Function at 0x140005134
Capabilities:
Get logon sessions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x230
mov r14, rcx
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x168]
call qword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
xor r13d, r13d
test eax, eax
jns 0x14000518a
mov r8d, eax
lea rdx, str.LsaEnumerateLogonSessions_x_r_n
mov rcx, r14
call fcn.14000108c
jmp 0x140005710
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x48], rax
cmp dword [rbp + 0x168], r13d
je 0x140005707
xorps xmm0, xmm0
mov dword [rbp - 0x20], 0x30
xor eax, eax
lea r9, [rbp - 0x70]
mov r8d, 0x800
mov qword [rbp + 8], rax
lea rdx, [rbp - 0x20]
xor ecx, ecx
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov rcx, qword [rbp - 0x70]
test eax, eax
mov rax, qword [rbp - 0x78]
cmovs rcx, r13
or rsi, 0xffffffffffffffff
mov qword [rbp - 0x70], rcx
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
jns 0x140005217
mov dword [rsp + 0x20], eax
lea rdx, str.LsaGetLogonSessionData__08x__08x__x_r_n
mov rax, qword [rbp - 0x78]
mov rcx, r14
mov r9d, dword [rax]
mov r8d, dword [rax + 4]
call fcn.14000108c
jmp 0x1400056db
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x68]
add rcx, 0x50
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
mov rbx, qword [rbp - 0x80]
lea r8, str._____None
mov rdi, r13
mov ecx, 0x20
mov eax, dword [rbx + 0x88]
mov dword [rbp + 0x160], eax
dec ecx
lea rax, [rbp + 0x160]
bt dword [rax], ecx
lea r8, [r8 - 8]
jae 0x140005276
mov rdx, qword [r8]
test rdx, rdx
je 0x140005276
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r13w
jne 0x140005265
add rdi, 4
add rdi, rax
test ecx, ecx
jne 0x140005248
test rdi, rdi
jne 0x14000528d
mov word [rbp + 0x10], r13w
lea rsi, [rbp + 0x10]
jmp 0x14000533c
inc rdi
cmp rdi, 0x80
jbe 0x1400052c6
mov eax, 2
mul rdi
mov rbx, rax
cmovo rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1400052ca
jmp 0x140005335
lea rsi, [rbp + 0x10]
mov rbx, rsi
lea r15, str._____None
mov r12d, 0x20
dec r12d
lea rax, [rbp + 0x160]
btr dword [rax], r12d
lea r15, [r15 - 8]
jae 0x140005316
mov r9, qword [r15]
test r9, r9
je 0x140005316
lea r8, str._t_t_s_r_n
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_swprintf_s]
test eax, eax
jle 0x140005321
cdqe
sub rdi, rax
lea rbx, [rbx + rax*2]
cmp dword [rbp + 0x160], r13d
je 0x140005338
jmp 0x1400052da
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, r13
mov rbx, qword [rbp - 0x80]
mov r9d, dword [rbx + 0x40]
lea rax, [rbx + 0x10]
mov qword [rbp - 0x30], rax
lea rdi, [rbx + 0x68]
mov eax, dword [rbx + 0x88]
lea r15, [rbx + 0x58]
mov dword [rbp + 0x160], eax
lea r12, [rbx + 0x30]
lea r13, [rbx + 0x20]
cmp r9d, 7
ja 0x1400053db
je 0x1400053d2
mov eax, r9d
test r9d, r9d
je 0x1400053c9
sub eax, 2
je 0x1400053bd
sub eax, 1
je 0x1400053b1
sub eax, 1
je 0x1400053a5
sub eax, 1
je 0x140005399
cmp eax, 1
jne 0x1400053fc
lea r8, str.Proxy
jmp 0x140005450
lea r8, str.Service
jmp 0x140005450
lea r8, str.Batch
jmp 0x140005450
lea r8, str.Network
jmp 0x140005450
lea r8, str.Interactive
jmp 0x140005450
lea r8, str.UndefinedLogonType
jmp 0x140005450
lea r8, str.Unlock
jmp 0x140005450
mov eax, r9d
sub eax, 8
je 0x140005449
sub eax, 1
je 0x140005440
sub eax, 1
je 0x140005437
sub eax, 1
je 0x14000542e
sub eax, 1
je 0x140005425
cmp eax, 1
je 0x14000541c
lea r8, [0x14000a858]
mov edx, InitCommonControls
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_swprintf_s]
mov rbx, qword [rbp - 0x80]
lea r8, [rbp - 0x20]
jmp 0x140005450
lea r8, str.CachedUnlock
jmp 0x140005450
lea r8, str.CachedRemoteInteractive
jmp 0x140005450
lea r8, str.CachedInteractive
jmp 0x140005450
lea r8, str.RemoteInteractive
jmp 0x140005450
lea r8, str.NewCredentials
jmp 0x140005450
lea r8, str.NetworkCleartext
movsx eax, word [rbp - 0x5e]
movsx ecx, word [rbp - 0x60]
movsx edx, word [rbp - 0x62]
movsx r9d, word [rbp - 0x64]
movsx r10d, word [rbp - 0x66]
movsx r11d, word [rbp - 0x68]
mov qword [rsp + 0x90], rdi
mov rdi, qword [rbp - 0x30]
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], eax
mov eax, dword [rbp + 0x160]
mov dword [rsp + 0x60], ecx
mov rcx, r14
mov dword [rsp + 0x58], edx
lea rdx, str._r_nLogonId:_t_08x__08x_r_nSession:_t_u_r_nLogonType:_t_s_r_nUserFlags:_t_08x_r_n_sLogonTime_t_u__02u__02u__02u:_02u:_02u_r_nUsername:_t_wZ_r_nLogonDomain:_t_wZ_r_nAuthenticationPackage:_t_wZ_r_nLogonServer:_t_wZ_r_nDnsDomainName:_t_wZ_r_nSid:
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbx + 4]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x44]
mov qword [rsp + 0x28], r8
mov r8d, dword [rbx + 8]
mov dword [rsp + 0x20], eax
call fcn.14000108c
xor r13d, r13d
test rsi, rsi
je 0x140005503
lea rax, [rbp + 0x10]
cmp rsi, rax
je 0x140005503
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp - 0x80]
mov rdx, qword [rax + 0x48]
mov qword [rbp - 0x28], rdx
test rdx, rdx
je 0x14000567c
mov r8b, 1
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlConvertSidToUnicodeString]
test eax, eax
jns 0x140005532
mov word [rbp - 0x40], r13w
mov qword [rbp - 0x38], r13
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x58]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x28]
mov edx, 1
lea rdi, [0x14000bdb8]
lea rbx, [0x14000bdb8]
call qword [sym.imp.ADVAPI32.dll_LsaLookupSids]
mov esi, eax
test eax, eax
js 0x140005633
mov rcx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov edx, dword [rcx + 0x18]
lea rdi, [rcx + 8]
mov r8d, dword [rcx]
cmp edx, dword [rax]
jae 0x14000558c
mov rax, qword [rax + 8]
lea rdx, [rdx + rdx*2]
lea rbx, [rax + rdx*8]
cmp r8d, 6
jg 0x1400055e8
je 0x1400055df
sub r8d, 1
je 0x1400055d6
sub r8d, 1
je 0x1400055cd
sub r8d, 1
je 0x1400055c4
sub r8d, 1
je 0x1400055bb
cmp r8d, 1
jne 0x140005606
lea rax, str.WellKnownGroup
jmp 0x14000563a
lea rax, str.Alias
jmp 0x14000563a
lea rax, str.Domain
jmp 0x14000563a
lea rax, str.Group
jmp 0x14000563a
lea rax, str.User
jmp 0x14000563a
lea rax, str.DeletedAccount
jmp 0x14000563a
sub r8d, 7
je 0x14000562a
sub r8d, 1
je 0x140005633
sub r8d, 1
je 0x140005621
sub r8d, 1
je 0x140005618
cmp r8d, 1
je 0x14000560f
lea rax, [0x14000bab0]
jmp 0x14000563a
lea rax, str.LogonSession
jmp 0x14000563a
lea rax, str.Label
jmp 0x14000563a
lea rax, str.Computer
jmp 0x14000563a
lea rax, str.Invalid
jmp 0x14000563a
lea rax, str.Unknown
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea rdx, str._t__wZ___wZ_wZ___S__r_n
mov rcx, r14
call fcn.14000108c
test esi, esi
js 0x140005672
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [r14 + 0xc]
mov ecx, dword [r14 + 8]
cmp eax, ecx
jae 0x1400056ba
mov ecx, eax
mov edx, InitCommonControls
mov rax, qword [r14]
mov word [rcx + rax], dx
add dword [r14 + 0xc], 2
mov eax, dword [r14 + 0xc]
mov ecx, dword [r14 + 8]
cmp eax, ecx
jae 0x1400056ba
mov ecx, eax
mov edx, 0xa
mov rax, qword [r14]
mov word [rcx + rax], dx
add dword [r14 + 0xc], 2
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov r8, qword [rbp + 0x158]
mov rcx, r14
mov rdx, qword [rbp - 0x78]
call fcn.140004f50
or rsi, 0xffffffffffffffff
mov rax, qword [rbp - 0x78]
add rax, 8
add dword [rbp + 0x168], 0xffffffff
mov qword [rbp - 0x78], rax
jne 0x1400051e3
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140005703
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rax, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret