Function at 0x41a23b
Capabilities:
Get session information
Get session user name

Disassembly:
push 0x284
mov eax, 0x60c038
call fcn.0042d958
lea eax, [ebp - 0x238]
xor ebx, ebx
push eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x238], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x284], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x41a27e
or eax, 0xffffffff
or edx, eax
jmp 0x41a55e
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0x101
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x218]
push eax
push ecx
call 0x419b6f
or dword [ebp - 0x28c], 0xffffffff
mov edi, ebx
or dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x27c], edi
cmp dword [ebp - 0x238], ebx
jbe 0x41a546
and dword [ebp - 0x288], 0
lea eax, [ebp - 0x23c]
and dword [ebp - 0x23c], 0
and dword [ebp - 0x280], 0
push eax
lea eax, [ebp - 0x280]
push eax
mov eax, dword [ebp - 0x284]
push 0x18
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov cl, 1
test eax, eax
jne 0x41a37d
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x224], 0
lea ecx, [ebp - 0x278]
push 1
push 2
push 1
push 0x8d319cc9
push 0x677a4c
push str.OneDriveAuditor::GetUserLogOnTime
push 0xb2
mov esi, eax
mov dword [ebp - 0x22c], str.error
push str.d:dbs_shodct1105_210049_0cmd7clientonedriveProductStandaloneUpdater_standaloneupdaterlibOneDriveAuditor.cpp
mov dword [ebp - 0x230], 6
mov dword [ebp - 0x228], esi
call fcn.0045dd2d
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0045ea98
call fcn.0045e7ff
cmp esi, 0x32
jne 0x41a4db
xor cl, cl
and dword [ebp - 0x254], 0
xor eax, eax
and dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
and dword [ebp - 4], eax
test cl, cl
je 0x41a3be
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x254]
add eax, 0x82
push eax
call fcn.00414483
jmp 0x41a41e
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x288]
push eax
mov eax, dword [ebp - 0x284]
push 5
push dword [ebx + eax]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov esi, eax
test esi, esi
je 0x41a402
push dword [ebp - 0x288]
lea ecx, [ebp - 0x254]
call fcn.00414483
push dword [ebp - 0x288]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
push esi
push ecx
call 0x419bfc
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x41a469
lea edi, [esi + 0xc8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x41a463
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x254]
call fcn.0041a858
test al, al
je 0x41a463
push edi
call 0x41a1ae
mov esi, dword [ebp - 0x280]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], edx
mov edi, dword [ebp - 0x27c]
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x290], 0
jg 0x41a4f3
jl 0x41a484
cmp dword [ebp - 0x28c], 0
jae 0x41a4f3
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x240]
cmp eax, 8
jb 0x41a4db
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x234], ecx
cmp eax, 0x1000
jb 0x41a4d2
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00415d5a
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x234]
push eax
push ecx
call fcn.0042d678
pop ecx
pop ecx
inc edi
add ebx, 0xc
mov dword [ebp - 0x27c], edi
cmp edi, dword [ebp - 0x238]
jb 0x41a2cb
jmp 0x41a546
mov eax, dword [ebp - 0x240]
cmp eax, 8
jb 0x41a546
mov ecx, dword [ebp - 0x254]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x27c], ecx
cmp eax, 0x1000
jb 0x41a53d
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00415d5a
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x27c]
push eax
push ecx
call fcn.0042d678
pop ecx
pop ecx
push dword [ebp - 0x284]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [ebp - 0x28c]
mov edx, dword [ebp - 0x290]
call fcn.0042d907
ret