Function at 0x101969f0
Capabilities:
Get session user name
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc6c
push ebx
push ebp
push esi
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x31c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x64
lea edi, [esp + 0x18c]
rep stosd dword es:[edi], eax
mov ecx, 0x64
lea edi, [esp + 0x95c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10c]
push 0x40
push eax
mov byte [esp + 0x20], bl
mov byte [esp + 0x9c], bl
mov byte [esp + 0x154], bl
mov byte [esp + 0x114], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x7c], bl
mov byte [esp + 0x64], bl
call fcn.101935c0
add esp, 8
test eax, eax
jne 0x10196a83
lea ecx, [esp + 0x3c]
push ebx
lea edx, [esp + 0x110]
push ecx
push edx
call fcn.10192ad0
add esp, 0xc
test eax, eax
je 0x10196a83
mov byte [esp + 0x3c], bl
jmp 0x10196a89
cmp byte [esp + 0x3c], bl
jne 0x10196abb
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.10192f50
add esp, 8
test eax, eax
je 0x10196abb
mov ecx, dword [str.NoName]
mov dx, word [0x1020dd88]
mov al, byte [0x1020dd8a]
mov dword [esp + 0x3c], ecx
mov word [esp + 0x40], dx
mov byte [esp + 0x42], al
mov ecx, dword [esp + 0xc88]
push str.RNBO_SPN_LOCAL
push ecx
call fcn.101d5c48
add esp, 8
test eax, eax
jne 0x10196b15
mov edx, dword [str.RNBO_SPN_LOCAL]
mov eax, dword [0x1020cd58]
mov ecx, dword [0x1020cd5c]
mov dword [esp + 0x10c], edx
mov dx, word [0x1020cd60]
mov dword [esp + 0x110], eax
mov al, byte [0x1020cd62]
mov dword [esp + 0x114], ecx
mov word [esp + 0x118], dx
mov byte [esp + 0x11a], al
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
push edx
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x10196bab
lea eax, [esp + 0x14c]
push 0x40
lea ecx, [esp + 0x98]
push eax
push ecx
call fcn.1019ec30
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10196b7e
mov edx, dword [str.NoName]
mov ax, word [0x1020dd88]
mov cl, byte [0x1020dd8a]
mov dword [esp + 0x94], edx
mov word [esp + 0x98], ax
mov byte [esp + 0x9a], cl
jmp 0x10196bd3
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x94]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10196bd3
mov ecx, dword [str.NoName]
mov dx, word [0x1020dd88]
mov al, byte [0x1020dd8a]
mov dword [esp + 0x94], ecx
mov word [esp + 0x98], dx
mov byte [esp + 0x9a], al
mov eax, dword [esp + 0xc84]
xor ecx, ecx
mov dword [esp + 0x30], ecx
xor edx, edx
mov dword [esp + 0x34], ecx
and eax, 0xffff
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], edx
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edx
push 0x1020dd80
push ecx
mov dword [esp + 0x38], edx
call fcn.101bc928
mov ebp, dword [esp + 0xc8c]
lea eax, [esp + 0x30]
mov edx, dword [ebp + 0x6c]
push edx
push 0x1020dd7c
push eax
call fcn.101bc928
mov ecx, dword [esp + 0xca4]
lea edx, [esp + 0xf8]
and ecx, 0xffff
push ecx
push 0x1020dd80
push edx
call fcn.101bc928
mov eax, dword [0x1021d290]
lea ecx, [esp + 0x11c]
push eax
push 0x1020dd7c
push ecx
call fcn.101bc928
mov edx, dword [esp + 0xcc0]
lea eax, [esp + 0x11c]
and edx, 0xffff
push edx
push 0x1020dd80
push eax
call fcn.101bc928
mov ecx, dword [ebp + 0x1a8]
lea edx, [esp + 0xbc]
push ecx
push 0x1020dd7c
push edx
call fcn.101bc928
add esp, 0x48
lea eax, [esp + 0xd4]
push 0x284
push 0x1020dd80
push eax
call fcn.101bc928
push ebx
lea ecx, [esp + 0x84]
push 0x1020dd80
push ecx
call fcn.101bc928
push ebx
lea edx, [esp + 0x78]
push 0x1020dd80
push edx
call fcn.101bc928
add esp, 0x24
cmp word [ebp + 0x1ac], bx
jne 0x10196d08
push ebx
lea eax, [esp + 0xfc]
push 0x1020dd7c
push eax
call fcn.101bc928
push ebx
lea ecx, [esp + 0x90]
push 0x1020dd7c
push ecx
call fcn.101bc928
add esp, 0x18
cmp word [ebp + 0x1ac], 1
jne 0x10196d31
cmp word [ebp + 0x1ae], bx
jne 0x10196d31
push ebx
lea edx, [esp + 0x84]
push 0x1020dd7c
push edx
call fcn.101bc928
add esp, 0xc
lea eax, [esp + 0xd4]
lea ecx, [esp + 0x5c]
push eax
lea edx, [esp + 0x78]
push ecx
lea eax, [esp + 0x88]
push edx
lea ecx, [esp + 0xf8]
push eax
lea edx, [esp + 0xf0]
push ecx
lea eax, [esp + 0x10c]
push edx
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0x58]
push ecx
lea eax, [esp + 0x12c]
push edx
lea ecx, [esp + 0xb8]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push 0xc
push 0x1020dd78
call fcn.1019fa00
mov edx, eax
add esp, 0x38
cmp edx, ebx
jne 0x10196dad
push ebp
push 0x4a
call fcn.10196730
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x95c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.101bceaa
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x960]
push ecx
push edx
push str.findFirstUnitEx
push 3
push 0x1020dc74
call fcn.1019fa00
mov edx, eax
add esp, 0x18
cmp edx, ebx
jne 0x10196e15
pop edi
pop esi
pop ebp
mov ax, 0x4a
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x18c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.101bceaa
lea ecx, [esp + 0x190]
push ecx
call fcn.1019fae0
mov edx, eax
add esp, 8
cmp edx, ebx
jne 0x10196e6c
pop edi
pop esi
pop ebp
mov ax, 0x4a
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x18c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.101bceaa
lea ecx, [esp + 0x320]
lea edx, [esp + 0x190]
push ecx
push ebp
push edx
call fcn.1019d090
add esp, 0x10
cmp ax, bx
je 0x10196ed1
push ebp
push eax
call fcn.10196660
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
lea eax, [esp + 0x31c]
push eax
call fcn.1019f7d0
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x10196ef6
pop edi
pop esi
pop ebp
mov ax, 0x42
pop ebx
add esp, 0xc6c
ret
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x63c]
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x31c]
mov dword [esp + 0x20], ecx
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea eax, [esp + 0x63c]
push edx
lea ecx, [esp + 0x4b0]
push eax
push ecx
push esi
push 3
push 0x1020dc74
call fcn.1019f630
push esi
mov edi, eax
call fcn.101bceaa
add esp, 0x1c
cmp di, bx
je 0x10196f58
pop edi
pop esi
pop ebp
mov ax, 0x42
pop ebx
add esp, 0xc6c
ret
xor edi, edi
mov byte [esp + 0x63b], bl
mov esi, str.error
lea eax, [esp + 0x4ac]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10196f91
cmp cl, bl
je 0x10196f8d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10196f91
add eax, 2
add esi, 2
cmp cl, bl
jne 0x10196f6d
xor eax, eax
jmp 0x10196f96
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10196fbc
lea eax, [esp + 0x63c]
push eax
call fcn.101bfa53
mov edi, eax
add esp, 4
cmp di, 0x46
je 0x10196fbc
cmp di, 0x50
jne 0x101970c5
lea ecx, [esp + 0x68]
lea edx, [esp + 0xaec]
push ecx
lea eax, [esp + 0x7d0]
push edx
lea ecx, [esp + 0x324]
push eax
push ecx
push 3
push 0x1020dd78
call fcn.1019f630
add esp, 0x18
test eax, eax
je 0x10196ffb
pop edi
pop esi
pop ebp
mov ax, 0x42
pop ebx
add esp, 0xc6c
ret
lea edx, [esp + 0x7cc]
mov byte [esp + 0x95b], bl
push edx
mov byte [esp + 0xc7f], bl
mov byte [esp + 0x77], bl
call fcn.101bfa53
mov word [ebp + 0x44], ax
mov ax, word [esp + 0xc88]
lea ecx, [esp + 0x6c]
mov word [ebp + 0x42], ax
push ecx
call fcn.101bfa53
mov word [ebp + 0x1a4], ax
mov ax, word [ebp + 0x74]
add esp, 8
cmp ax, 1
je 0x1019704e
cmp ax, 2
jne 0x1019705f
mov edx, dword [esp + 0xc88]
push edx
push ebp
call fcn.10196580
add esp, 8
cmp di, bx
je 0x10197070
cmp di, 0x46
je 0x10197070
cmp di, 0x50
jne 0x101970c5
movsx esi, word [ebp + 0x5a]
lea eax, [esp + 0xaec]
inc esi
push eax
mov word [ebp + 0x5a], si
call fcn.101bfa53
add esp, 4
cmp di, bx
mov word [ebp + esi*2 + 0x46], ax
jne 0x101970bb
mov esi, dword [ebp + 0x5c]
lea ecx, [ebp + 0x64]
inc esi
push ecx
mov dword [ebp + 0x5c], esi
call fcn.101cdda5
add esp, 4
mov ax, di
mov dword [ebp + 0x68], 0x78
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
cmp di, 0x50
mov ax, 0x46
je 0x101970c8
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret