Function at 0x14002f750
Capabilities:
Get logon sessions
List user accounts

Disassembly:
push rbp
sub rsp, 0x5c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x538], 0xfffffffffffffffe
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rcx
mov byte [rbp + 0x4eb], 0
mov byte [rbp + 0x4ea], 0
mov byte [rbp + 0x4e9], 0
mov byte [rbp + 0x4e8], 0
mov byte [rbp + 0x4eb], 1
lea rcx, [rbp + 0xd0]
call fcn.140031070
mov dword [rbp + 0xec], 0
call fcn.14002f280
mov qword [rbp + 0xb8], rax
jmp 0x14002f7c0
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xf8], 0
mov dword [rbp + 0xfc], 0
mov qword [rbp + 0x528], 0
mov qword [rbp + 0x530], 0
lea rcx, [rbp + 0xf0]
call fcn.14002f3a0
mov qword [rbp + 0xb0], rax
jmp 0x14002f80d
mov r9, qword [rbp + 0xb0]
mov rax, rsp
lea rcx, [rbp + 0xec]
mov qword [rax + 0x38], rcx
lea rcx, [rbp + 0xfc]
mov qword [rax + 0x30], rcx
lea rcx, [rbp + 0xf8]
mov qword [rax + 0x28], rcx
mov dword [rax + 0x20], 0xffffffff
xor edx, edx
mov ecx, edx
mov r8d, 2
call sub.NETAPI32.dll_NetUserEnum
mov dword [rbp + 0xac], eax
jmp 0x14002f856
mov eax, dword [rbp + 0xac]
mov dword [rbp + 0x4ec], eax
cmp eax, 0
je 0x14002f874
mov eax, dword [rbp + 0xac]
cmp eax, 0xea
jne 0x14002f898
mov rcx, qword [rbp + 0xf0]
mov eax, dword [rbp + 0xf8]
mov edx, eax
call fcn.140028920
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], rax
jmp 0x14002f8ae
mov eax, dword [rbp + 0xac]
cmp eax, 0xea
jne 0x14002f96a
jmp 0x14002f959
mov rdx, qword [rbp + 0x98]
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x4f0], rcx
mov qword [rbp + 0x4f8], rdx
call fcn.14000df50
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], rax
jmp 0x14002f8df
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x100]
call fcn.140022ec0
mov qword [rbp + 0x80], rax
jmp 0x14002f910
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
cmp rax, 0
sete al
test al, 1
jne 0x14002f898
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov rcx, qword [rax]
call fcn.140001a50
mov byte [rbp + 0x7f], al
jmp 0x14002fd85
lea rcx, [rbp + 0xf0]
call fcn.14000b8a0
jmp 0x14002f7b2
lea rcx, [rbp + 0xf0]
call fcn.14000b8a0
jmp 0x14002f978
mov dword [rbp + 0x254], 0
call fcn.14002f440
mov qword [rbp + 0x70], rax
jmp 0x14002f98d
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x258], rax
lea rcx, [rbp + 0x258]
call fcn.14002f4c0
mov qword [rbp + 0x68], rax
jmp 0x14002f9aa
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x254]
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov dword [rbp + 0x64], eax
jmp 0x14002f9bf
mov eax, dword [rbp + 0x64]
cmp eax, 0
jne 0x14002f9e5
mov rcx, qword [rbp + 0x258]
mov eax, dword [rbp + 0x254]
mov edx, eax
call fcn.140028bd0
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x58], rax
jmp 0x14002fa19
mov rax, qword [rbp + 0xc0]
mov byte [rbp + 0x4eb], 0
mov rcx, qword [rbp + 0xe0]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x258]
call fcn.14000b6c0
jmp 0x14002fd6e
mov rdx, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x500], rcx
mov qword [rbp + 0x508], rdx
call fcn.140025a60
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rax
jmp 0x14002fa3e
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x260], rcx
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x260]
call fcn.140023890
mov qword [rbp + 0x38], rax
jmp 0x14002fa66
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
cmp rax, 0
sete al
test al, 1
jne 0x14002f9e5
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x510], rax
call fcn.14002f460
mov qword [rbp + 0x30], rax
jmp 0x14002faa4
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 0x278]
call fcn.14002f480
mov qword [rbp + 0x20], rax
jmp 0x14002fac1
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
call sub.Secur32.dll_LsaGetLogonSessionData
mov dword [rbp + 0x1c], eax
jmp 0x14002fad3
mov eax, dword [rbp + 0x1c]
cmp eax, 0
je 0x14002faec
lea rcx, [rbp + 0x278]
call fcn.140008a60
jmp 0x14002fa54
mov rcx, qword [rbp + 0x278]
call fcn.140028230
mov byte [rbp + 0x1b], al
jmp 0x14002fafd
mov al, byte [rbp + 0x1b]
test al, 1
jne 0x14002fadb
jmp 0x14002fb06
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x10], rax
and rax, 7
cmp rax, 0
jne 0x14002fb3c
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x280]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x2c0], 3
je 0x14002fb66
jmp 0x14002fb51
mov rdx, qword [rbp + 0x10]
lea r8, [0x140099f58]
mov ecx, 8
call fcn.140095c80
mov rdx, qword [rbp + 0x2c8]
lea rcx, [rbp + 0x3a8]
call fcn.140005970
jmp 0x14002fb77
lea rcx, [rbp + 0x278]
call fcn.140008a60
jmp 0x14002fa54
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x3a8], rax
sete al
test al, 1
jne 0x14002fb91
jmp 0x14002fb9a
mov byte [rbp + 0x4e9], 0
jmp 0x14002fb66
mov rax, qword [rbp + 0x3b8]
mov qword [rbp + 0x3d0], rax
movups xmm0, xmmword [rbp + 0x3a8]
movaps xmmword [rbp + 0x3c0], xmm0
mov byte [rbp + 0x4e9], 1
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3a0], rax
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmmword [rbp + 0x390], xmm0
lea rcx, [rbp + 0xd0]
call fcn.140033850
mov qword [rbp], rdx
mov qword [rbp + 8], rax
jmp 0x14002fbef
mov rdx, qword [rbp]
mov rcx, qword [rbp + 8]
call fcn.140001b00
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rax
jmp 0x14002fc06
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], rax
lea rcx, [rbp + 0x3e0]
lea rdx, [rbp + 0x390]
call fcn.1400228f0
mov byte [rbp - 0x11], al
jmp 0x14002fc34
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14002fc52
jmp 0x14002fc3d
lea rcx, [rbp + 0x408]
lea rdx, [rbp + 0x390]
call fcn.140005b90
jmp 0x14002fc63
lea rcx, [rbp + 0x390]
call fcn.14000a020
jmp 0x14002fb91
lea r9, [0x140099f70]
lea rcx, [rbp + 0x3f0]
lea rdx, [rbp + 0x408]
lea r8, [rbp + 0x280]
call fcn.140028f10
jmp 0x14002fc86
mov byte [rbp + 0x4e9], 0
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x4a0], rax
movaps xmm0, xmmword [rbp + 0x390]
movaps xmmword [rbp + 0x490], xmm0
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x480], rax
movaps xmm0, xmmword [rbp + 0x490]
movaps xmmword [rbp + 0x470], xmm0
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x4c0], rax
movups xmm0, xmmword [rbp + 0x3f0]
movaps xmmword [rbp + 0x4b0], xmm0
lea rcx, [rbp + 0x4d0]
call fcn.140031090
jmp 0x14002fcef
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x430], rax
movaps xmm0, xmmword [rbp + 0x470]
movaps xmmword [rbp + 0x420], xmm0
mov dword [rbp + 0x468], 0
mov rax, qword [rbp + 0x4c0]
mov qword [rbp + 0x448], rax
movaps xmm0, xmmword [rbp + 0x4b0]
movups xmmword [rbp + 0x438], xmm0
mov rax, qword [rbp + 0x4e0]
mov qword [rbp + 0x460], rax
movups xmm0, xmmword [rbp + 0x4d0]
movups xmmword [rbp + 0x450], xmm0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x420]
call fcn.140031fb0
jmp 0x14002fd62
mov byte [rbp + 0x4e9], 0
jmp 0x14002fadb
mov rax, qword [rbp + 0xc8]
mov byte [rbp + 0x4eb], 0
add rsp, 0x5c0
pop rbp
ret
mov al, byte [rbp + 0x7f]
test al, 1
jne 0x14002f8fb
jmp 0x14002fd92
call fcn.14002f2a0
mov qword [rbp - 0x20], rax
jmp 0x14002fd9d
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x518], 0
mov qword [rbp + 0x520], 0
mov rax, qword [rbp + 0x118]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x120]
call fcn.14002f3c0
mov qword [rbp - 0x28], rax
jmp 0x14002fdde
mov r9, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
xor eax, eax
mov ecx, eax
mov r8d, 0x17
call sub.NETAPI32.dll_NetUserGetInfo
mov dword [rbp - 0x34], eax
jmp 0x14002fdfa
mov eax, dword [rbp - 0x34]
cmp eax, 0
je 0x14002fe13
lea rcx, [rbp + 0x120]
call fcn.140008980
jmp 0x14002f8fb
mov rax, qword [rbp + 0x120]
mov qword [rbp - 0x40], rax
and rax, 7
cmp rax, 0
jne 0x14002fe3e
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax + 0x20]
lea rcx, [rbp + 0x128]
call fcn.140005970
jmp 0x14002fe53
mov rdx, qword [rbp - 0x40]
lea r8, [0x140099f88]
mov ecx, 8
call fcn.140095c80
mov byte [rbp + 0x4e8], 1
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x128], rdx
cmove rax, rcx
cmp rax, 1
jne 0x14002febb
mov byte [rbp + 0x4e8], 0
mov byte [rbp + 0x4ea], 1
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x150], rax
movups xmm0, xmmword [rbp + 0x128]
movaps xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0x178]
lea rdx, [rbp + 0x140]
call fcn.140005b90
jmp 0x14002fee6
movabs rdx, 0x8000000000000000
mov eax, 1
xor ecx, ecx
cmp qword [rbp + 0x128], rdx
cmove rax, rcx
cmp rax, 1
je 0x14002fffb
jmp 0x140030004
lea r9, [0x140099fa0]
lea rcx, [rbp + 0x160]
lea rdx, [rbp + 0x178]
lea r8, [rbp + 0x118]
call fcn.140028e70
jmp 0x14002ff09
mov byte [rbp + 0x4ea], 0
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x210], rax
movaps xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x200], xmm0
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x1f0], rax
movaps xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0x1e0], xmm0
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x230], rax
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0x220], xmm0
mov rax, qword [rbp + 0x118]
mov rdx, qword [rax]
lea rcx, [rbp + 0x238]
call fcn.14002f500
jmp 0x14002ff7c
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1a0], rax
movaps xmm0, xmmword [rbp + 0x1e0]
movaps xmmword [rbp + 0x190], xmm0
mov dword [rbp + 0x1d8], 0
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x1b8], rax
movaps xmm0, xmmword [rbp + 0x220]
movups xmmword [rbp + 0x1a8], xmm0
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x1d0], rax
movups xmm0, xmmword [rbp + 0x238]
movups xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x190]
call fcn.140031fb0
jmp 0x14002ffef
mov byte [rbp + 0x4ea], 0
jmp 0x14002febb
test byte [rbp + 0x4e8], 1
jne 0x140030010
mov byte [rbp + 0x4e8], 0
jmp 0x14002fe02
lea rcx, [rbp + 0x128]
call fcn.14000a020
jmp 0x140030004