Function at 0x1001eb0d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push esi
push edi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001f3c0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x9c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xb4]
movzx eax, byte [eax]
test eax, eax
je 0x1001f39a
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x144], 0x196b
cmp dword [ebp - 0x144], 0xda1
jge 0x1001f32b
lea eax, [ebp - 0x38]
push eax
push 0x10009e78
call fcn.10055d2e
pop ecx
pop ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x54], 0
je 0x1001f32b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x10009f20
call fcn.10055d2e
add esp, 0x14
push 0
push 3
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.1006f350
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x3c]
je 0x1001ec26
push 0x10009f38
call fcn.10057e5c
pop ecx
jmp 0x1001ebc8
mov byte [ebp - 1], 0
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
add eax, dword [ebp - 0x14]
adc edx, dword [ebp - 0x10]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x18]
jg 0x1001ed4c
jl 0x1001ec6b
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x1c]
ja 0x1001ed4c
mov esi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
sbb edi, dword [ebp - 0x10]
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
sub esi, eax
sbb edi, edx
push 0
push 3
push edi
push esi
call fcn.1006f350
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], edx
mov eax, dword [ebp - 0xdc]
or eax, dword [ebp - 0xd8]
jne 0x1001ed4c
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
add eax, dword [ebp - 0xc]
adc edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sbb esi, dword [ebp - 0x18]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], edx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], esi
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0xe8]
jg 0x1001ed4c
jl 0x1001ed0a
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0xec]
ja 0x1001ed4c
mov esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
sbb edi, dword [ebp - 0x18]
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
sub esi, eax
sbb edi, edx
sub esi, dword [ebp - 0xc]
sbb edi, dword [ebp - 8]
push 0
push 3
push edi
push esi
call fcn.1006f350
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x48]
or eax, dword [ebp - 0x44]
jne 0x1001ed4c
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jg 0x1001ee42
jl 0x1001ed66
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
ja 0x1001ee42
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
adc ecx, dword [ebp - 8]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x18]
jg 0x1001ee42
jl 0x1001ed92
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x1c]
ja 0x1001ee42
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sbb ecx, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
push 0
push 3
push ecx
push eax
call fcn.1006f350
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x5c]
or eax, dword [ebp - 0x58]
jne 0x1001ee42
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sbb esi, dword [ebp - 0x18]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], esi
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x70]
jg 0x1001ee42
jl 0x1001ee00
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x74]
ja 0x1001ee42
mov esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
sbb edi, dword [ebp - 0x18]
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
sub esi, eax
sbb edi, edx
add esi, dword [ebp - 0x14]
adc edi, dword [ebp - 0x10]
push 0
push 3
push edi
push esi
call fcn.1006f350
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 0x80]
or eax, dword [ebp - 0x7c]
jne 0x1001ee42
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jg 0x1001ef74
jl 0x1001ee5c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
ja 0x1001ef74
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
adc ecx, dword [ebp - 8]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], ecx
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x18]
jg 0x1001ef74
jl 0x1001ee94
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x1c]
ja 0x1001ef74
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sbb ecx, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
push 0
push 3
push ecx
push eax
call fcn.1006f350
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x98]
or eax, dword [ebp - 0x94]
jne 0x1001ef74
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sbb esi, dword [ebp - 0x18]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], esi
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xac]
jg 0x1001ef74
jl 0x1001ef26
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xb0]
ja 0x1001ef74
mov esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
sbb edi, dword [ebp - 0x18]
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
sub esi, eax
sbb edi, edx
add esi, dword [ebp - 0xc]
adc edi, dword [ebp - 8]
push 0
push 3
push edi
push esi
call fcn.1006f350
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0xbc]
or eax, dword [ebp - 0xb8]
jne 0x1001ef74
mov byte [ebp - 1], 1
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
add eax, dword [ebp - 0xc]
adc edx, dword [ebp - 8]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x18]
jg 0x1001f0a2
jl 0x1001efb5
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x1c]
ja 0x1001f0a2
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x18]
sbb eax, edx
sub ecx, dword [ebp - 0xc]
sbb eax, dword [ebp - 8]
push 0
push 3
push eax
push ecx
call fcn.1006f350
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0xd4]
or eax, dword [ebp - 0xd0]
jne 0x1001f0a2
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
add eax, dword [ebp - 0x14]
adc edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sbb esi, dword [ebp - 0x18]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], esi
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xf0]
jg 0x1001f0a2
jl 0x1001f054
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xf4]
ja 0x1001f0a2
mov esi, dword [ebp - 0x24]
sub esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
sbb edi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x14]
sbb edi, dword [ebp - 0x10]
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
sub esi, eax
sbb edi, edx
push 0
push 3
push edi
push esi
call fcn.1006f350
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0x100]
or eax, dword [ebp - 0xfc]
jne 0x1001f0a2
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jg 0x1001f1d4
jl 0x1001f0bc
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
ja 0x1001f1d4
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x10]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x18]
jg 0x1001f1d4
jl 0x1001f0fd
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x1c]
ja 0x1001f1d4
push 0
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1005b740
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x18]
sbb eax, edx
add ecx, dword [ebp - 0x14]
adc eax, dword [ebp - 0x10]
push 0
push 3
push eax
push ecx
call fcn.1006f350
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x118]
or eax, dword [ebp - 0x114]
jne 0x1001f1d4
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
adc ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sbb esi, dword [ebp - 0x18]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], esi
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x12c]
jg 0x1001f1d4
jl 0x1001f193
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x130]
ja 0x1001f1d4
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sbb ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
sbb ecx, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
push 0
push 3
push ecx
push eax
call fcn.1006f350
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x140]
or eax, dword [ebp - 0x13c]
jne 0x1001f1d4
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jg 0x1001f306
jl 0x1001f1ee
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
ja 0x1001f306
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x18]
jg 0x1001f306
jl 0x1001f22f
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x1c]
ja 0x1001f306
push 0
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1005b740
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x18]
sbb eax, edx
add ecx, dword [ebp - 0xc]
adc eax, dword [ebp - 8]
push 0
push 3
push eax
push ecx
call fcn.1006f350
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x158]
or eax, dword [ebp - 0x154]
jne 0x1001f306
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
adc ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sbb esi, dword [ebp - 0x18]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], esi
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x170]
jg 0x1001f306
jl 0x1001f2c5
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x174]
ja 0x1001f306
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sbb ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
sbb ecx, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
push 0
push 3
push ecx
push eax
call fcn.1006f350
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x180]
or eax, dword [ebp - 0x17c]
jne 0x1001f306
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f31b
push 0x10009f3c
call fcn.10057e5c
pop ecx
jmp 0x1001f326
push 0x10009f38
call fcn.10057e5c
pop ecx
jmp 0x1001ebc8
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x110]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x178]
mov edx, dword [edx]
mov dword [ecx + eax], edx
jmp 0x1001f3bb
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
and dword [eax], 0
jmp 0x1001f4be
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x34], 0
jmp 0x1001f3e0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1001f3f6
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1a0], 0xfffffff6
jmp 0x1001f3d9
mov dword [ebp - 0x28], 0
jmp 0x1001f406
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x1001f476
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x198], 0x272
mov dword [ebp - 0x194], 0x272
mov dword [ebp - 0x190], 0x272
mov dword [ebp - 0x18c], 0x272
mov dword [ebp - 0x30], 1
jmp 0x1001f44b
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1001f462
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x1a0], 0
je 0x1001f460
jmp 0x1001f462
jmp 0x1001f444
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x198], 0
je 0x1001f474
jmp 0x1001f476
jmp 0x1001f3ff
mov dword [ebp - 0x28], 1
jmp 0x1001f486
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1001f4a4
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1001f4a2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1001f47f
push dword [ebp - 0x15c]
push 0
push 0x2000
push 0x6ad3
call fcn.1001e14e
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret