Function at 0x40f170
Capabilities:
Get logon sessions
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1070
call fcn.004145d0
mov eax, dword [0x4371c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x1068], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1054], eax
xor edi, edi
lea eax, [ebp - 0x1060]
mov dword [ebp - 0x1064], edx
push eax
lea eax, [ebp - 0x1050]
mov dword [ebp - 0x1070], ecx
push eax
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x1060], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1058], edi
mov dword [ebp - 0x106c], 1
mov dword [ebp - 0x105c], edi
mov dword [ebp - 0x104c], edi
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x40f22c
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push 0x433558
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
xor esi, esi
cmp dword [ebp - 0x1050], esi
jbe 0x40f4d8
lea ebx, [ebx]
mov eax, dword [ebp - 0x1060]
test eax, eax
je 0x40f4c4
test edi, edi
jne 0x40f4c8
lea ecx, [ebp - 0x1048]
push ecx
lea eax, [eax + esi*8]
push eax
call dword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
jne 0x40f484
mov eax, dword [ebp - 0x1048]
test eax, eax
je 0x40f460
cmp dword [eax + 0x2c], edi
je 0x40f42e
mov ecx, dword [ebp - 0x1070]
cmp dword [eax + 0x28], ecx
jne 0x40f42e
push dword [ebp - 0x1064]
push dword [eax + 0x10]
call fcn.00412a87
add esp, 8
test eax, eax
jne 0x40f428
mov eax, dword [ebp - 0x1048]
push dword [ebp - 0x1068]
push dword [eax + 0x18]
call fcn.00412a87
add esp, 8
test eax, eax
jne 0x40f428
push 0x410
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.00414300
add esp, 0xc
lea eax, [ebp - 0x104c]
push eax
mov eax, dword [ebp - 0x1048]
push dword [eax + 0x2c]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x40f3fa
push dword [ebp - 0x104c]
lea eax, [ebp - 0x1044]
push 0x4335d0
push 0x208
push eax
call fcn.00412a6b
mov eax, dword [ebp - 0x104c]
add esp, 0x10
test eax, eax
je 0x40f330
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x106c]
mov dword [ebp - 0x104c], 0
push eax
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x105c], 0x208
push eax
lea eax, [ebp - 0xc34]
push eax
push ecx
lea edx, [ebp - 0x1044]
call fcn.0040f0b0
lea eax, [ebp - 0xc34]
push eax
push esi
push 0x433670
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a6b
add esp, 0x24
lea eax, [ebp - 0x824]
push eax
call ebx
lea eax, [ebp - 0xc34]
push 0x5c
push eax
call fcn.0041463b
mov edx, eax
add esp, 8
test edx, edx
je 0x40f4b7
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f3b0
sub ecx, edi
sar ecx, 1
cmp ecx, 1
jbe 0x40f3c7
add edx, 2
test edx, edx
je 0x40f4b1
push dword [ebp - 0x1064]
push edx
call fcn.00412a87
add esp, 8
test eax, eax
jne 0x40f4b1
mov eax, dword [ebp - 0x1048]
mov edi, dword [eax + 0x2c]
mov dword [ebp - 0x1058], edi
jmp 0x40f4b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4336d8
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f4b7
mov eax, dword [ebp - 0x1048]
test eax, eax
je 0x40f460
push dword [eax + 0x28]
push dword [eax + 0x18]
push dword [eax + 0x10]
lea eax, [ebp - 0x824]
push esi
push 0x433748
push 0x410
push eax
call fcn.00412a6b
add esp, 0x1c
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f4b7
push 0x4337f0
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a6b
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f4b7
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
push eax
push esi
push 0x433850
lea eax, [ebp - 0x824]
push 0x410
push eax
call fcn.00412a6b
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call ebx
jmp 0x40f4b7
mov edi, dword [ebp - 0x1058]
inc esi
cmp esi, dword [ebp - 0x1050]
jb 0x40f240
test edi, edi
je 0x40f4d8
mov esi, dword [ebp - 0x1054]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
jmp 0x40f4de
mov esi, dword [ebp - 0x1054]
push dword [esi]
lea eax, [ebp - 0x824]
push 0x4338c8
push 0x410
push eax
call fcn.00412a6b
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0041153d
mov esp, ebp
pop ebp
ret