Function at 0x100106c9
Capabilities:
Get session information
Get session user name
Identify system language via api

Disassembly:
push 8
mov eax, 0x10038964
call fcn.10020675
mov ebx, dword [ebp + 0xc]
push 0x1003e664
push ebx
call fcn.1000cc63
push str.A686911000006E71
push ebx
call fcn.1000cc63
mov esi, 0x1003d614
push esi
push ebx
call fcn.1000cc63
push 0x1003e670
push ebx
call fcn.1000cc63
mov eax, dword [0x10045344]
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
and dword [ebp - 4], 0
push 0x66
push 0x1003d510
lea eax, [ebp + 0xc]
call fcn.10001796
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
push dword [edi - 0xc]
mov eax, ebx
push edi
call fcn.1000d59a
push esi
push ebx
call fcn.1000cc63
or dword [ebp - 4], 0xffffffff
lea eax, [edi - 0x10]
call fcn.1000160d
push 0x1003e67c
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c18e
mov dword [esp], 0x1003e688
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c243
mov dword [esp], 0x1003e698
push ebx
call fcn.1000cc63
mov edi, 0x190
push edi
call fcn.10019ca9
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100107a3
push edi
push 0
push eax
call fcn.100207d0
mov edi, dword [ebp + 0xc]
add esp, 0xc
jmp 0x100107a5
xor edi, edi
push edi
call fcn.10009ccb
pop ecx
push edi
push ebx
call fcn.1000cc63
push esi
push ebx
call fcn.1000cc63
test edi, edi
je 0x100107c5
push edi
call fcn.1001d3d4
pop ecx
push str.S_MR_u7b:
push ebx
call fcn.1000cc63
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push 5
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x10010808
push dword [ebp + 0xc]
push ebx
call fcn.1000cc63
push esi
push ebx
call fcn.1000cc63
push dword [ebp + 0xc]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push str._f:y
push ebx
call fcn.1000cc63
push 0x40
call fcn.10019ca9
mov edi, eax
pop ecx
test edi, edi
je 0x10010833
push 0x40
push 0
push edi
call fcn.100207d0
add esp, 0xc
mov dword [ebp + 0xc], edi
jmp 0x10010837
and dword [ebp + 0xc], 0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push 0
call edi
mov edi, dword [ebp + 0xc]
push eax
push str._d___d
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push edi
push ebx
call fcn.1000cc63
push esi
push ebx
call fcn.1000cc63
test edi, edi
je 0x10010872
push edi
call fcn.1001d3d4
pop ecx
push 0x1003e6bc
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c2b5
mov dword [esp], 0x1003e6c8
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c36b
mov dword [esp], 0x1003e6d4
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c3f6
mov dword [esp], 0x1003e6e0
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c6ce
mov dword [esp], str._faS
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c85d
mov dword [esp], 0x1003e6f8
push ebx
call fcn.1000cc63
mov esi, ebx
call fcn.1000c8cf
push 0x1003e704
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c949
mov dword [esp], str._vz_:
push ebx
call fcn.1000cc63
mov esi, 0x208
push esi
call fcn.10019ca9
mov edi, eax
pop ecx
test edi, edi
je 0x10010924
push esi
push 0
push edi
call fcn.100207d0
add esp, 0xc
mov dword [ebp + 0xc], edi
jmp 0x10010928
and dword [ebp + 0xc], 0
mov edi, dword [ebp + 0xc]
or esi, 0xffffffff
call fcn.1000b886
push edi
push ebx
call fcn.1000cc63
mov edi, 0x1003d614
push edi
push ebx
call fcn.1000cc63
cmp dword [ebp + 0xc], 0
je 0x10010955
push dword [ebp + 0xc]
call fcn.1001d3d4
pop ecx
push str.6r_vz_:
push ebx
call fcn.1000cc63
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.1000b955
pop ecx
cmp eax, 0xffffffff
je 0x100109a1
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.1000b9b8
pop ecx
mov dword [ebp - 4], 1
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
mov eax, ebx
call fcn.1000d59a
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1000160d
push edi
push ebx
call fcn.1000cc63
push 0x1003e728
push ebx
call fcn.1000cc63
mov esi, 0x208
push esi
call fcn.10019ca9
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100109da
push esi
push 0
push eax
call fcn.100207d0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp + 0xc], eax
jmp 0x100109de
and dword [ebp + 0xc], 0
push esi
push dword [ebp + 0xc]
push 1
push str.TIME
push str.A686911000006E71
push SysReAllocString
call fcn.10009ddb
add esp, 0x18
push dword [ebp + 0xc]
push ebx
call fcn.1000cc63
push edi
push ebx
call fcn.1000cc63
cmp dword [ebp + 0xc], 0
je 0x10010a1a
push dword [ebp + 0xc]
call fcn.1001d3d4
pop ecx
push 0x1003e734
push ebx
call fcn.1000cc63
push ebx
call fcn.1000c9b5
mov dword [esp], str.ck_WL
push ebx
call fcn.1000cc63
mov edi, dword [ebp + 8]
push ebx
call fcn.100129e9
push 0x1003e74c
push ebx
call fcn.1000cc63
push ebx
call fcn.10019303
pop ecx
call fcn.10020714
ret 8