Function at 0x100c14b
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
lea ebp, [esp - 0x9a8]
sub esp, 0xa28
mov eax, dword [0x1016020]
push ebx
xor ebx, ebx
push esi
push edi
mov edi, 0x1fc
mov dword [ebp + 0x9a4], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x74], ebx
lea eax, [ebp + 0x3b0]
mov ecx, edi
mov byte [eax], bl
inc eax
dec ecx
jne 0x100c188
lea eax, [ebp + 0x7a8]
mov ecx, 0xfe
mov byte [eax], bl
inc eax
dec ecx
jne 0x100c199
push edi
push 0x1001404
lea eax, [ebp + 0x3b0]
push eax
call fcn.0100f97e
mov esi, dword [ebp + 0x9b0]
push ebx
push esi
call fcn.0100f1d5
test eax, eax
je 0x100c486
push esi
call fcn.01012a24
test eax, eax
jne 0x100c486
cmp esi, ebx
je 0x100c220
mov ax, word [esi]
cmp ax, bx
mov ecx, esi
je 0x100c212
cmp ax, 0x5c
jne 0x100c1f5
inc ecx
inc ecx
mov ax, word [ecx]
inc dword [ebp - 0x5c]
cmp ax, bx
jne 0x100c1e2
cmp word [ebp - 0x5c], 2
jne 0x100c20c
push edi
push esi
lea eax, [ebp + 0x3b0]
push eax
call fcn.0100f97e
jmp 0x100c220
cmp word [ebp - 0x5c], bx
jne 0x100c220
push edi
push esi
lea eax, [ebp + 0x3b0]
push eax
call fcn.01010072
mov ecx, 0x103
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x7c], ecx
lea eax, [ebp + 0x1a8]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100c23a
mov edi, dword [ebp + 0x9b4]
push ebx
push edi
call fcn.0100f1d5
test eax, eax
jne 0x100c276
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x100c270
call fcn.0100efe9
jmp 0x100c4f9
lea edi, [ebp + 0x1a8]
push 0x5c
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
cmp eax, ebx
je 0x100c287
lea edi, [eax + 2]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x5c]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x68]
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call esi
push dword [ebp - 0x70]
call fcn.0100f58f
cmp eax, ebx
mov dword [ebp - 0x68], eax
jne 0x100c2bf
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100c4f9
mov eax, dword [ebp - 0x78]
add eax, eax
push eax
call fcn.0100f58f
cmp eax, ebx
mov dword [ebp - 0x5c], eax
jne 0x100c2e4
call fcn.0100efe9
lea eax, [ebp - 0x68]
push eax
call fcn.0100fc2c
jmp 0x100c4f9
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x68]
push edi
push dword [ebp + 0x9b0]
call esi
test eax, eax
je 0x100c311
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x68]
call fcn.0100bebd
test eax, eax
jne 0x100c332
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.0101134d
lea eax, [ebp - 0x68]
push eax
call fcn.0100fc2c
lea eax, [ebp - 0x5c]
jmp 0x100c2d9
lea eax, [ebp - 0x68]
push eax
call fcn.0100fc2c
lea eax, [ebp - 0x5c]
push eax
call fcn.0100fc2c
mov esi, 0xfe
push esi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x7a8]
push eax
call fcn.0100f97e
push esi
push 0x1001280
lea eax, [ebp + 0x7a8]
push eax
call fcn.01010072
push esi
mov edi, 0x1001518
push edi
lea eax, [ebp + 0x7a8]
push eax
call fcn.01010072
mov esi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
lea eax, [ebp - 0x60]
push eax
push 0x80000002
lea eax, [ebp + 0x3b0]
push eax
call esi
test eax, eax
jne 0x100c266
lea eax, [ebp - 0x6c]
push eax
push 0x80000003
lea eax, [ebp + 0x3b0]
push eax
call esi
test eax, eax
jne 0x100c266
cmp dword [ebp - 0x60], ebx
je 0x100c3f5
lea eax, [ebp - 0x58]
push eax
mov esi, 0x20019
push esi
push ebx
push edi
push dword [ebp - 0x60]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call edi
cmp dword [ebp - 0x58], ebx
jne 0x100c3fa
cmp dword [ebp - 0x6c], ebx
je 0x100c467
lea eax, [ebp - 0x58]
push eax
push esi
push ebx
lea eax, [ebp + 0x7a8]
push eax
push dword [ebp - 0x6c]
call edi
cmp dword [ebp - 0x58], ebx
je 0x100c467
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9b8]
push dword [ebp - 0x58]
call fcn.0100bd2e
test eax, eax
jne 0x100c456
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.0101134d
cmp dword [ebp - 0x58], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100c436
push dword [ebp - 0x58]
call esi
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x60], ebx
je 0x100c443
push dword [ebp - 0x60]
call esi
mov dword [ebp - 0x60], ebx
cmp dword [ebp - 0x6c], ebx
je 0x100c4f9
push dword [ebp - 0x6c]
call esi
jmp 0x100c4f9
cmp dword [ebp - 0x58], ebx
je 0x100c467
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x60], ebx
je 0x100c478
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x60], ebx
cmp dword [ebp - 0x6c], ebx
je 0x100c50b
push dword [ebp - 0x6c]
jmp 0x100c505
lea eax, [ebp - 0x64]
push eax
mov esi, 0x20019
push esi
push ebx
mov edi, 0x1001518
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100c4bd
cmp dword [ebp - 0x64], ebx
jne 0x100c4c2
lea eax, [ebp - 0x64]
push eax
push esi
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x64], ebx
je 0x100c50b
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x9b8]
push dword [ebp - 0x64]
call fcn.0100bd2e
test eax, eax
jne 0x100c4fd
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.0101134d
cmp dword [ebp - 0x64], ebx
je 0x100c4f9
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100c519
cmp dword [ebp - 0x64], ebx
je 0x100c50b
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x9bc]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x9a4]
pop edi
pop esi
pop ebx
call fcn.0100eec6
add ebp, 0x9a8
leave
ret 0x10