Function at 0x1002dce6
Capabilities:
Get session user name

Disassembly:
mov eax, 0x100587f2
call fcn.10057898
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x28], edi
test cl, cl
je 0x1002dd2e
cmp byte [ebp + 0xc], 0
je 0x1002dd17
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x1002e0b8
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002e0b8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1002e0b8
cmp byte [ebp + 0x14], 0
je 0x1002dd62
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002e0b8
push 0x340d
push 0
push 0x2e0d
push 0x227b
mov dl, 1
xor cl, cl
call fcn.1002ce9b
add esp, 0x10
jmp 0x1002e0b8
mov dword [ebp - 0x34], edi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x5418
cmp dword [ebp - 0x1c], 0x55d8
jle 0x1002dda3
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.10001ca8
inc edi
cmp edi, 0x1e5c
jl 0x1002dd7b
inc esi
cmp esi, 0x3ec5
jl 0x1002dd79
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x53e1
mov dword [ebp - 0x48], eax
jge 0x1002ddc4
mov edx, str.sxyfcs_xxdemqka_vhotqbxkh_wcdeqs_zlmhgfp_zvgctvyj_mpcli_ttr_nhxy_lgfjblczk_kgbk_wqvztxt_ajwxq
mov ecx, 0x1006f978
call fcn.1000365f
or dword [ebp - 4], 0xffffffff
xor edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1002de06
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24], 0xd3df75dc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002ddf8
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1002de57
mov dword [ebp - 0x18], ebx
jmp 0x1002de26
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 0x31d83293
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002de18
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24], ecx
mov dword [ebp - 0x5c], ebx
jmp 0x1002de4d
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x24], 7
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], edx
jl 0x1002de3f
dec dword [ebp - 0x1c]
jns 0x1002de13
push ebx
push 0x33a1
xor cl, cl
call fcn.1002d5b7
mov eax, dword [edi]
pop ecx
mov dword [ebp - 0x38], eax
pop ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1002de7e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x20], 0x91a049fe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1002de70
push ecx
push 0x7c33
push ecx
push 0x56ba
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x11]
push ebx
mov edx, 0x4efe
call fcn.1002cb3d
add esp, 0x14
mov dword [ebp - 0x20], 0xfffffff2
cmp dword [ebp - 0x20], 0xfffffffd
jle 0x1002df97
mov dword [ebp - 0x1c], 0x24f84b81
mov dword [ebp - 0x18], 0x3152
cmp dword [ebp - 0x18], 0x3477
jle 0x1002df03
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1006f978
or eax, esi
cdq
push edx
push eax
call fcn.10001ca8
inc edi
cmp edi, 0x7741
jl 0x1002ded8
inc esi
cmp esi, 0x2f82
jl 0x1002ded6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x1c], ebx
jmp 0x1002df16
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x78], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002df08
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x2f7b
jge 0x1002df3b
mov edx, str.gcubw_ymx_bswtcq_oyze_smpbuzcxu_mxqyvfq_aiqxwdvin_eoyuerojb_pflsw_vqjmlab
mov ecx, 0x1006f978
call fcn.1000365f
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffe2
jmp 0x1002df83
push 0x791
push 0x6ec6
push ecx
push ecx
mov dl, 1
call fcn.1002e1a9
add esp, 0x10
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x19
je 0x1002df6a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x70], eax
inc dword [ebp - 0x20]
jmp 0x1002deab
push ebx
push ecx
lea eax, [ebp - 0x38]
mov edx, 0xd5
push eax
push 0x739d
push ecx
lea ecx, [ebp - 0x34]
call fcn.1002c9ab
add esp, 0x14
mov edi, ebx
mov dword [ebp - 0x30], 0x713a473e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x44], 0x47bb7ab6
mov dword [ebp - 0x18], ebx
jmp 0x1002dfdf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002dfd5
mov dword [ebp - 0x18], ebx
jmp 0x1002dff7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0xc9fa8bc0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1002dfe9
mov ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
imul eax, dword [ebp - 0x3c], 0xd2e8
neg ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 6
jmp 0x1002e090
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1002e03a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x50], 0x6986d6db
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002e02c
mov dword [ebp - 0x18], ebx
jmp 0x1002e053
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x68], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002e045
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x4c], ecx
inc dword [ebp - 0x68]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jne 0x1002e020
mov esi, dword [ebp - 0x34]
mov dl, 0xeb
mov cl, byte [edi + esi]
call fcn.10034279
mov byte [edi + esi], al
inc edi
cmp edi, 4
jb 0x1002dfb5
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret