Function at 0x10cf9a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113da2c
mov eax, dword fs:[0]
push eax
sub esp, 0x544
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x102a97c
lea eax, [ebp - 0x530]
push eax
push 0x102a900
lea ecx, [ebp - 0x52c]
push 2
push ecx
mov dword [ebp - 0x530], ebx
call fcn.01075110
push 0x206
lea edx, [ebp - 0x216]
push ebx
push edx
mov dword [ebp - 4], ebx
mov word [ebp - 0x218], bx
call fcn.01084910
push 0x206
lea eax, [ebp - 0x41e]
push ebx
push eax
mov word [ebp - 0x420], bx
call fcn.01084910
mov eax, dword [esi]
sub eax, 0x10
mov dword [ebp - 0x534], 0x104
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x544], ebx
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
add esp, 0x30
or eax, ecx
jge 0x10cfa68
push ebx
mov ecx, esi
call fcn.010745e0
mov eax, dword [esi]
cmp dword [eax - 8], ebx
jge 0x10cfa79
push 0x80070057
call fcn.01071710
mov dword [eax - 0xc], ebx
mov ecx, dword [esi]
lea edx, [ebp - 0x534]
push edx
lea eax, [ebp - 0x420]
push eax
push 0xc
mov word [ecx], bx
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10cfad7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10cfaaa
call esi
jmp 0x10cfab6
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x80070534
mov dword [ebp - 0x530], eax
jne 0x10cfc92
mov eax, 1
mov dword [ebp - 0x530], eax
jmp 0x10cfc92
lea ecx, [ebp - 0x534]
push ecx
lea edx, [ebp - 0x218]
push edx
push 2
mov dword [ebp - 0x534], 0x104
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10cfb2a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10cfb13
call esi
mov dword [ebp - 0x530], eax
jmp 0x10cfc92
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x530], eax
jmp 0x10cfc92
lea eax, [ebp - 0x538]
push eax
push ebx
push ebx
call dword [sym.imp.NTDSAPI.dll_DsBindW]
cmp eax, ebx
jne 0x10cfb91
lea edx, [ebp - 0x540]
push edx
lea eax, [ebp - 0x544]
push eax
push 1
push 8
lea ecx, [ebp - 0x218]
push 2
mov dword [ebp - 0x544], ecx
mov ecx, dword [ebp - 0x538]
push 2
push ecx
call dword [sym.imp.NTDSAPI.dll_DsCrackNamesW]
cmp eax, ebx
jne 0x10cfb91
mov eax, dword [ebp - 0x540]
cmp eax, ebx
je 0x10cfb91
cmp dword [eax], 1
jb 0x10cfb91
mov eax, dword [eax + 4]
cmp dword [eax], ebx
jne 0x10cfb91
mov edx, dword [eax + 8]
push edx
mov ecx, esi
call fcn.0107f660
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x10cfc7e
lea ecx, [ebp - 0x534]
push ecx
lea edx, [ebp - 0x218]
push edx
push 8
mov dword [ebp - 0x534], 0x104
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10cfc70
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x54c], ebx
call fcn.0107f6b0
lea ecx, [ebp - 0x54c]
push ecx
push 0x100e2bc
lea edx, [ebp - 0x548]
push edx
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 1
call fcn.010a3a80
lea eax, [ebp - 0x54c]
push eax
push 0x100e2bc
lea ecx, [ebp - 0x550]
push ecx
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 2
call fcn.010a3a80
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0109c210
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 2
call fcn.0111cdb0
push 0x40
mov ecx, esi
call fcn.010c7080
mov eax, dword [ebp - 0x548]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, esi
call fcn.0109dbe0
lea ecx, [ebp - 0x548]
call fcn.0111cdb0
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], bl
call fcn.0111cdb0
jmp 0x10cfc7e
lea edx, [ebp - 0x218]
push edx
mov ecx, esi
call fcn.0107f660
mov ecx, esi
call fcn.0109c120
mov ecx, eax
call fcn.0109c170
mov eax, dword [ebp - 0x530]
mov ecx, dword [ebp - 0x540]
cmp ecx, ebx
je 0x10cfca9
push ecx
call dword [sym.imp.NTDSAPI.dll_DsFreeNameResultW]
mov eax, dword [ebp - 0x530]
cmp dword [ebp - 0x538], ebx
je 0x10cfcc4
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.NTDSAPI.dll_DsUnBindW]
mov eax, dword [ebp - 0x530]
lea ecx, [ebp - 0x52c]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4