Function at 0x1400438a0
Capabilities:
Get logon sessions
List user accounts

Disassembly:
push rbp
sub rsp, 0x5c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x538], 0xfffffffffffffffe
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rcx
mov byte [rbp + 0x4eb], 0
mov byte [rbp + 0x4ea], 0
mov byte [rbp + 0x4e9], 0
mov byte [rbp + 0x4e8], 0
mov byte [rbp + 0x4eb], 1
lea rcx, [rbp + 0xd0]
call fcn.14005b100
mov dword [rbp + 0xec], 0
call fcn.1400433d0
mov qword [rbp + 0xb8], rax
jmp 0x140043910
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xf8], 0
mov dword [rbp + 0xfc], 0
mov qword [rbp + 0x528], 0
mov qword [rbp + 0x530], 0
lea rcx, [rbp + 0xf0]
call fcn.1400434f0
mov qword [rbp + 0xb0], rax
jmp 0x14004395d
mov r9, qword [rbp + 0xb0]
mov rax, rsp
lea rcx, [rbp + 0xec]
mov qword [rax + 0x38], rcx
lea rcx, [rbp + 0xfc]
mov qword [rax + 0x30], rcx
lea rcx, [rbp + 0xf8]
mov qword [rax + 0x28], rcx
mov dword [rax + 0x20], 0xffffffff
xor edx, edx
mov ecx, edx
mov r8d, 2
call sub.NETAPI32.dll_NetUserEnum
mov dword [rbp + 0xac], eax
jmp 0x1400439a6
mov eax, dword [rbp + 0xac]
mov dword [rbp + 0x4ec], eax
cmp eax, 0
je 0x1400439c4
mov eax, dword [rbp + 0xac]
cmp eax, 0xea
jne 0x1400439e8
mov rcx, qword [rbp + 0xf0]
mov eax, dword [rbp + 0xf8]
mov edx, eax
call fcn.140055a80
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], rax
jmp 0x1400439fe
mov eax, dword [rbp + 0xac]
cmp eax, 0xea
jne 0x140043aba
jmp 0x140043aa9
mov rdx, qword [rbp + 0x98]
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x4f0], rcx
mov qword [rbp + 0x4f8], rdx
call fcn.140070c40
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], rax
jmp 0x140043a2f
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x100]
call fcn.14006e480
mov qword [rbp + 0x80], rax
jmp 0x140043a60
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
cmp rax, 0
sete al
test al, 1
jne 0x1400439e8
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov rcx, qword [rax]
call fcn.14004a420
mov byte [rbp + 0x7f], al
jmp 0x140043ed5
lea rcx, [rbp + 0xf0]
call fcn.140041fb0
jmp 0x140043902
lea rcx, [rbp + 0xf0]
call fcn.140041fb0
jmp 0x140043ac8
mov dword [rbp + 0x254], 0
call fcn.140043590
mov qword [rbp + 0x70], rax
jmp 0x140043add
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x258]
call fcn.1400435d0
mov qword [rbp + 0x68], rax
jmp 0x140043afa
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x254]
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov dword [rbp + 0x64], eax
jmp 0x140043b0f
mov eax, dword [rbp + 0x64]
cmp eax, 0
jne 0x140043b35
mov rcx, qword [rbp + 0x258]
mov eax, dword [rbp + 0x254]
mov edx, eax
call fcn.140055d30
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x58], rax
jmp 0x140043b69
mov rax, qword [rbp + 0xc0]
mov byte [rbp + 0x4eb], 0
mov rcx, qword [rbp + 0xe0]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x258]
call fcn.140041d20
jmp 0x140043ebe
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x500], rcx
mov qword [rbp + 0x508], rdx
call fcn.14004a5c0
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rax
jmp 0x140043b8e
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x260], rcx
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x260]
call fcn.14006eff0
mov qword [rbp + 0x38], rax
jmp 0x140043bb6
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
cmp rax, 0
sete al
test al, 1
jne 0x140043b35
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x510], rax
call fcn.1400435b0
mov qword [rbp + 0x30], rax
jmp 0x140043bf4
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 0x278]
call fcn.140043610
mov qword [rbp + 0x20], rax
jmp 0x140043c11
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
call sub.Secur32.dll_LsaGetLogonSessionData
mov dword [rbp + 0x1c], eax
jmp 0x140043c23
mov eax, dword [rbp + 0x1c]
cmp eax, 0
je 0x140043c3c
lea rcx, [rbp + 0x278]
call fcn.14003f7a0
jmp 0x140043ba4
mov rcx, qword [rbp + 0x278]
call fcn.1400453d0
mov byte [rbp + 0x1b], al
jmp 0x140043c4d
mov al, byte [rbp + 0x1b]
test al, 1
jne 0x140043c2b
jmp 0x140043c56
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x10], rax
and rax, 7
cmp rax, 0
jne 0x140043c8c
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x280]
mov r8d, 0x110
call fcn.140136190
cmp dword [rbp + 0x2c0], 3
je 0x140043cb6
jmp 0x140043ca1
mov rdx, qword [rbp + 0x10]
lea r8, [0x140141cc0]
mov ecx, 8
call fcn.140138050
mov rdx, qword [rbp + 0x2c8]
lea rcx, [rbp + 0x3a8]
call fcn.14004b8e0
jmp 0x140043cc7
lea rcx, [rbp + 0x278]
call fcn.14003f7a0
jmp 0x140043ba4
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x3a8], rax
sete al
test al, 1
jne 0x140043ce1
jmp 0x140043cea
mov byte [rbp + 0x4e9], 0
jmp 0x140043cb6
mov rax, qword [rbp + 0x3b8]
mov qword [rbp + 0x3d0], rax
movups xmm0, xmmword [rbp + 0x3a8]
movaps xmmword [rbp + 0x3c0], xmm0
mov byte [rbp + 0x4e9], 1
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3a0], rax
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmmword [rbp + 0x390], xmm0
lea rcx, [rbp + 0xd0]
call fcn.14005d430
mov qword [rbp], rdx
mov qword [rbp + 8], rax
jmp 0x140043d3f
mov rdx, qword [rbp]
mov rcx, qword [rbp + 8]
call fcn.14003d830
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rax
jmp 0x140043d56
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], rax
lea rcx, [rbp + 0x3e0]
lea rdx, [rbp + 0x390]
call fcn.14006dc80
mov byte [rbp - 0x11], al
jmp 0x140043d84
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140043da2
jmp 0x140043d8d
lea rcx, [rbp + 0x408]
lea rdx, [rbp + 0x390]
call fcn.14004bb00
jmp 0x140043db3
lea rcx, [rbp + 0x390]
call fcn.140040190
jmp 0x140043ce1
lea r9, [0x140141cd8]
lea rcx, [rbp + 0x3f0]
lea rdx, [rbp + 0x408]
lea r8, [rbp + 0x280]
call fcn.140046890
jmp 0x140043dd6
mov byte [rbp + 0x4e9], 0
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x4a0], rax
movaps xmm0, xmmword [rbp + 0x390]
movaps xmmword [rbp + 0x490], xmm0
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x480], rax
movaps xmm0, xmmword [rbp + 0x490]
movaps xmmword [rbp + 0x470], xmm0
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x4c0], rax
movups xmm0, xmmword [rbp + 0x3f0]
movaps xmmword [rbp + 0x4b0], xmm0
lea rcx, [rbp + 0x4d0]
call fcn.14005b0c0
jmp 0x140043e3f
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x430], rax
movaps xmm0, xmmword [rbp + 0x470]
movaps xmmword [rbp + 0x420], xmm0
mov dword [rbp + 0x468], 0
mov rax, qword [rbp + 0x4c0]
mov qword [rbp + 0x448], rax
movaps xmm0, xmmword [rbp + 0x4b0]
movups xmmword [rbp + 0x438], xmm0
mov rax, qword [rbp + 0x4e0]
mov qword [rbp + 0x460], rax
movups xmm0, xmmword [rbp + 0x4d0]
movups xmmword [rbp + 0x450], xmm0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x420]
call fcn.14005c5f0
jmp 0x140043eb2
mov byte [rbp + 0x4e9], 0
jmp 0x140043c2b
mov rax, qword [rbp + 0xc8]
mov byte [rbp + 0x4eb], 0
add rsp, 0x5c0
pop rbp
ret
mov al, byte [rbp + 0x7f]
test al, 1
jne 0x140043a4b
jmp 0x140043ee2
call fcn.1400433f0
mov qword [rbp - 0x20], rax
jmp 0x140043eed
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x518], 0
mov qword [rbp + 0x520], 0
mov rax, qword [rbp + 0x118]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x120]
call fcn.140043510
mov qword [rbp - 0x28], rax
jmp 0x140043f2e
mov r9, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
xor eax, eax
mov ecx, eax
mov r8d, 0x17
call sub.NETAPI32.dll_NetUserGetInfo
mov dword [rbp - 0x34], eax
jmp 0x140043f4a
mov eax, dword [rbp - 0x34]
cmp eax, 0
je 0x140043f63
lea rcx, [rbp + 0x120]
call fcn.14003f6d0
jmp 0x140043a4b
mov rax, qword [rbp + 0x120]
mov qword [rbp - 0x40], rax
and rax, 7
cmp rax, 0
jne 0x140043f8e
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax + 0x20]
lea rcx, [rbp + 0x128]
call fcn.14004b8e0
jmp 0x140043fa3
mov rdx, qword [rbp - 0x40]
lea r8, [0x140141cf0]
mov ecx, 8
call fcn.140138050
mov byte [rbp + 0x4e8], 1
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x128], rdx
cmove rax, rcx
cmp rax, 1
jne 0x14004400b
mov byte [rbp + 0x4e8], 0
mov byte [rbp + 0x4ea], 1
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x150], rax
movups xmm0, xmmword [rbp + 0x128]
movaps xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0x178]
lea rdx, [rbp + 0x140]
call fcn.14004bb00
jmp 0x140044036
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x128], rdx
cmove rax, rcx
cmp rax, 1
je 0x14004414b
jmp 0x140044154
lea r9, [0x140141d08]
lea rcx, [rbp + 0x160]
lea rdx, [rbp + 0x178]
lea r8, [rbp + 0x118]
call fcn.1400467f0
jmp 0x140044059
mov byte [rbp + 0x4ea], 0
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x210], rax
movaps xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x200], xmm0
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x1f0], rax
movaps xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0x1e0], xmm0
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x230], rax
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x220], xmm0
mov rax, qword [rbp + 0x118]
mov rdx, qword [rax]
lea rcx, [rbp + 0x238]
call fcn.140043650
jmp 0x1400440cc
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1a0], rax
movaps xmm0, xmmword [rbp + 0x1e0]
movaps xmmword [rbp + 0x190], xmm0
mov dword [rbp + 0x1d8], 0
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x1b8], rax
movaps xmm0, xmmword [rbp + 0x220]
movups xmmword [rbp + 0x1a8], xmm0
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x1d0], rax
movups xmm0, xmmword [rbp + 0x238]
movups xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x190]
call fcn.14005c5f0
jmp 0x14004413f
mov byte [rbp + 0x4ea], 0
jmp 0x14004400b
test byte [rbp + 0x4e8], 1
jne 0x140044160
mov byte [rbp + 0x4e8], 0
jmp 0x140043f52
lea rcx, [rbp + 0x128]
call fcn.140040190
jmp 0x140044154