Function at 0x140140000
Capabilities:
Get logon sessions
List user accounts

Disassembly:
push rbp
sub rsp, 0x5b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x528], 0xfffffffffffffffe
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rcx
mov byte [rbp + 0x4db], 0
mov byte [rbp + 0x4da], 0
mov byte [rbp + 0x4d9], 0
mov byte [rbp + 0x4d8], 0
mov byte [rbp + 0x4db], 1
lea rcx, [rbp + 0xc0]
call fcn.140141570
mov dword [rbp + 0xdc], 0
call fcn.14013fb20
mov qword [rbp + 0xa8], rax
jmp 0x140140070
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], 0
mov dword [rbp + 0xec], 0
mov qword [rbp + 0x518], 0
mov qword [rbp + 0x520], 0
lea rcx, [rbp + 0xe0]
call fcn.14013fc40
mov qword [rbp + 0xa0], rax
jmp 0x1401400bd
mov r9, qword [rbp + 0xa0]
xor eax, eax
mov ecx, eax
xor edx, edx
mov r8d, 2
lea r11, [rbp + 0xe8]
lea r10, [rbp + 0xec]
lea rax, [rbp + 0xdc]
mov dword [rsp + 0x20], 0xffffffff
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rax
call sub.netapi32.dll_NetUserEnum
mov dword [rbp + 0x9c], eax
mov dword [rbp + 0x4dc], eax
cmp eax, 0
je 0x14014011f
mov eax, dword [rbp + 0x9c]
cmp eax, 0xea
jne 0x140140143
mov rcx, qword [rbp + 0xe0]
mov eax, dword [rbp + 0xe8]
mov edx, eax
call fcn.140163250
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], rax
jmp 0x140140159
mov eax, dword [rbp + 0x9c]
cmp eax, 0xea
jne 0x140140209
jmp 0x1401401f8
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov qword [rbp + 0x4e0], rcx
mov qword [rbp + 0x4e8], rdx
call fcn.14016f0e0
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], rax
jmp 0x140140187
mov rax, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 0xf0]
call fcn.140158bf0
mov qword [rbp + 0x70], rax
jmp 0x1401401b2
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
cmp rax, 0
sete al
test al, 1
jne 0x140140143
mov rax, qword [rbp + 0x100]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax]
call fcn.14016c2c0
mov byte [rbp + 0x6f], al
jmp 0x140140614
lea rcx, [rbp + 0xe0]
call fcn.14013dbe0
jmp 0x140140062
lea rcx, [rbp + 0xe0]
call fcn.14013dbe0
jmp 0x140140217
mov dword [rbp + 0x244], 0
call fcn.14013fd00
mov qword [rbp + 0x60], rax
jmp 0x14014022c
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x248], rax
lea rcx, [rbp + 0x248]
call fcn.14013fd80
mov qword [rbp + 0x58], rax
jmp 0x140140249
mov rdx, qword [rbp + 0x58]
lea rcx, [rbp + 0x244]
call sub.secur32.dll_LsaEnumerateLogonSessions
cmp eax, 0
jne 0x14014027c
mov rcx, qword [rbp + 0x248]
mov eax, dword [rbp + 0x244]
mov edx, eax
call fcn.1401634c0
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], rax
jmp 0x1401402b0
mov rax, qword [rbp + 0xb0]
mov byte [rbp + 0x4db], 0
mov rcx, qword [rbp + 0xd0]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x248]
call fcn.14013da00
jmp 0x1401405fd
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov qword [rbp + 0x4f0], rcx
mov qword [rbp + 0x4f8], rdx
call fcn.1401674f0
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], rax
jmp 0x1401402d5
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x250], rcx
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x250]
call fcn.140159860
mov qword [rbp + 0x30], rax
jmp 0x1401402fd
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x260]
cmp rax, 0
sete al
test al, 1
jne 0x14014027c
mov rax, qword [rbp + 0x260]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x500], rax
call fcn.14013fd20
mov qword [rbp + 0x28], rax
jmp 0x14014033b
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x268]
call fcn.14013fd40
mov qword [rbp + 0x18], rax
jmp 0x140140358
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
call sub.secur32.dll_LsaGetLogonSessionData
cmp eax, 0
je 0x14014037b
lea rcx, [rbp + 0x268]
call fcn.14013add0
jmp 0x1401402eb
mov rcx, qword [rbp + 0x268]
call fcn.14015e620
mov byte [rbp + 0x17], al
jmp 0x14014038c
mov al, byte [rbp + 0x17]
test al, 1
jne 0x14014036a
jmp 0x140140395
mov rax, qword [rbp + 0x268]
mov qword [rbp + 8], rax
and rax, 7
cmp rax, 0
jne 0x1401403cb
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x270]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x2b0], 3
je 0x1401403f5
jmp 0x1401403e0
mov rdx, qword [rbp + 8]
lea r8, [0x1401e4d00]
mov ecx, 8
call fcn.1401bd798
mov rdx, qword [rbp + 0x2b8]
lea rcx, [rbp + 0x398]
call fcn.140134cd0
jmp 0x140140406
lea rcx, [rbp + 0x268]
call fcn.14013add0
jmp 0x1401402eb
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x398], rax
sete al
test al, 1
jne 0x140140420
jmp 0x140140429
mov byte [rbp + 0x4d9], 0
jmp 0x1401403f5
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3c0], rax
movups xmm0, xmmword [rbp + 0x398]
movaps xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x4d9], 1
mov rax, qword [rbp + 0x3c0]
mov qword [rbp + 0x390], rax
movaps xmm0, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x380], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140144920
mov qword [rbp - 8], rdx
mov qword [rbp], rax
jmp 0x14014047e
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp]
call fcn.140138570
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rax
jmp 0x140140495
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], rax
lea rcx, [rbp + 0x3d0]
lea rdx, [rbp + 0x380]
call fcn.1401584e0
mov byte [rbp - 0x19], al
jmp 0x1401404c3
mov al, byte [rbp - 0x19]
test al, 1
jne 0x1401404e1
jmp 0x1401404cc
lea rcx, [rbp + 0x3f8]
lea rdx, [rbp + 0x380]
call fcn.140134ee0
jmp 0x1401404f2
lea rcx, [rbp + 0x380]
call fcn.14013c3a0
jmp 0x140140420
lea r9, [0x1401e4d18]
lea rcx, [rbp + 0x3e0]
lea rdx, [rbp + 0x3f8]
lea r8, [rbp + 0x270]
call fcn.14012ef90
jmp 0x140140515
mov byte [rbp + 0x4d9], 0
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x490], rax
movaps xmm0, xmmword [rbp + 0x380]
movaps xmmword [rbp + 0x480], xmm0
mov rax, qword [rbp + 0x490]
mov qword [rbp + 0x470], rax
movaps xmm0, xmmword [rbp + 0x480]
movaps xmmword [rbp + 0x460], xmm0
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x4b0], rax
movups xmm0, xmmword [rbp + 0x3e0]
movaps xmmword [rbp + 0x4a0], xmm0
lea rcx, [rbp + 0x4c0]
call fcn.140141530
jmp 0x14014057e
mov rax, qword [rbp + 0x470]
mov qword [rbp + 0x420], rax
movaps xmm0, xmmword [rbp + 0x460]
movaps xmmword [rbp + 0x410], xmm0
mov dword [rbp + 0x458], 0
mov rax, qword [rbp + 0x4b0]
mov qword [rbp + 0x438], rax
movaps xmm0, xmmword [rbp + 0x4a0]
movups xmmword [rbp + 0x428], xmm0
mov rax, qword [rbp + 0x4d0]
mov qword [rbp + 0x450], rax
movups xmm0, xmmword [rbp + 0x4c0]
movups xmmword [rbp + 0x440], xmm0
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0x410]
call fcn.140142a20
jmp 0x1401405f1
mov byte [rbp + 0x4d9], 0
jmp 0x14014036a
mov rax, qword [rbp + 0xb8]
mov byte [rbp + 0x4db], 0
add rsp, 0x5b0
pop rbp
ret
mov al, byte [rbp + 0x6f]
test al, 1
jne 0x1401401a0
jmp 0x140140621
call fcn.14013fb40
mov qword [rbp - 0x28], rax
jmp 0x14014062c
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x508], 0
mov qword [rbp + 0x510], 0
mov rax, qword [rbp + 0x108]
mov rax, qword [rax]
mov qword [rbp - 0x38], rax
lea rcx, [rbp + 0x110]
call fcn.14013fc80
mov qword [rbp - 0x30], rax
jmp 0x14014066d
mov r9, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
xor eax, eax
mov ecx, eax
mov r8d, 0x17
call sub.netapi32.dll_NetUserGetInfo
cmp eax, 0
je 0x14014069a
lea rcx, [rbp + 0x110]
call fcn.14013ad10
jmp 0x1401401a0
mov rax, qword [rbp + 0x110]
mov qword [rbp - 0x40], rax
and rax, 7
cmp rax, 0
jne 0x1401406c5
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax + 0x20]
lea rcx, [rbp + 0x118]
call fcn.140134cd0
jmp 0x1401406da
mov rdx, qword [rbp - 0x40]
lea r8, [0x1401e4d30]
mov ecx, 8
call fcn.1401bd798
mov byte [rbp + 0x4d8], 1
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x118], rdx
cmove rax, rcx
cmp rax, 1
jne 0x140140742
mov byte [rbp + 0x4d8], 0
mov byte [rbp + 0x4da], 1
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x140], rax
movups xmm0, xmmword [rbp + 0x118]
movaps xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0x168]
lea rdx, [rbp + 0x130]
call fcn.140134ee0
jmp 0x14014076d
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x118], rdx
cmove rax, rcx
cmp rax, 1
je 0x140140882
jmp 0x14014088b
lea r9, [0x1401e4d48]
lea rcx, [rbp + 0x150]
lea rdx, [rbp + 0x168]
lea r8, [rbp + 0x108]
call fcn.14012f030
jmp 0x140140790
mov byte [rbp + 0x4da], 0
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x200], rax
movaps xmm0, xmmword [rbp + 0x130]
movaps xmmword [rbp + 0x1f0], xmm0
mov rax, qword [rbp + 0x200]
mov qword [rbp + 0x1e0], rax
movaps xmm0, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x1d0], xmm0
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x220], rax
movups xmm0, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x210], xmm0
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax]
lea rcx, [rbp + 0x228]
call fcn.14013fdc0
jmp 0x140140803
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 0x190], rax
movaps xmm0, xmmword [rbp + 0x1d0]
movaps xmmword [rbp + 0x180], xmm0
mov dword [rbp + 0x1c8], 0
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x1a8], rax
movaps xmm0, xmmword [rbp + 0x210]
movups xmmword [rbp + 0x198], xmm0
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x1c0], rax
movups xmm0, xmmword [rbp + 0x228]
movups xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0x180]
call fcn.140142a20
jmp 0x140140876
mov byte [rbp + 0x4da], 0
jmp 0x140140742
test byte [rbp + 0x4d8], 1
jne 0x140140897
mov byte [rbp + 0x4d8], 0
jmp 0x140140689
lea rcx, [rbp + 0x118]
call fcn.14013c3a0
jmp 0x14014088b