown_
mov r8d, 1
mov edx, ebx
mov rcx, r14
call qword [sym.imp.ProcessHacker.exe_PhSetListViewSubItem]
mov rcx, r15
call qword [sym.imp.ProcessHacker.exe_PhSidToStringSid]
mov rcx, rax
call qword [sym.imp.ProcessHacker.exe_PhAutoDereferenceObject]
test rax, rax
je 0x1800017ae
mov r9, qword [rax + 8]
jmp 0x1800017b5
lea r9, str._unknown_
mov r8d, 2
mov edx, ebx
mov rcx, r14
call qword [sym.imp.ProcessHacker.exe_PhSetListViewSubItem]
jmp 0x1800017fa
mov rax, qword [rbp - 0x61]
lea rdx, [rbp - 0x45]
mov r8d, 0x10
mov ecx, dword [rax + 4]
mov dword [rbp - 0x49], 0x780030
call fcn.180004e24
xor r9d, r9d
lea r8, [rbp - 0x49]
mov edx, 0x7fffffff
mov rcx, r14
call qword [sym.imp.ProcessHacker.exe_PhAddListViewItem]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
inc esi
cmp esi, dword [rbp - 0x69]
jb 0x1800016b0
mov r15, qword [rsp + 0xc0]
mov r13, qword [rsp + 0x100]
mov r12, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180002ff0
add rsp, 0xc8
pop r14
pop rsi
pop rbx
pop rbp
ret