Function at 0x417127
Capabilities:
Get session information
Get session user name

Disassembly:
push 0x284
mov eax, 0x6177dc
call fcn.00429e48
lea eax, [ebp - 0x238]
xor ebx, ebx
push eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x238], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x284], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x41716a
or eax, 0xffffffff
or edx, eax
jmp 0x41744a
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0x101
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x218]
push eax
push ecx
call 0x416aff
or dword [ebp - 0x28c], 0xffffffff
mov edi, ebx
or dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x27c], edi
cmp dword [ebp - 0x238], ebx
jbe 0x417432
and dword [ebp - 0x288], 0
lea eax, [ebp - 0x23c]
and dword [ebp - 0x23c], 0
and dword [ebp - 0x280], 0
push eax
lea eax, [ebp - 0x280]
push eax
mov eax, dword [ebp - 0x284]
push 0x18
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov cl, 1
test eax, eax
jne 0x417269
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x224], 0
lea ecx, [ebp - 0x278]
push 1
push 2
push 1
push 0x8d319cc9
push 0x68d384
push str.OneDriveAuditor::GetUserLogOnTime
push 0xb2
mov esi, eax
mov dword [ebp - 0x22c], str.error
push str.D:dbs_shodct0219_230508_0cmdwclientonedriveProductStandaloneUpdaterStandaloneUpdaterLibOneDriveAuditor.cpp
mov dword [ebp - 0x230], 6
mov dword [ebp - 0x228], esi
call fcn.00458a4c
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0045974a
call fcn.004594ba
cmp esi, 0x32
jne 0x4173c7
xor cl, cl
and dword [ebp - 0x254], 0
xor eax, eax
and dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
and dword [ebp - 4], eax
test cl, cl
je 0x4172aa
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x254]
add eax, 0x82
push eax
call fcn.00411a05
jmp 0x41730a
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x288]
push eax
mov eax, dword [ebp - 0x284]
push 5
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov esi, eax
test esi, esi
je 0x4172ee
push dword [ebp - 0x288]
lea ecx, [ebp - 0x254]
call fcn.00411a05
push dword [ebp - 0x288]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
push esi
push ecx
call 0x416b8c
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x417355
lea edi, [esi + 0xc8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x41734f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x254]
call fcn.00417763
test al, al
je 0x41734f
push edi
call 0x41709a
mov esi, dword [ebp - 0x280]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], edx
mov edi, dword [ebp - 0x27c]
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x290], 0
jg 0x4173df
jl 0x417370
cmp dword [ebp - 0x28c], 0
jae 0x4173df
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x240]
cmp eax, 8
jb 0x4173c7
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x234], ecx
cmp eax, 0x1000
jb 0x4173be
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x234]
push eax
push ecx
call fcn.00429b68
pop ecx
pop ecx
inc edi
add ebx, 0xc
mov dword [ebp - 0x27c], edi
cmp edi, dword [ebp - 0x238]
jb 0x4171b7
jmp 0x417432
mov eax, dword [ebp - 0x240]
cmp eax, 8
jb 0x417432
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x27c], ecx
cmp eax, 0x1000
jb 0x417429
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00413aba
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x27c]
push eax
push ecx
call fcn.00429b68
pop ecx
pop ecx
push dword [ebp - 0x284]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [ebp - 0x28c]
mov edx, dword [ebp - 0x290]
call fcn.00429df7
ret