Function at 0x140100094
Capabilities:
Get logon sessions
Get session information

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor r14d, r14d
mov r13, rcx
test rcx, rcx
jne 0x1401000c6
mov eax, 0x80070057
jmp 0x14010031d
mov qword [rcx], r14
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x48], r14d
mov qword [rbp - 0x20], r14
call qword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
mov esi, eax
test eax, eax
jle 0x1401000f6
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x14010030c
mov rdi, r14
mov r12d, r14d
mov rbx, r14
mov r15d, r14d
cmp dword [rbp + 0x48], r14d
jbe 0x140100307
mov rax, qword [rbp - 0x20]
mov ecx, r15d
cmp dword [rax + rcx*8], 0x3e7
lea rdx, [rax + rcx*8]
jne 0x140100134
cmp dword [rdx + 4], r14d
je 0x1401002b2
jmp 0x14010013d
cmp dword [rax + rcx*8], 0x3e5
je 0x140100146
cmp dword [rax + rcx*8], 0x3e4
jne 0x140100150
cmp dword [rdx + 4], r14d
je 0x1401002b2
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x28]
mov ecx, r15d
mov qword [rbp - 0x28], r14
lea rcx, [rax + rcx*8]
call qword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
mov ecx, eax
call qword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
mov esi, eax
test eax, eax
jle 0x140100180
movzx esi, ax
or esi, 0x80070000
mov rcx, qword [rbp - 0x28]
test esi, esi
js 0x1401002a7
cmp dword [rcx + 0x44], r14d
je 0x1401002ac
mov edx, dword [rcx + 0x40]
lea eax, [rdx - 2]
test eax, 0xfffffff5
jne 0x1401002ac
cmp edx, 0xc
je 0x1401002ac
mov rcx, qword [rcx + 0x48]
mov edx, 0x18
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x1401002a3
mov rcx, qword [rbp - 0x28]
lea edx, [rax + 0x17]
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x1401002a3
mov rcx, qword [rbp - 0x28]
lea edx, [rax + 0xc]
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x1401002a3
mov rdx, qword [rbp - 0x28]
cmp word [rdx + 0x20], 0x20
jne 0x140100220
mov rcx, qword [rdx + 0x28]
lea rdx, str.Font_Driver_Host
call fcn.1400059ec
test eax, eax
je 0x1401002a3
mov rdx, qword [rbp - 0x28]
cmp word [rdx + 0x20], 0x1c
jne 0x14010023f
mov rcx, qword [rdx + 0x28]
lea rdx, str.Window_Manager
call fcn.1400059ec
test eax, eax
je 0x1401002a3
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x18], r14
lea rax, [rbp + 0x60]
mov dword [rbp + 0x60], r14d
lea r9, [rbp - 0x18]
mov edx, dword [rdx + 0x44]
mov r8d, 0x18
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x1401002a3
mov rcx, qword [rbp - 0x18]
mov r14d, dword [rcx]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [rbp - 0x28]
cmp qword [rcx + 0x50], rdi
jle 0x140100298
test r14d, r14d
jne 0x140100298
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rcx + 0x50]
mov r12d, dword [rcx + 0x44]
mov eax, r15d
mov rbx, qword [rbx + rax*8]
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
xor r14d, r14d
jmp 0x1401002b2
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1401002b2
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
inc r15d
cmp r15d, dword [rbp + 0x48]
jb 0x140100114
test r12d, r12d
je 0x140100307
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x1401002e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x1401002e9
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x14010030c
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x1401002f9
mov dword [rax], r12d
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x14010030c
mov qword [rax], rbx
jmp 0x14010030c
mov esi, 0x80070490
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14010031b
call qword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret