Function at 0x10016f90
Capabilities:
Create thread
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100420b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
jmp 0x10016fbd
call fcn.10016330
push 0
push 0
push 0x10016de0
push 0x10015f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10067840], eax
push 0
push 0
push 0x10016de0
push 0x10012590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10068358], eax
call fcn.10016760
push 0x10066bac
push 0x10067d48
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x10067d48
mov ecx, 0x10068a98
call fcn.10006ad0
push 5
call fcn.10016820
add esp, 4
test eax, eax
je 0x10017056
push 1
call fcn.10016890
add esp, 4
test eax, eax
jne 0x1001704a
push 2
call fcn.10016890
add esp, 4
test eax, eax
je 0x10017054
mov dword [0x10068254], 5
jmp 0x10017060
mov dword [0x10068254], 7
push 0
push 0
push 0
push 0x10016d50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0x10016de0
push 0x10016740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x10067838]
call fcn.100100a0
test eax, eax
jne 0x100170ea
mov eax, 0xfdb7418b
push eax
lea ecx, [ebp - 0x41]
call fcn.1001fec0
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0
mov ecx, dword [0x10067834]
call fcn.10010200
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41]
call fcn.100182e0
call fcn.100049d0
mov ecx, dword [0x10067820]
call fcn.10009730
movzx ecx, al
test ecx, ecx
jne 0x1001711e
mov ecx, dword [0x10068360]
call fcn.100256d0
cmp eax, 1
jle 0x1001711e
push 0
mov ecx, dword [0x10068360]
call fcn.10024dd0
mov ecx, dword [0x10068364]
call fcn.10021700
mov byte [ebp - 0xd], 0
mov ecx, 0x1004864a
call fcn.10007080
mov dword [ebp - 0x18], eax
mov ecx, dword [0x10068360]
call fcn.10025b00
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10017166
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0x40
mov eax, dword [0x1006782c]
mov ecx, dword [eax + 0x148]
call ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10017177
mov dword [ebp - 0x18], 0xfffffffe
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [0x10067838]
call fcn.10024800
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x100171a0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [0x1006782c]
mov eax, dword [edx + 0x8c]
call eax
mov ecx, dword [0x10067838]
call fcn.10024ae0
call fcn.10001460
movzx ecx, al
test ecx, ecx
je 0x100171cd
mov ecx, dword [0x10067838]
call fcn.10010840
mov ecx, dword [0x10067838]
call fcn.10010870
mov ecx, dword [0x10068360]
call fcn.10022f30
mov ecx, dword [0x10068360]
call fcn.10022ef0
mov ecx, dword [0x10068360]
call fcn.10022db0
mov ecx, dword [0x10068360]
call fcn.10022e30
mov ecx, dword [0x10068360]
call fcn.10022e70
mov ecx, dword [0x10068360]
call fcn.10022df0
mov ecx, dword [0x10068360]
call fcn.10022eb0
mov ecx, dword [0x10068360]
call fcn.10022910
jmp 0x10017237
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret