Function at 0x1022917
Capabilities:
Get session information
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x146c
call fcn.0101bc80
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 9
pop edi
xor ebx, ebx
push 0x1080
lea eax, [ebp - 0x146c]
push ebx
push eax
mov dword [ebp - 0x3ec], 0x899
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0x3e4], 0x89a
mov dword [ebp - 0x3e0], 1
mov dword [ebp - 0x3dc], 0x89b
mov dword [ebp - 0x3d8], 2
mov dword [ebp - 0x3d4], 0x89d
mov dword [ebp - 0x3d0], 3
mov dword [ebp - 0x3cc], 0x89c
mov dword [ebp - 0x3c8], 4
mov dword [ebp - 0x3c4], 0x89e
mov dword [ebp - 0x3c0], 5
mov dword [ebp - 0x3bc], 0x89f
mov dword [ebp - 0x3b8], 6
mov dword [ebp - 0x3b4], 0x8a0
mov dword [ebp - 0x3b0], 7
mov dword [ebp - 0x3ac], 0x8a1
mov dword [ebp - 0x3a8], 8
mov dword [ebp - 0x3a4], 0x8a2
mov dword [ebp - 0x3a0], edi
mov dword [ebp - 0x39c], 0x8a3
mov dword [ebp - 0x398], 0xa
mov dword [ebp - 0x394], 0x8a4
mov dword [ebp - 0x390], 0xb
mov dword [ebp - 0x38c], 0x8a5
mov dword [ebp - 0x388], 0xc
mov dword [ebp - 0x384], 0x8a6
mov dword [ebp - 0x380], 0xd
mov dword [ebp - 0x37c], 0x8a7
mov dword [ebp - 0x378], 0xe
mov dword [ebp - 0x374], 0x8a8
mov dword [ebp - 0x370], 0xf
mov dword [ebp - 0x36c], 0x8a9
mov dword [ebp - 0x368], 0x10
mov dword [ebp - 0x364], 0x8aa
mov dword [ebp - 0x360], 0x11
mov dword [ebp - 0x35c], 0x8ab
mov dword [ebp - 0x358], 0x12
mov dword [ebp - 0x354], 0x8ac
mov dword [ebp - 0x350], 0x13
mov dword [ebp - 0x34c], 0x8ad
mov dword [ebp - 0x348], 0x14
call fcn.0101bc52
add esp, 0xc
lea eax, [ebp - 0x1464]
push eax
mov dword [ebp - 0x146c], esi
call fcn.0101f727
lea eax, [ebp - 0x320]
push eax
call fcn.0101f727
lea esi, [ebp - 0x1454]
mov eax, dword [ebp - 0x146c]
push reloc.msvcrt.dll_wcstoul
push esi
push dword [ebp + ebx*8 - 0x3ec]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jbe 0x10229f6
inc ebx
add esi, 0xc8
cmp ebx, 0x15
jb 0x1022728
mov eax, dword [ebp - 0x146c]
push dword [eax]
push dword [eax + 4]
lea eax, [ebp - 0x310]
push 0x100257c
push 0x208
push eax
call fcn.0101d67b
add esp, 0x14
test eax, eax
jl 0x1022a05
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x1468]
push eax
call fcn.0101fedd
mov esi, eax
test esi, esi
jne 0x10229b7
lea eax, [ebp - 0x146c]
push eax
call fcn.01021363
mov esi, eax
test esi, esi
jne 0x10229b7
mov ebx, 0xfde9
push ebx
push eax
mov eax, dword [ebp - 0x146c]
push 0x17
push 0x835
push dword [eax + 0x1c]
lea eax, [ebp - 0x320]
push eax
call fcn.010204bb
mov esi, eax
test esi, esi
jne 0x10229b7
mov ecx, edi
lea edi, [ebp - 0x344]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x31c]
add eax, eax
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x1468]
xor edi, edi
inc edi
mov dword [ebp - 0x340], 0x100530c
mov dword [ebp - 0x33c], 0x1005300
mov dword [ebp - 0x32c], edi
mov dword [ebp - 0x328], edi
call fcn.01020034
mov esi, eax
test esi, esi
jne 0x10229b7
mov eax, dword [ebp - 0x146c]
xor ecx, ecx
cmp dword [eax + 0x3c], ecx
je 0x10228ca
cmp dword [eax + 0xc], ecx
je 0x10228ca
push ebx
push ecx
push 0x17
push 0x837
push dword [eax + 0x1c]
lea eax, [ebp - 0x1464]
push eax
call fcn.010204bb
mov esi, eax
test esi, esi
jne 0x10229b7
mov eax, dword [ebp - 0x146c]
mov ecx, dword [eax + 8]
mov ebx, edi
mov edi, dword [ecx]
cmp edi, ecx
je 0x10228ca
push 1
push ebx
push edi
lea eax, [ebp - 0x146c]
push eax
call fcn.01021e78
mov esi, eax
test esi, esi
jne 0x10229b7
push eax
push ebx
push edi
lea eax, [ebp - 0x146c]
push eax
call fcn.01021e78
mov esi, eax
test esi, esi
jne 0x10229b7
mov edi, dword [edi]
mov eax, dword [ebp - 0x146c]
inc ebx
cmp edi, dword [eax + 8]
jne 0x1022889
mov ecx, dword [eax + 8]
mov ebx, dword [ecx]
cmp ebx, ecx
je 0x102298b
mov esi, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x54]
xor edx, edx
mov dword [ebp - 0x314], esi
cmp dx, word [esi]
je 0x1022980
cmp dx, word [ecx]
je 0x1022980
push ecx
push 0x1002ae0
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0100c705
add esp, 0x10
test eax, eax
jl 0x1022a05
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x344]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x1468]
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x340], 0x10052f4
mov dword [ebp - 0x330], 1
call fcn.01020034
mov esi, eax
test esi, esi
jne 0x10229b7
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x102297a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x146c]
mov ebx, dword [ebx]
cmp ebx, dword [eax + 8]
jne 0x10228d7
test byte [ebp - 0x1458], 1
je 0x10229a6
lea eax, [ebp - 0x146c]
push eax
call fcn.010206df
mov esi, eax
test esi, esi
jne 0x10229b7
push dword [ebp - 0x1468]
call fcn.01020360
mov esi, eax
test esi, esi
jne 0x10229b7
lea eax, [ebp - 0x320]
push eax
call fcn.0101f747
lea eax, [ebp - 0x1464]
push eax
call fcn.0101f747
cmp dword [ebp - 0x1468], 0
je 0x10229e3
push dword [ebp - 0x1468]
call fcn.0101f3b9
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1022a05
mov eax, 0x54f
mov esi, eax
jmp 0x10229b7