Function at 0x499000
Capabilities:
Get logon sessions

Disassembly:
push 0x78
mov eax, 0x4bb9ca
call fcn.004701a5
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4c], esi
test esi, esi
jne 0x49901d
xor al, al
jmp 0x499392
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
xor ebx, ebx
push 1
push ebx
push ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x499057
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CInstallManager::GetInteractiveSessions_4507__:_WTSEnumerateSessions_failed:__lu
call fcn.004a3592
pop ecx
pop ecx
jmp 0x499060
cmp dword [ebp - 0x44], ebx
jne 0x4992f3
push str.falling_back_to_LSA_to_get_active_sessions
call fcn.004a35a8
mov eax, dword [esi]
pop ecx
mov ecx, esi
call dword [eax + 0x20]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
je 0x4990a3
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push str.CInstallManager::GetInteractiveSessions_4561__:_LsaEnumerateLogonSessions_failed:__lu
call fcn.004a35be
pop ecx
pop ecx
jmp 0x499016
mov edi, ebx
mov dword [ebp - 0x54], ebx
cmp dword [ebp - 0x58], edi
jbe 0x4992d8
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], ebx
lea eax, [eax + edi*8]
push eax
call dword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x49929f
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x49929f
cmp dword [eax + 0x24], 2
jne 0x499296
cmp dword [eax + 0x10], ebx
je 0x499296
movzx eax, word [eax + 0xc]
push 0x508688
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.00401520
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], ebx
call fcn.00426a1a
mov ecx, dword [ebp - 0x48]
movzx eax, cx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00402ef6
mov edx, eax
mov eax, dword [ebp - 0x48]
movzx ecx, ax
mov eax, dword [ebp - 0x3c]
push ecx
push dword [eax + 0x10]
push ecx
push edx
call fcn.0046ea36
mov ecx, dword [ebp - 0x48]
movzx eax, cx
add esp, 0x10
lea ecx, [ebp - 0x44]
push eax
call fcn.00402f37
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x44]
push dword [eax + 0x28]
push str.CInstallManager::GetInteractiveSessions_4594__:_UserName__lu_:__s
call fcn.004a35a8
add esp, 0xc
jmp 0x4991cc
lea ecx, [ebp - 0x7c]
call fcn.00426c16
test al, al
je 0x4991e3
push str.Couldnt_alloc_memory_for_username
call fcn.004a35be
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.00426a56
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00402199
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x28]
test esi, esi
jne 0x49928b
push str.Invalid_IVC
call fcn.004a35be
pop ecx
jmp 0x499293
push eax
mov ecx, esi
call fcn.0049939a
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
jmp 0x4992cf
push dword [ebp - 0x50]
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
cmp dword [ebp - 0x3c], 0
je 0x4992b7
push dword [ebp - 0x3c]
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push edi
push str.CInstallManager::GetInteractiveSessions_4576__:_LsaEnumerateLogonSessions__Iu__failed:__lu
call fcn.004a35be
add esp, 0xc
inc edi
mov dword [ebp - 0x54], edi
jmp 0x4990a8
push dword [ebp - 0x50]
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
neg eax
sbb eax, eax
neg eax
jmp 0x499392
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
push str.CInstallManager::GetInteractiveSessions_4517__:_Console_Session:__lu
call fcn.004a35a8
pop ecx
pop ecx
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x44], ebx
jbe 0x499387
mov edi, ebx
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 0x3d], bl
push dword [edi + eax]
call fcn.004993e3
test al, al
je 0x499345
mov eax, dword [ebp - 0x3c]
cmp dword [edi + eax + 8], ebx
jne 0x499345
push dword [edi + eax]
push str.CInstallManager::GetInteractiveSessions_4527__:_Active_User_Session:__lu
call fcn.004a35a8
pop ecx
pop ecx
mov byte [ebp - 0x3d], 1
mov ecx, str.Active
jmp 0x49934a
mov ecx, str.inactive
mov eax, dword [ebp - 0x3c]
push ecx
push dword [edi + eax + 8]
push dword [edi + eax + 4]
push dword [edi + eax]
push str.CInstallManager::GetInteractiveSessions_4532__:_Session:__lu____s____lu____s
call fcn.004a35a8
add esp, 0x14
cmp byte [ebp - 0x3d], bl
je 0x499378
mov eax, dword [ebp - 0x3c]
mov ecx, esi
push dword [edi + eax]
call fcn.0049939a
mov eax, dword [ebp - 0x4c]
inc eax
add edi, 0xc
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x44], eax
ja 0x499310
push dword [ebp - 0x3c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov al, 1
call fcn.004700f7
ret 4