Function at 0x417a91
Capabilities:
Get session information
Get session user name

Disassembly:
push 0x264
mov eax, 0x59d923
call fcn.00462cd6
lea eax, [ebp - 0x238]
xor ebx, ebx
push eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x238], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x260], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x417ad4
or eax, 0xffffffff
or edx, eax
jmp 0x417d06
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x101
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
push ecx
call 0x4174c9
or dword [ebp - 0x26c], 0xffffffff
mov edi, ebx
or dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x268], edi
cmp dword [ebp - 0x238], ebx
jbe 0x417cee
lea eax, [ebp - 0x23c]
xor ecx, ecx
push eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x264], ecx
push eax
mov eax, dword [ebp - 0x260]
push 0x18
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x25c], ecx
push dword [ebx + eax]
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov cl, 1
test eax, eax
jne 0x417bbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x228], 0
mov esi, eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x230], str.error
push eax
push 1
push 1
push 0x8d319cc9
push 0x5eff88
push str.OneDriveAuditor::GetUserLogOnTime
mov edx, 0xb2
mov dword [ebp - 0x234], 6
mov ecx, str.d:dbs_shodct0423_142515cmd2clientonedriveproduct_standaloneupdater_standaloneupdaterlibonedriveauditor.cpp
mov dword [ebp - 0x22c], esi
call fcn.0041da21
call fcn.0041de26
cmp esi, 0x32
jne 0x417ccb
xor cl, cl
and dword [ebp - 0x248], 0
xor eax, eax
mov dword [ebp - 0x244], 7
mov word [ebp - 0x258], ax
and dword [ebp - 4], eax
test cl, cl
je 0x417bf7
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
add eax, 0x82
push eax
call fcn.004096b4
jmp 0x417c57
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x260]
push 5
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov esi, eax
test esi, esi
je 0x417c3b
push dword [ebp - 0x264]
lea ecx, [ebp - 0x258]
call fcn.004096b4
push dword [ebp - 0x264]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x244], 8
lea eax, [ebp - 0x258]
cmovae eax, dword [ebp - 0x258]
push eax
push esi
push ecx
call 0x417548
mov esi, dword [ebp - 0x25c]
test esi, esi
je 0x417ca1
lea edi, [esi + 0xc8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x417c9b
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x258]
call fcn.00417f8b
test al, al
je 0x417c9b
push edi
call 0x417a04
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], edx
mov edi, dword [ebp - 0x268]
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x270], 0
jg 0x417ce3
jl 0x417cbc
cmp dword [ebp - 0x26c], 0
jae 0x417ce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.0040aa69
inc edi
add ebx, 0xc
mov dword [ebp - 0x268], edi
cmp edi, dword [ebp - 0x238]
jb 0x417b21
jmp 0x417cee
lea ecx, [ebp - 0x258]
call fcn.0040aa69
push dword [ebp - 0x260]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [ebp - 0x26c]
mov edx, dword [ebp - 0x270]
call fcn.00462c80
ret