Function at 0x4258b0
Capabilities:
Get logon sessions
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x4a2120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], 0
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.004308d0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.004308d0
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00403190
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x18
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x425974
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push str.GetLoggedUserSid__:_WTSQuerySessionInformation___err___d_n
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
jmp 0x425a27
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x425a27
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x434]
add eax, 0x82
push eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00431171
add esp, 0xc
mov eax, dword [ebp - 0x434]
add eax, 0x60
push eax
push 0x104
lea ecx, [ebp - 0x424]
push ecx
call fcn.00431171
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call fcn.00430fc7
add esp, 4
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x424]
push eax
call fcn.00430fc7
add esp, 4
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x21c]
push edx
push str.GetLoggedUserSid__:_szUserName___s__szDomain___s__dwSessionId___d_n
push 0x80
push 0x4a4ae8
call fcn.00401600
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x425a36
mov eax, dword [ebp - 0x14]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x440], 0
cmp dword [ebp - 0x10], 0
je 0x425aa3
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x438]
push ecx
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
je 0x425aa3
mov eax, dword [ebp - 0x440]
push eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push str.GetLoggedUserSid__:_LsaEnumerateLogonSessions___err___d_n
push 0x10
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x44c], 0
jmp 0x425ad2
mov eax, dword [ebp - 0x44c]
add eax, 1
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x438]
jae 0x425b84
cmp dword [ebp - 0x448], 0
jne 0x425b84
lea eax, [ebp - 0x444]
push eax
mov ecx, dword [ebp - 0x44c]
mov edx, dword [ebp - 0x43c]
lea eax, [edx + ecx*8]
push eax
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
jne 0x425b7f
cmp dword [ebp - 0x444], 0
je 0x425b7f
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x28]
cmp ecx, dword [ebp - 0x10]
jne 0x425b7f
mov eax, dword [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x10]
push eax
call fcn.004310cb
add esp, 0xc
test eax, eax
jne 0x425b7f
mov eax, dword [ebp - 0x430]
push eax
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x18]
push eax
call fcn.004310cb
add esp, 0xc
test eax, eax
jne 0x425b7f
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x448], ecx
jmp 0x425ac3
cmp dword [ebp - 0x448], 0
je 0x425bc4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x448]
push ecx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004030c0
mov eax, dword [ebp - 0xc]
push eax
push str.GetLoggedUserSid__:_user_sid_is_found:__s_n
push 0x80
push 0x4a4ae8
call fcn.00401600
add esp, 0x10
cmp dword [ebp - 0xc], 0
je 0x425bd4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x43c], 0
je 0x425be9
mov eax, dword [ebp - 0x43c]
push eax
call sub.Secur32.dll_LsaFreeReturnBuffer
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043094a
mov esp, ebp
pop ebp
ret