Function at 0x40ef50
Capabilities:
Get logon sessions
Print debug messages
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1284
call fcn.00412130
mov eax, dword [0x442074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1280], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x126c], eax
lea eax, [ebp - 0x1270]
push edi
push eax
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x1278], edx
push eax
mov dword [ebp - 0x127c], ecx
mov dword [ebp - 0x1268], 0
mov dword [ebp - 0x1270], 0
mov dword [ebp - 0x1254], 0
mov dword [ebp - 0x1264], esi
mov dword [ebp - 0x1274], 1
mov dword [ebp - 0x125c], esi
mov dword [ebp - 0x1258], esi
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40f00c
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___err___d_n
lea eax, [ebp - 0x828]
push 0x410
push eax
call fcn.0040af70
add esp, 0x10
lea eax, [ebp - 0x828]
push eax
call ebx
xor edi, edi
cmp dword [ebp - 0x1268], esi
jbe 0x40f33b
nop word [eax + eax]
mov eax, dword [ebp - 0x1270]
test eax, eax
je 0x40f327
test esi, esi
jne 0x40f32b
lea ecx, [ebp - 0x1254]
push ecx
lea eax, [eax + edi*8]
push eax
call dword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
jne 0x40f2e7
mov eax, dword [ebp - 0x1254]
test eax, eax
je 0x40f2c3
cmp dword [eax + 0x2c], esi
je 0x40f291
mov ecx, dword [ebp - 0x127c]
cmp dword [eax + 0x28], ecx
jne 0x40f291
push dword [ebp - 0x1278]
push dword [eax + 0x10]
call fcn.0041ec0b
add esp, 8
test eax, eax
jne 0x40f28b
mov eax, dword [ebp - 0x1254]
push dword [ebp - 0x1280]
push dword [eax + 0x18]
call fcn.0041ec0b
add esp, 8
test eax, eax
jne 0x40f28b
push 0x410
push eax
lea eax, [ebp - 0xc38]
push eax
call fcn.00414870
add esp, 0xc
lea eax, [ebp - 0x1258]
push eax
mov eax, dword [ebp - 0x1254]
push dword [eax + 0x2c]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x40f25d
push dword [ebp - 0x1258]
lea eax, [ebp - 0x1250]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_s
push 0x208
push eax
call fcn.0040af70
mov eax, dword [ebp - 0x1258]
add esp, 0x10
test eax, eax
je 0x40f110
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x1260]
mov dword [ebp - 0x1258], 0
push eax
push 1
push 0
lea eax, [ebp - 0x1250]
mov dword [ebp - 0x125c], 0x208
push eax
push 0x80000002
mov dword [ebp - 0x1260], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f1c9
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x1274]
push eax
push 0
push str.ProfileImagePath
push dword [ebp - 0x1260]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1274]
cmp eax, 2
je 0x40f187
cmp eax, 1
jne 0x40f1bd
push 0x104
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
mov dword [ebp - 0x125c], eax
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0xc38]
push eax
call fcn.004205c8
add esp, 0xc
push dword [ebp - 0x1260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc38]
push eax
push edi
push str.GetSidFromEnumSess__:_ProfileImagePath__d____s_n
lea eax, [ebp - 0x828]
push 0x410
push eax
call fcn.0040af70
add esp, 0x14
lea eax, [ebp - 0x828]
push eax
call ebx
lea eax, [ebp - 0xc38]
push 0x5c
push eax
call fcn.004149ca
mov edx, eax
add esp, 8
test edx, edx
je 0x40f31a
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f213
sub ecx, esi
sar ecx, 1
cmp ecx, 1
jbe 0x40f22a
add edx, 2
test edx, edx
je 0x40f314
push dword [ebp - 0x1278]
push edx
call fcn.0041ec0b
add esp, 8
test eax, eax
jne 0x40f314
mov eax, dword [ebp - 0x1254]
mov esi, dword [eax + 0x2c]
mov dword [ebp - 0x1264], esi
jmp 0x40f31a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSidFromEnumSess__:_ConvertSidToStringSid___err___d_n
lea eax, [ebp - 0x828]
push 0x410
push eax
call fcn.0040af70
add esp, 0x10
lea eax, [ebp - 0x828]
push eax
call ebx
jmp 0x40f31a
mov eax, dword [ebp - 0x1254]
test eax, eax
je 0x40f2c3
push dword [eax + 0x28]
push dword [eax + 0x18]
push dword [eax + 0x10]
lea eax, [ebp - 0x828]
push edi
push str.GetSidFromEnumSess__:_i___d_:_szUserName___s__szDomain___s__dwSessionId___d_n
push 0x410
push eax
call fcn.0040af70
add esp, 0x1c
lea eax, [ebp - 0x828]
push eax
call ebx
jmp 0x40f31a
push str.GetSidFromEnumSess__:_lpSessionData__NULL._n
lea eax, [ebp - 0x828]
push 0x410
push eax
call fcn.0040af70
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call ebx
jmp 0x40f31a
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push edi
push str.GetSidFromEnumSess__:_LsaGetLogonSessionData__i__err___d_n
lea eax, [ebp - 0x828]
push 0x410
push eax
call fcn.0040af70
add esp, 0x14
lea eax, [ebp - 0x828]
push eax
call ebx
jmp 0x40f31a
mov esi, dword [ebp - 0x1264]
inc edi
cmp edi, dword [ebp - 0x1268]
jb 0x40f020
test esi, esi
je 0x40f33b
mov edi, dword [ebp - 0x126c]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
jmp 0x40f341
mov edi, dword [ebp - 0x126c]
push dword [edi]
lea eax, [ebp - 0x828]
push str.GetSidFromEnumSess__:_LsaEnumerateLogonSessions___lpszSid___s_n
push 0x410
push eax
call fcn.0040af70
add esp, 0x10
lea eax, [ebp - 0x828]
push eax
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [edi], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00411e49
mov esp, ebp
pop ebp
ret