Function at 0x100780e
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov eax, 0x100a4f8
mov esi, 0x100a4d4
mov ecx, 0x100a4bc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp + 0x10]
mov edx, 0x100a4b0
cmp eax, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], 0x10000
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x50], 0x100a498
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x40], ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
je 0x100787e
mov dword [ebp - 0x14], 0x20000
mov eax, dword [ebp - 0x14]
mov edi, dword [0x10230f8]
or ah, 0x80
push 0x100a364
push eax
push ebx
push ebx
push 0xa
mov dword [ebp + 0x14], eax
call edi
cmp eax, ebx
mov dword [esi + 8], eax
je 0x100790a
push 0x100a490
push dword [ebp + 0x14]
push ebx
push ebx
push 0xa
call edi
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x100790a
push 0x100a488
push dword [ebp - 0x14]
push ebx
push ebx
push 0xa
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x100790a
push ebx
push 4
push ebx
push eax
call dword [0x10230f4]
test eax, eax
je 0x100790a
push 0x200
mov dword [ebp - 0x1c], 0x100
call fcn.01005a7e
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x100dc12
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 1
call dword [0x1021684]
test al, al
jne 0x100da96
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
test eax, eax
jle 0x100dd00
call edi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
cmp edi, ebx
je 0x1007942
push ebx
push ebx
push dword [esi + 4]
push dword [esi]
push 0xc00003f4
push edi
call fcn.01007971
cmp dword [ebp - 0xc], ebx
jne 0x100dfc6
cmp dword [ebp - 0x10], ebx
jne 0x100dfdf
cmp edi, ebx
mov eax, edi
je 0x100dfee
pop edi
pop esi
pop ebx
leave
ret 0x10
lea edi, [esi + 0x24]
push ebx
push edi
push ebx
push ebx
push 3
push dword [esi + 0x20]
mov dword [edi], ebx
push 1
call dword [0x10230b4]
mov eax, dword [edi]
cmp eax, ebx
je 0x100790a
push eax
call fcn.01005a7e
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x100dc12
push ebx
push edi
push eax
push ebx
push 3
push dword [esi + 0x20]
push 1
call dword [0x10230b4]
test eax, eax
je 0x100790a
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0x12c
cmp edi, ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x54]
jne 0x100daf7
lea ecx, [ebp - 0x3c]
cmp edi, ebx
mov eax, 0x100b350
jne 0x100db05
mov eax, 0x100b324
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x28]
push 0x2710
push edx
push ebx
push ebx
push ebx
push ecx
push eax
push ebx
push dword [esi + 0x20]
push dword [ebp + 8]
call dword [0x1021660]
add esp, 0x2c
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100db5f
push eax
call dword [0x1021680]
pop ecx
push dword [ebp + 0xc]
test eax, eax
jg 0x100db4c
call dword [0x1021680]
pop ecx
mov dword [ebp - 0xc], eax
jmp 0x1007929
call dword [0x1021680]
and eax, 0xffff
pop ecx
or eax, 0x80070000
jmp 0x100db44
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [0x1021664]
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
jne 0x100db80
mov dword [ebp - 0xc], 0x80070525
jmp 0x1007929
cmp edi, ebx
je 0x100dc1e
push 0x100a498
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [0x102166c]
add esp, 0xc
mov dword [esi + 0x14], eax
push 0x100a4b0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [0x102166c]
add esp, 0xc
mov dword [esi + 0x1c], eax
neg edi
sbb edi, edi
lea eax, [ebp - 8]
and edi, 0x20
push eax
or edi, 0x800
push edi
push dword [ebp + 8]
call dword [0x1023130]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x1007929
cmp dword [ebp - 8], ebx
je 0x100dfbe
push dword [ebp - 8]
call dword [0x102312c]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x100dfbe
lea edi, [eax + eax*8]
shl edi, 2
push edi
call fcn.01005a7e
mov edx, eax
cmp edx, ebx
mov dword [esi + 0x30], edx
jne 0x100dd24
mov dword [ebp - 4], 0x8007000e
jmp 0x1007929
push 0x100a4d4
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [0x102166c]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x100dc41
cmp dword [eax], ebx
jne 0x100db9f
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.DLL_GetUserNameW]
cmp dword [ebp + 0x14], ebx
je 0x100790a
push dword [esi + 0x20]
call dword [sym.imp.MSVCRT.DLL_wcslen]
pop ecx
mov ecx, dword [ebp + 0x14]
lea eax, [ecx + eax*2]
push eax
mov dword [ebp + 0x14], eax
call fcn.01005a7e
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100dc12
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_GetUserNameW]
test eax, eax
je 0x100790a
push ebx
push dword [esi + 0x20]
call dword [0x1021668]
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 0x10], eax
je 0x100dd19
push 0x100b320
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.DLL_wcscat]
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
cmp dword [eax], ebx
je 0x100dd07
mov eax, dword [ebp + 0x10]
push 3
push 0x100b318
push dword [eax]
call dword [sym.imp.MSVCRT.DLL_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x100dcf7
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 6
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.DLL_wcscat]
pop ecx
pop ecx
push 0x100b314
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.DLL_wcscat]
pop ecx
pop ecx
add dword [ebp + 0x10], 4
mov eax, dword [ebp + 0x10]
jmp 0x100dcb6
call edi
jmp 0x1007926
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.DLL_wcslen]
pop ecx
mov ecx, dword [ebp + 0xc]
mov word [ecx + eax*2 - 2], bx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
jmp 0x100db9f
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp - 4], ebx
and ecx, 3
cmp dword [ebp - 0x18], ebx
rep stosb byte es:[edi], al
mov dword [esi + 0x2c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x10], ebx
jbe 0x1007929
mov dword [ebp + 0xc], ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], ebx
jbe 0x100dd6e
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
call dword [0x1023124]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov eax, dword [ecx + eax*4 + 4]
cmp eax, ebx
je 0x100dd85
push eax
call fcn.01002494
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov eax, dword [ecx + eax*4 + 0x1c]
cmp eax, ebx
je 0x100dd9c
push eax
call fcn.01002494
mov ecx, dword [esi + 0x30]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + ecx + 0x20]
cmp eax, ebx
je 0x100ddba
push eax
mov eax, dword [esi + 0x2c]
lea eax, [eax + eax*8]
push dword [ecx + eax*4]
call dword [0x1023120]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov eax, dword [ecx + eax*4]
cmp eax, ebx
je 0x100dddd
push eax
call dword [0x102311c]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov dword [ecx + eax*4], ebx
cmp dword [ebp - 0xc], ebx
jne 0x1007929
cmp dword [ebp - 4], ebx
jne 0x1007929
cmp dword [ebp + 0xc], ebx
jbe 0x100ddfa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, ebx
je 0x1007929
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov dword [edx + eax*4], ecx
lea eax, [ebp + 8]
push eax
push 0x100a4f8
push dword [ebp - 8]
call dword [0x1023118]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x100dea4
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x100dea7
mov eax, dword [ecx]
cmp eax, ebx
je 0x100dfa7
mov edi, dword [sym.imp.MSVCRT.DLL_wcslen]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
call fcn.01005a7e
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
lea ecx, [ecx + ecx*8]
mov dword [edx + ecx*4 + 4], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov eax, dword [ecx + eax*4 + 4]
cmp eax, ebx
je 0x100defc
mov ecx, dword [ebp + 8]
push dword [ecx]
push eax
call dword [sym.imp.MSVCRT.DLL_wcscpy]
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x1023120]
lea eax, [ebp + 8]
push eax
push 0x100a498
push dword [ebp - 8]
call dword [0x1023118]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x100debf
mov dword [ebp - 0xc], ebx
inc dword [ebp + 0x10]
add dword [ebp + 0xc], 0x24
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x18]
jb 0x100dd50
jmp 0x1007929
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x100dea7
mov eax, dword [ecx]
cmp eax, ebx
je 0x100dfa7
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
call fcn.01005a7e
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
lea ecx, [ecx + ecx*8]
mov dword [edx + ecx*4 + 0x1c], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
mov eax, dword [ecx + eax*4 + 0x1c]
cmp eax, ebx
jne 0x100df11
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x1023120]
mov dword [ebp - 4], 0x8007000e
jmp 0x100dea7
mov ecx, dword [ebp + 8]
push dword [ecx]
push eax
call dword [sym.imp.MSVCRT.DLL_wcscpy]
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x1023120]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*8]
lea eax, [ecx + eax*4 + 0x20]
push eax
push 0x100b2e8
push dword [ebp - 8]
call dword [0x1023118]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x100dea7
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
call dword [0x1023128]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x100dea7
mov ecx, dword [esi + 0x30]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x20], 0x14
lea eax, [eax + eax*8]
lea eax, [ecx + eax*4 + 8]
push eax
push 3
push dword [ebp + 0x14]
call dword [0x10230b0]
test eax, eax
je 0x100dea7
push dword [ebp + 0x14]
call dword [0x10230e8]
inc dword [esi + 0x2c]
jmp 0x100dea7
cmp ecx, ebx
je 0x100dea7
push ecx
push dword [ebp - 8]
call dword [0x1023120]
jmp 0x100dea7
mov dword [esi + 0x2c], ebx
jmp 0x1007929
push ebx
push ebx
push dword [esi + 4]
push dword [esi]
push 0xc00003f5
push dword [ebp - 0xc]
call fcn.01007971
jmp 0x100794b
push dword [ebp - 0x10]
call dword [0x1021674]
pop ecx
jmp 0x1007954
mov eax, dword [ebp - 0xc]
jmp 0x100795e