Function at 0x100165c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1a0], edi
mov dword [ebp - 0x1a8], 0
call sym.vmtools.dll_Unicode_Duplicate
add esp, 4
cmp byte [edi], 0x7e
mov esi, eax
mov dword [ebp - 0x1b0], esi
je 0x10016620
push 0x24
push edi
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
test eax, eax
jne 0x10016620
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
xor edi, edi
cmp byte [esi], 0
push ebx
mov dword [ebp - 0x198], edi
je 0x100166a1
mov ebx, dword [sym.imp.MSVCR90.dll_strcspn]
cmp byte [esi], 0x24
jne 0x10016669
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [ecx]
cmp al, 0x30
jl 0x1001664a
cmp al, 0x39
jle 0x10016660
cmp al, 0x61
jl 0x10016652
cmp al, 0x7a
jle 0x10016660
mov dl, al
sub dl, 0x41
cmp dl, 0x19
jbe 0x10016660
cmp al, 0x5f
jne 0x10016663
inc ecx
jmp 0x10016640
sub ecx, esi
mov eax, ecx
jmp 0x10016674
push 0x10064b9c
push esi
call ebx
add esp, 8
cmp edi, 0x64
jge 0x10016742
mov dword [ebp + edi*4 - 0x4d0], esi
mov dword [ebp + edi*4 - 0x340], eax
mov byte [ebp + edi - 0xcc], 0
add esi, eax
inc edi
cmp byte [esi], 0
jne 0x10016634
mov dword [ebp - 0x198], edi
xor eax, eax
mov dword [ebp - 0x1a4], eax
test edi, edi
jle 0x10016843
jmp 0x100166c0
mov esi, dword [ebp + eax*4 - 0x4d0]
cmp byte [esi], 0x24
jne 0x10016834
mov ebx, dword [ebp + eax*4 - 0x340]
cmp ebx, 1
je 0x10016834
mov cl, byte [ebx + esi]
lea edi, [esi + 1]
push edi
mov byte [ebp - 0x199], cl
mov byte [ebx + esi], 0
call sym.vmtools.dll_Posix_Getenv
push eax
call sym.vmtools.dll_Unicode_Duplicate
add esp, 8
test eax, eax
jne 0x100167e9
push 0x10064b98
push edi
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10016760
call dword [sym.imp.MSVCR90.dll__getpid]
push eax
push 0x1005f1cc
lea edx, [ebp - 0x68]
push 0x64
push edx
call sym.vmtools.dll_Str_Snprintf
lea eax, [ebp - 0x68]
push eax
call sym.vmtools.dll_UtilSafeStrdup0
add esp, 0x14
jmp 0x100167e9
mov eax, dword [ebp - 0x1a0]
push eax
push str.Util_ExpandString
push str._s:_Filename___s__has_too_many_chunks._n
call fcn.10003450
add esp, 0xc
jmp 0x1001690d
push str.USER
push edi
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x100167bb
lea ecx, [ebp - 0x1ac]
push ecx
lea edx, [ebp - 0x194]
push edx
mov dword [ebp - 0x1ac], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x100167ac
push 1
lea eax, [ebp - 0x194]
push 0xffffffffffffffff
push eax
call sym.vmtools.dll_Unicode_AllocWithLength
add esp, 0xc
test eax, eax
jne 0x100167e9
push str.unknown
call sym.vmtools.dll_Unicode_Duplicate
add esp, 4
jmp 0x100167e9
mov ecx, dword [ebp - 0x1a0]
push ecx
push edi
push str.Environment_variable__s_not_defined_in__s._n
call fcn.10003450
push 0x64
lea edx, [ebp - 0x68]
push esi
push edx
call sym.vmtools.dll_Str_Strcpy
push 0
lea eax, [ebp - 0x68]
push 0xffffffffffffffff
push eax
call sym.vmtools.dll_Unicode_AllocWithLength
add esp, 0x24
mov cl, byte [ebp - 0x199]
mov byte [ebx + esi], cl
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp + ecx*4 - 0x4d0], eax
test eax, eax
je 0x100168b4
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10016810
mov edi, dword [ebp - 0x198]
sub eax, esi
mov dword [ebp + ecx*4 - 0x340], eax
mov eax, dword [ebp - 0x1a4]
mov byte [ebp + ecx - 0xcc], 1
inc eax
cmp eax, edi
mov dword [ebp - 0x1a4], eax
jl 0x100166c0
xor ecx, ecx
xor edx, edx
xor eax, eax
cmp edi, 2
lea esi, [ecx + 1]
jl 0x10016875
lea ebx, [edi - 1]
jmp 0x10016860
add ecx, dword [ebp + eax*4 - 0x340]
add edx, dword [ebp + eax*4 - 0x33c]
add eax, 2
cmp eax, ebx
jl 0x10016860
cmp eax, edi
jge 0x10016881
mov esi, dword [ebp + eax*4 - 0x340]
inc esi
add edx, ecx
add edx, esi
push edx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 0x1a8], eax
test eax, eax
jne 0x100168d1
mov eax, dword [ebp - 0x1a0]
push eax
push str.Util_ExpandString
push str._s:_Cannot_allocate_memory_for_the_expansion_of___s_._n
call fcn.10003450
add esp, 0xc
jmp 0x1001690d
mov edx, dword [ebp - 0x1a0]
push edx
push 0
push str.Util_ExpandString
push str._s:_Cannot_allocate_memory_to_expand___s__in___s_._n
call fcn.10003450
add esp, 0x10
jmp 0x10016907
xor esi, esi
cmp dword [ebp - 0x198], esi
mov ebx, eax
jle 0x10016904
lea ecx, [ecx]
mov edi, dword [ebp + esi*4 - 0x340]
mov ecx, dword [ebp + esi*4 - 0x4d0]
push edi
push ecx
push ebx
call sub.MSVCR90.dll_memcpy
inc esi
add esp, 0xc
add ebx, edi
cmp esi, dword [ebp - 0x198]
jl 0x100168e0
mov byte [ebx], 0
mov edi, dword [ebp - 0x198]
mov ebx, dword [sym.imp.MSVCR90.dll_free]
xor esi, esi
test edi, edi
jle 0x1001693c
lea esp, [esp]
cmp byte [ebp + esi - 0xcc], 0
je 0x10016937
mov edx, dword [ebp + esi*4 - 0x4d0]
push edx
call ebx
add esp, 4
inc esi
cmp esi, edi
jl 0x10016920
mov eax, dword [ebp - 0x1b0]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1a8]
add esp, 4
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret