Function at 0x100152d0
Capabilities:
Get session user name

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x1008bc20]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0x10
mov eax, 0x10064bfe
call fcn.10045c3f
mov ebx, dword [ebp + 0x114]
mov esi, 0x104
push esi
xor edi, edi
lea eax, [ebp + 1]
push edi
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp], 0
call fcn.100457d0
add esp, 0xc
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.10013588
mov dword [ebp - 4], edi
push 0xffffffffffffffff
mov edi, str._SELF_
push edi
mov ecx, ebx
call fcn.10014897
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0xffffffff
je 0x10015359
push esi
lea eax, [ebp]
push eax
push dword [0x1008ec84]
call ebx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
push edi
call fcn.10015241
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
mov edi, str._SELFDIR_
push edi
call fcn.10014897
cmp eax, 0xffffffff
je 0x100153cb
push esi
lea eax, [ebp]
push eax
push dword [0x1008ec84]
call ebx
lea eax, [ebp]
push eax
xor esi, esi
call fcn.100465b0
pop ecx
test eax, eax
jbe 0x100153a6
lea eax, [ebp + esi]
cmp byte [eax], 0x2f
jne 0x10015397
mov byte [eax], 0x5c
lea eax, [ebp]
push eax
inc esi
call fcn.100465b0
pop ecx
cmp esi, eax
jb 0x1001538b
lea eax, [ebp]
push 0x5c
push eax
call fcn.100464f0
pop ecx
pop ecx
test eax, eax
je 0x100153ba
mov byte [eax], 0
lea eax, [ebp]
push eax
push edi
mov edi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10015241
jmp 0x100153ce
mov edi, dword [ebp - 0x10]
push 0xffffffffffffffff
mov ebx, str._ID_
push ebx
mov ecx, edi
call fcn.10014897
mov esi, 0x100685bc
cmp eax, 0xffffffff
je 0x10015419
mov ecx, dword [0x1008ec80]
xor eax, eax
cmp ecx, eax
je 0x10015400
cmp dword [ecx + 0x10], eax
je 0x10015400
mov ecx, dword [ecx + 0x10]
call fcn.100225f4
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.10013b39
add esp, 0xc
push dword [ebp - 0x18]
mov ecx, edi
push ebx
call fcn.10015241
push 0xffffffffffffffff
mov ebx, str._KID_
push ebx
mov ecx, edi
call fcn.10014897
cmp eax, 0xffffffff
je 0x1001545f
mov ecx, dword [0x1008ec80]
xor eax, eax
cmp ecx, eax
je 0x10015446
cmp dword [ecx + 0x10], eax
je 0x10015446
mov ecx, dword [ecx + 0x10]
call fcn.1002261a
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.10013b39
add esp, 0xc
push dword [ebp - 0x18]
mov ecx, edi
push ebx
call fcn.10015241
push 0xffffffffffffffff
mov ebx, str._SEQ_
push ebx
mov ecx, edi
call fcn.10014897
cmp eax, 0xffffffff
je 0x100154a5
mov ecx, dword [0x1008ec80]
xor eax, eax
cmp ecx, eax
je 0x1001548c
cmp dword [ecx + 0x10], eax
je 0x1001548c
mov ecx, dword [ecx + 0x10]
call fcn.100225a8
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.10013b39
add esp, 0xc
push dword [ebp - 0x18]
mov ecx, edi
push ebx
call fcn.10015241
push 0xffffffffffffffff
mov esi, str._USER_
push esi
mov ecx, edi
call fcn.10014897
mov ebx, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, 0x105
cmp eax, 0xffffffff
je 0x100154f2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], edi
call ebx
test eax, eax
jne 0x100154e5
lea eax, [ebp]
push str.error
push eax
call fcn.10046190
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
push esi
call fcn.10015241
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
mov esi, str._USERHASH_
push esi
call fcn.10014897
cmp eax, 0xffffffff
je 0x10015568
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
mov dword [ebp - 0x1c], edi
push eax
xor edi, edi
call ebx
test eax, eax
je 0x1001554a
xor eax, eax
cmp byte [ebp], al
je 0x10015544
mov ecx, eax
and ecx, 0x80000003
jns 0x10015530
dec ecx
or ecx, 0xfffffffc
inc ecx
movsx edx, byte [ebp + eax]
shl ecx, 3
shl edx, cl
xor edi, edx
inc eax
cmp byte [ebp + eax], 0
jne 0x10015521
xor edi, 0x1b5e8f34
push edi
lea eax, [ebp - 0x18]
push str._08x
push eax
call fcn.10013b39
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push dword [ebp - 0x18]
push esi
call fcn.10015241
push dword [ebp - 0x10]
call fcn.10040502
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.1004523d
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.10045c30
add ebp, 0x10c
leave
ret