Function at 0x140014de0
Capabilities:
Get logon sessions
List user accounts

Disassembly:
push rbp
sub rsp, 0x600
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x578], 0xfffffffffffffffe
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rcx
mov byte [rbp + 0x50b], 0
mov byte [rbp + 0x50a], 0
mov byte [rbp + 0x509], 0
mov byte [rbp + 0x508], 0
mov byte [rbp + 0x50b], 1
lea rcx, [rbp + 0xe0]
call fcn.140020900
mov dword [rbp + 0xfc], 0
call fcn.140014840
mov qword [rbp + 0xc8], rax
jmp 0x140014e50
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], 0
mov dword [rbp + 0x10c], 0
mov qword [rbp + 0x558], 0
mov qword [rbp + 0x560], 0
mov qword [rbp + 0x570], 0
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x568], rax
mov rax, qword [rbp + 0x568]
mov qword [rbp + 0xb8], rax
lea rcx, [rbp + 0x100]
call fcn.1400149e0
mov qword [rbp + 0xc0], rax
jmp 0x140014ec4
mov r9, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0xb8]
mov rax, rsp
lea rdx, [rbp + 0xfc]
mov qword [rax + 0x38], rdx
lea rdx, [rbp + 0x10c]
mov qword [rax + 0x30], rdx
lea rdx, [rbp + 0x108]
mov qword [rax + 0x28], rdx
mov dword [rax + 0x20], 0xffffffff
xor edx, edx
mov r8d, 2
call sub.NETAPI32.dll_NetUserEnum
mov dword [rbp + 0xb4], eax
jmp 0x140014f12
mov eax, dword [rbp + 0xb4]
mov dword [rbp + 0x50c], eax
cmp eax, 0
je 0x140014f30
mov eax, dword [rbp + 0xb4]
cmp eax, 0xea
jne 0x140014f54
mov rcx, qword [rbp + 0x100]
mov eax, dword [rbp + 0x108]
mov edx, eax
call fcn.140045080
mov qword [rbp + 0xa0], rdx
mov qword [rbp + 0xa8], rax
jmp 0x140014f6a
mov eax, dword [rbp + 0xb4]
cmp eax, 0xea
jne 0x140015029
jmp 0x140015018
mov rdx, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0xa8]
mov qword [rbp + 0x510], rcx
mov qword [rbp + 0x518], rdx
call fcn.1400172b0
mov qword [rbp + 0x90], rdx
mov qword [rbp + 0x98], rax
jmp 0x140014f9b
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x98]
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x110]
call fcn.14000af10
mov qword [rbp + 0x88], rax
jmp 0x140014fcc
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
cmp rax, 0
sete al
test al, 1
jne 0x140014f54
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov rcx, qword [rax]
call fcn.14003a9f0
mov byte [rbp + 0x87], al
jmp 0x140015468
lea rcx, [rbp + 0x100]
call fcn.140010440
jmp 0x140014e42
lea rcx, [rbp + 0x100]
call fcn.140010440
jmp 0x140015037
mov dword [rbp + 0x264], 0
call fcn.140014ad0
mov qword [rbp + 0x78], rax
jmp 0x14001504c
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x268]
call fcn.140014b10
mov qword [rbp + 0x70], rax
jmp 0x140015069
mov rdx, qword [rbp + 0x70]
lea rcx, [rbp + 0x264]
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov dword [rbp + 0x6c], eax
jmp 0x14001507e
mov eax, dword [rbp + 0x6c]
cmp eax, 0
jne 0x1400150a4
mov rcx, qword [rbp + 0x268]
mov eax, dword [rbp + 0x264]
mov edx, eax
call fcn.140045180
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], rax
jmp 0x1400150d8
mov rax, qword [rbp + 0xd0]
mov byte [rbp + 0x50b], 0
mov rcx, qword [rbp + 0xf0]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x268]
call fcn.140010260
jmp 0x140015451
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x520], rcx
mov qword [rbp + 0x528], rdx
call fcn.140008210
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], rax
jmp 0x1400150fd
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov qword [rbp + 0x270], rcx
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 0x270]
call fcn.14000bef0
mov qword [rbp + 0x40], rax
jmp 0x140015125
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x280]
cmp rax, 0
sete al
test al, 1
jne 0x1400150a4
mov rax, qword [rbp + 0x280]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x530], rax
call fcn.140014a90
mov qword [rbp + 0x38], rax
jmp 0x140015163
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x288], rax
lea rcx, [rbp + 0x288]
call fcn.140014b50
mov qword [rbp + 0x28], rax
jmp 0x140015180
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
call sub.Secur32.dll_LsaGetLogonSessionData
mov dword [rbp + 0x24], eax
jmp 0x140015192
mov eax, dword [rbp + 0x24]
cmp eax, 0
je 0x1400151ab
lea rcx, [rbp + 0x288]
call fcn.14000d550
jmp 0x140015113
mov rcx, qword [rbp + 0x288]
call fcn.14002db20
mov byte [rbp + 0x23], al
jmp 0x1400151bc
mov al, byte [rbp + 0x23]
test al, 1
jne 0x14001519a
jmp 0x1400151c5
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x18], rax
and rax, 7
cmp rax, 0
sete al
test al, 1
jne 0x1400151e1
jmp 0x140015202
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x290]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x2d0], 3
je 0x14001522e
jmp 0x140015219
mov rdx, qword [rbp + 0x18]
lea r8, [0x1400a1258]
mov ecx, 8
call fcn.14009f5d0
ud2
mov rdx, qword [rbp + 0x2d8]
lea rcx, [rbp + 0x3b8]
call fcn.140012730
jmp 0x14001523f
lea rcx, [rbp + 0x288]
call fcn.14000d550
jmp 0x140015113
mov rax, qword [rbp + 0x3b8]
cmp rax, 0
sete al
test al, 1
jne 0x140015253
jmp 0x14001525c
mov byte [rbp + 0x509], 0
jmp 0x14001522e
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e0], rax
movups xmm0, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x509], 1
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3b0], rax
movaps xmm0, xmmword [rbp + 0x3d0]
movaps xmmword [rbp + 0x3a0], xmm0
lea rcx, [rbp + 0xe0]
call fcn.140023290
mov qword [rbp + 8], rdx
mov qword [rbp + 0x10], rax
jmp 0x1400152b1
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
call fcn.140017230
mov qword [rbp - 8], rdx
mov qword [rbp], rax
jmp 0x1400152c8
mov rax, qword [rbp - 8]
mov rcx, qword [rbp]
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], rax
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x400], rax
mov rdx, qword [rbp + 0x400]
lea rcx, [rbp + 0x3f0]
call fcn.14000a4b0
mov byte [rbp - 9], al
jmp 0x140015304
mov al, byte [rbp - 9]
test al, 1
jne 0x140015322
jmp 0x14001530d
lea rcx, [rbp + 0x420]
lea rdx, [rbp + 0x3a0]
call fcn.140012960
jmp 0x140015333
lea rcx, [rbp + 0x3a0]
call fcn.14000ebd0
jmp 0x140015253
lea rax, [rbp + 0x290]
mov qword [rbp + 0x438], rax
mov r8, qword [rbp + 0x438]
lea rcx, [rbp + 0x408]
lea rdx, [rbp + 0x420]
call fcn.14003af50
jmp 0x14001535d
mov byte [rbp + 0x509], 0
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x4c0], rax
movaps xmm0, xmmword [rbp + 0x3a0]
movaps xmmword [rbp + 0x4b0], xmm0
mov rax, qword [rbp + 0x4c0]
mov qword [rbp + 0x4a0], rax
movaps xmm0, xmmword [rbp + 0x4b0]
movaps xmmword [rbp + 0x490], xmm0
mov dword [rbp + 0x4cc], 0
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x4e0], rax
movups xmm0, xmmword [rbp + 0x408]
movaps xmmword [rbp + 0x4d0], xmm0
lea rcx, [rbp + 0x4f0]
call fcn.140020960
jmp 0x1400153d0
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x450], rax
movaps xmm0, xmmword [rbp + 0x490]
movaps xmmword [rbp + 0x440], xmm0
mov eax, dword [rbp + 0x4cc]
mov dword [rbp + 0x488], eax
mov rax, qword [rbp + 0x4e0]
mov qword [rbp + 0x468], rax
movaps xmm0, xmmword [rbp + 0x4d0]
movups xmmword [rbp + 0x458], xmm0
mov rax, qword [rbp + 0x500]
mov qword [rbp + 0x480], rax
movups xmm0, xmmword [rbp + 0x4f0]
movups xmmword [rbp + 0x470], xmm0
lea rcx, [rbp + 0xe0]
lea rdx, [rbp + 0x440]
call fcn.140021750
jmp 0x140015445
mov byte [rbp + 0x509], 0
jmp 0x14001519a
mov rax, qword [rbp + 0xd8]
mov byte [rbp + 0x50b], 0
add rsp, 0x600
pop rbp
ret
mov al, byte [rbp + 0x87]
test al, 1
jne 0x140014fb7
jmp 0x140015478
call fcn.140014800
mov qword [rbp - 0x18], rax
jmp 0x140015483
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x538], 0
mov qword [rbp + 0x540], 0
mov qword [rbp + 0x550], 0
mov rax, qword [rbp + 0x550]
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x548]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x130]
call fcn.140014990
mov qword [rbp - 0x20], rax
jmp 0x1400154e8
mov r9, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov r8d, 0x17
call sub.NETAPI32.dll_NetUserGetInfo
mov dword [rbp - 0x34], eax
jmp 0x140015504
mov eax, dword [rbp - 0x34]
cmp eax, 0
je 0x14001551d
lea rcx, [rbp + 0x130]
call fcn.14000d470
jmp 0x140014fb7
mov rax, qword [rbp + 0x130]
mov qword [rbp - 0x40], rax
and rax, 7
cmp rax, 0
sete al
test al, 1
jne 0x140015539
jmp 0x14001554f
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax + 0x20]
lea rcx, [rbp + 0x138]
call fcn.140012730
jmp 0x140015566
mov rdx, qword [rbp - 0x40]
lea r8, [0x1400a1270]
mov ecx, 8
call fcn.14009f5d0
ud2
mov byte [rbp + 0x508], 1
mov rdx, qword [rbp + 0x138]
mov eax, 1
xor ecx, ecx
cmp rdx, 0
cmove rax, rcx
cmp rax, 1
jne 0x1400155c8
mov byte [rbp + 0x508], 0
mov byte [rbp + 0x50a], 1
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x160], rax
movups xmm0, xmmword [rbp + 0x138]
movaps xmmword [rbp + 0x150], xmm0
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x150]
call fcn.140012960
jmp 0x1400155ed
mov rdx, qword [rbp + 0x138]
mov eax, 1
xor ecx, ecx
cmp rdx, 0
cmove rax, rcx
cmp rax, 1
je 0x140015715
jmp 0x14001571e
lea rax, [rbp + 0x128]
mov qword [rbp + 0x198], rax
mov r8, qword [rbp + 0x198]
lea rcx, [rbp + 0x168]
lea rdx, [rbp + 0x180]
call fcn.14003aea0
jmp 0x140015617
mov byte [rbp + 0x50a], 0
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x220], rax
movaps xmm0, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x210], xmm0
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x200], rax
movaps xmm0, xmmword [rbp + 0x210]
movaps xmmword [rbp + 0x1f0], xmm0
mov dword [rbp + 0x22c], 0
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x240], rax
movups xmm0, xmmword [rbp + 0x168]
movaps xmmword [rbp + 0x230], xmm0
mov rax, qword [rbp + 0x128]
mov rdx, qword [rax]
lea rcx, [rbp + 0x248]
call fcn.140014b90
jmp 0x140015694
mov rax, qword [rbp + 0x200]
mov qword [rbp + 0x1b0], rax
movaps xmm0, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x1a0], xmm0
mov eax, dword [rbp + 0x22c]
mov dword [rbp + 0x1e8], eax
mov rax, qword [rbp + 0x240]
mov qword [rbp + 0x1c8], rax
movaps xmm0, xmmword [rbp + 0x230]
movups xmmword [rbp + 0x1b8], xmm0
mov rax, qword [rbp + 0x258]
mov qword [rbp + 0x1e0], rax
movups xmm0, xmmword [rbp + 0x248]
movups xmmword [rbp + 0x1d0], xmm0
lea rcx, [rbp + 0xe0]
lea rdx, [rbp + 0x1a0]
call fcn.140021750
jmp 0x140015709
mov byte [rbp + 0x50a], 0
jmp 0x1400155c8
test byte [rbp + 0x508], 1
jne 0x14001572a
mov byte [rbp + 0x508], 0
jmp 0x14001550c
lea rcx, [rbp + 0x138]
call fcn.14000ebd0
jmp 0x14001571e