Function at 0x1003d950
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c5993
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x1022b584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [ecx + 0xc], ebx
jbe 0x1003de5a
mov dword [ebp - 0x50], ebx
mov eax, dword [eax]
lea edx, [ebp - 0x50]
push edx
push 9
push eax
mov ecx, dword [eax]
mov dword [ebp - 4], ebx
call dword [ecx + 0x28]
test eax, eax
mov eax, dword [ebp - 0x50]
jns 0x1003d9c4
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1003de5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1003de5a
xor ecx, ecx
mov dword [ebp - 0x44], ecx
test eax, eax
je 0x1003d9e8
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push 0x101d6d44
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x44]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 1
test ecx, ecx
jne 0x1003dad9
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003daab
push 0x1c
push str.Common_task_schedule_info.cc
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000cf00
mov byte [ebp - 4], 3
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x100]
push 0x8a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10007f90
mov esi, eax
push str.fail_:_error_to_get_logon_trigger_ptr
push esi
mov byte [ebp - 4], 4
call fcn.10008dd0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x100]
call fcn.10008e90
lea ecx, [ebp - 0x28]
call fcn.10007310
lea ecx, [ebp - 0x40]
call fcn.10007310
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
test eax, eax
je 0x1003dabc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1003de5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1003de5a
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1003de98
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x4c], eax
push str.Trigger
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.1003e240
test al, al
jne 0x1003db17
push 7
push str.Trigger
lea ecx, [ebp - 0x4c]
call fcn.1000f6e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 6
push 0x101d2d68
push eax
call fcn.100120d0
mov eax, dword [ebp - 0x4c]
add esp, 0xc
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
jne 0x1003db79
mov dword [ebp - 0x60], 0
cmp word [0x1022e640], 0
mov byte [ebp - 4], 7
jne 0x1003db68
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x100
push eax
push 0x1022e640
push 2
call sub.Secur32.dll_GetUserNameExW
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1003dea2
jmp 0x1003db89
push eax
call ebx
mov dword [ebp - 0x60], eax
test eax, eax
je 0x1003deac
jmp 0x1003db43
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
push 0x1022e640
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.1003e240
test al, al
jne 0x1003dbce
mov ecx, 0x1022e640
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003dbb1
sub ecx, edx
sar ecx, 1
push ecx
push 0x1022e640
lea ecx, [ebp - 0x48]
call fcn.1000f6e0
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 7
test esi, esi
jne 0x1003dc0b
xor edi, edi
mov dword [ebp - 0x68], edi
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003dbfa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1003deb6
jmp 0x1003dc1d
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x68], edi
test edi, edi
je 0x1003dec0
jmp 0x1003dbde
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 0xa
call fcn.1000ed90
mov ecx, eax
test ecx, ecx
je 0x1003deca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
push 0x101d6e84
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xb
call fcn.1003e240
test al, al
jne 0x1003dc68
push 0x101d6e84
lea ecx, [ebp - 0x48]
call fcn.1003c5d0
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 0xa
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov ebx, dword [ecx + 4]
cmp byte [ebx + 0xd], 0
jne 0x1003dcd8
test eax, eax
je 0x1003de98
mov ecx, dword [ebx + 0x10]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x1003dcb7
test si, si
je 0x1003dcb3
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1003dcb7
add ecx, 4
add edx, 4
test si, si
jne 0x1003dc91
xor ecx, ecx
jmp 0x1003dcbc
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x1003dccb
mov ebx, dword [ebx + 8]
mov ecx, dword [ebp - 0x5c]
jmp 0x1003dcd2
mov ecx, ebx
mov ebx, dword [ebx]
mov dword [ebp - 0x5c], ecx
cmp byte [ebx + 0xd], 0
je 0x1003dc84
mov ebx, dword [ebp - 0x58]
cmp ecx, ebx
je 0x1003dd25
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x1003ded4
mov edx, eax
nop dword [eax]
mov si, word [edx]
cmp si, word [ecx]
jne 0x1003dd16
test si, si
je 0x1003dd12
mov si, word [edx + 2]
cmp si, word [ecx + 2]
jne 0x1003dd16
add edx, 4
add ecx, 4
test si, si
jne 0x1003dcf0
xor ecx, ecx
jmp 0x1003dd1b
sbb ecx, ecx
or ecx, 1
mov esi, dword [ebp - 0x5c]
shr ecx, 0x1f
test cl, cl
je 0x1003dd27
mov esi, ebx
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003dd3f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x64]
cmp esi, dword [eax + 8]
je 0x1003ddaa
mov eax, dword [esi + 0x14]
sub eax, 0x10
push eax
call fcn.100121a0
lea esi, [eax + 0x10]
mov dword [ebp - 0x58], esi
push esi
mov byte [ebp - 4], 0xc
call fcn.101967d5
mov ebx, eax
mov eax, 0x88888889
mul ebx
lea eax, [ebp - 0x54]
shr edx, 5
mov ecx, edx
shl ecx, 4
sub ecx, edx
shl ecx, 2
sub ebx, ecx
push ebx
push edx
push str.PT_dM_dS
push eax
call fcn.100132f0
add esp, 0x18
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003ddaa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x1003de7a
xor esi, esi
mov dword [ebp - 0x58], esi
push esi
push edi
push dword [ebp - 0x60]
mov byte [ebp - 4], 0xd
push dword [ebp - 0x44]
call fcn.10044ce0
mov ecx, dword [ebp - 0x44]
add esp, 0x10
test ecx, ecx
je 0x1003dde2
mov dword [ebp - 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, 1
call esi
mov edx, dword [ebp - 0x54]
or eax, 0xffffffff
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003de0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push edi
call esi
push dword [ebp - 0x60]
call esi
mov edx, dword [ebp - 0x4c]
or eax, 0xffffffff
mov byte [ebp - 4], bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003de35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0
test eax, eax
je 0x1003de46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x1003de5a
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101799ce
mov esp, ebp
pop ebp
ret 8
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
jne 0x1003ddba
push 0x8007000e
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x8007000e
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x8007000e
call fcn.10009b10
push 0x80004005
call fcn.10009b10
push 0x80004005
call fcn.10009b10
int3