Function at 0x1014513
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x1029c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc34], eax
xor eax, eax
xor ebx, ebx
mov esi, 0x1fc
push esi
mov word [ebp - 0x5f8], ax
mov word [ebp - 0x200], ax
push 0x1001b78
lea eax, [ebp - 0x5f8]
push eax
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xc20], ebx
call fcn.01018bdf
push ebx
push edi
call fcn.010182b0
test eax, eax
je 0x10149c4
push edi
call fcn.01013556
test eax, eax
jne 0x10149c4
cmp edi, ebx
je 0x101460b
movzx eax, word [edi]
mov ecx, edi
cmp ax, bx
je 0x10145fd
movzx eax, ax
cmp ax, 0x5c
jne 0x10145da
inc ecx
inc ecx
movzx eax, word [ecx]
inc dword [ebp - 0xc08]
cmp ax, bx
jne 0x10145c4
cmp word [ebp - 0xc08], 2
jne 0x10145f4
push esi
push edi
lea eax, [ebp - 0x5f8]
push eax
call fcn.01018bdf
jmp 0x101460b
cmp word [ebp - 0xc08], bx
jne 0x101460b
push esi
push edi
lea eax, [ebp - 0x5f8]
push eax
call fcn.01018c22
mov eax, 0x103
mov dword [ebp - 0xc2c], eax
mov ecx, eax
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc24], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xc14], ebx
lea eax, [ebp - 0xa00]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1014636
push ebx
push dword [ebp - 0xc00]
call fcn.010182b0
test eax, eax
jne 0x101468a
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0xa00]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x101467e
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd5
xor eax, eax
jmp 0x1014a95
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xc00], eax
push 0x5c
push ebx
push dword [ebp - 0xc00]
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
cmp eax, ebx
je 0x10146a6
add eax, 2
mov dword [ebp - 0xc00], eax
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xc24]
push eax
push dword [ebp - 0xc08]
lea eax, [ebp - 0xc1c]
push eax
push dword [ebp - 0xc14]
push dword [ebp - 0xc00]
push edi
call esi
cmp dword [ebp - 0xc1c], ebx
je 0x1014664
push dword [ebp - 0xc1c]
call fcn.01018520
mov dword [ebp - 0xc14], eax
cmp eax, ebx
jne 0x1014700
push 0xe
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x1014664
mov eax, dword [ebp - 0xc24]
add eax, eax
push eax
call fcn.01018520
mov dword [ebp - 0xc08], eax
cmp eax, ebx
jne 0x1014744
push 0xe
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd5
lea eax, [ebp - 0xc14]
push eax
call fcn.01018819
jmp 0x1014677
lea ecx, [ebp - 0xc30]
push ecx
lea ecx, [ebp - 0xc24]
push ecx
push eax
lea eax, [ebp - 0xc1c]
push eax
push dword [ebp - 0xc14]
push dword [ebp - 0xc00]
push edi
call esi
test eax, eax
jne 0x1014794
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd5
lea eax, [ebp - 0xc14]
push eax
call fcn.01018819
lea eax, [ebp - 0xc08]
jmp 0x1014739
lea eax, [ebp - 0xbfc]
push eax
push dword [ebp - 0xc14]
call fcn.010140d4
test eax, eax
je 0x101476d
lea eax, [ebp - 0xc14]
push eax
call fcn.01018819
lea eax, [ebp - 0xc08]
push eax
call fcn.01018819
mov esi, 0xfe
push esi
lea eax, [ebp - 0xbfc]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.01018bdf
push esi
push 0x10013e4
lea eax, [ebp - 0x200]
push eax
call fcn.01018c22
push esi
mov edi, 0x1001d48
push edi
lea eax, [ebp - 0x200]
push eax
call fcn.01018c22
mov esi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
lea eax, [ebp - 0xc10]
push eax
push 0x80000002
lea eax, [ebp - 0x5f8]
push eax
call esi
mov dword [ebp - 0xc00], eax
cmp eax, ebx
je 0x101486b
lea eax, [ebp - 0x5f8]
push eax
push 0x9dc
call fcn.01019fbd
push eax
lea eax, [ebp - 0x7f8]
push 0x100
push eax
call fcn.01003f97
add esp, 0x10
lea eax, [ebp - 0x7f8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
push dword [ebp - 0xc00]
jmp 0x10146f5
lea eax, [ebp - 0xc18]
push eax
push 0x80000003
lea eax, [ebp - 0x5f8]
push eax
call esi
mov dword [ebp - 0xc00], eax
cmp eax, ebx
jne 0x1014825
cmp dword [ebp - 0xc10], ebx
je 0x10148e7
lea eax, [ebp - 0xc04]
push eax
mov esi, 0x20019
push esi
push ebx
push edi
push dword [ebp - 0xc10]
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
call edi
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xc04], ebx
jne 0x10148f3
cmp dword [ebp - 0xc18], ebx
je 0x1014993
lea eax, [ebp - 0xc04]
push eax
push esi
push ebx
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 0xc18]
call edi
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xc04], ebx
je 0x1014993
lea eax, [ebp - 0xc20]
push eax
push dword [ebp - 0xc28]
push dword [ebp - 0xc04]
call fcn.010132dd
test eax, eax
jne 0x1014979
push dword [ebp - 0xc00]
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd5
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0xc04], ebx
je 0x101494a
push dword [ebp - 0xc04]
call esi
mov dword [ebp - 0xc04], ebx
cmp dword [ebp - 0xc10], ebx
je 0x1014960
push dword [ebp - 0xc10]
call esi
mov dword [ebp - 0xc10], ebx
cmp dword [ebp - 0xc18], ebx
je 0x1014677
push dword [ebp - 0xc18]
call esi
jmp 0x1014677
cmp dword [ebp - 0xc04], ebx
je 0x1014993
push dword [ebp - 0xc04]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [ebp - 0xc04], ebx
cmp dword [ebp - 0xc10], ebx
je 0x10149ad
push dword [ebp - 0xc10]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [ebp - 0xc10], ebx
cmp dword [ebp - 0xc18], ebx
je 0x1014a84
push dword [ebp - 0xc18]
jmp 0x1014a7e
lea eax, [ebp - 0xc0c]
push eax
mov esi, 0x20019
push esi
push ebx
mov edi, 0x1001d48
push edi
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0xc00], eax
cmp eax, ebx
je 0x1014a10
cmp dword [ebp - 0xc0c], ebx
jne 0x1014a18
lea eax, [ebp - 0xc0c]
push eax
push esi
push ebx
push edi
push 0x80000001
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xc0c], ebx
je 0x1014a84
lea eax, [ebp - 0xc20]
push eax
push dword [ebp - 0xc28]
push dword [ebp - 0xc0c]
call fcn.010132dd
test eax, eax
jne 0x1014a70
push dword [ebp - 0xc00]
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd5
cmp dword [ebp - 0xc0c], ebx
je 0x1014677
push dword [ebp - 0xc0c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1014677
cmp dword [ebp - 0xc0c], ebx
je 0x1014a84
push dword [ebp - 0xc0c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0xc20]
mov ecx, dword [ebp - 0xc34]
mov dword [ecx], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01017692
leave
ret 0x10