Function at 0x4173ca
Capabilities:
Get session information
Get session user name

Disassembly:
push 0x284
mov eax, 0x60f244
call fcn.00429868
lea eax, [ebp - 0x238]
xor ebx, ebx
push eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x238], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x284], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x41740d
or eax, 0xffffffff
or edx, eax
jmp 0x4176f1
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0x101
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x218]
push eax
push ecx
call 0x416d9f
or dword [ebp - 0x28c], 0xffffffff
mov edi, ebx
or dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x27c], edi
cmp dword [ebp - 0x238], ebx
jbe 0x4176d9
and dword [ebp - 0x288], 0
lea eax, [ebp - 0x23c]
and dword [ebp - 0x23c], 0
and dword [ebp - 0x280], 0
push eax
lea eax, [ebp - 0x280]
push eax
mov eax, dword [ebp - 0x284]
push 0x18
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov cl, 1
test eax, eax
jne 0x41750c
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x224], 0
lea ecx, [ebp - 0x278]
push 1
push 2
push 1
push 0x8d319cc9
push 0x6825bc
push str.OneDriveAuditor::GetUserLogOnTime
push 0xb2
mov esi, eax
mov dword [ebp - 0x22c], str.error
push str.D:dbs_shodct0202_162706cmdcclientonedriveProductStandaloneUpdaterStandaloneUpdaterLibOneDriveAuditor.cpp
mov dword [ebp - 0x230], 6
mov dword [ebp - 0x228], esi
call fcn.004591ec
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0045a999
call fcn.0045a6b3
cmp esi, 0x32
jne 0x41766e
xor cl, cl
and dword [ebp - 0x254], 0
and dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
mov dword [ebp - 4], 1
test cl, cl
je 0x417551
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x254]
add eax, 0x82
push eax
call fcn.00411bb5
jmp 0x4175b1
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x288]
push eax
mov eax, dword [ebp - 0x284]
push 5
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov esi, eax
test esi, esi
je 0x417595
push dword [ebp - 0x288]
lea ecx, [ebp - 0x254]
call fcn.00411bb5
push dword [ebp - 0x288]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
push esi
push ecx
call 0x416e2c
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x4175fc
lea edi, [esi + 0xc8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x4175f6
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x254]
call fcn.00417a0a
test al, al
je 0x4175f6
push edi
call 0x41733d
mov esi, dword [ebp - 0x280]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], edx
mov edi, dword [ebp - 0x27c]
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x290], 0
jg 0x417686
jl 0x417617
cmp dword [ebp - 0x28c], 0
jae 0x417686
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x240]
cmp eax, 8
jb 0x41766e
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x234], ecx
cmp eax, 0x1000
jb 0x417665
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00413cba
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x234]
push eax
push ecx
call fcn.00429588
pop ecx
pop ecx
inc edi
add ebx, 0xc
mov dword [ebp - 0x27c], edi
cmp edi, dword [ebp - 0x238]
jb 0x41745a
jmp 0x4176d9
mov eax, dword [ebp - 0x240]
cmp eax, 8
jb 0x4176d9
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x27c], ecx
cmp eax, 0x1000
jb 0x4176d0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00413cba
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x27c]
push eax
push ecx
call fcn.00429588
pop ecx
pop ecx
push dword [ebp - 0x284]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [ebp - 0x28c]
mov edx, dword [ebp - 0x290]
call fcn.00429817
ret