Function at 0x1001da57
Capabilities:
Get session user name

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
push edi
xor ebx, ebx
lea edi, [esp + 0x50]
push 8
mov edx, ecx
mov dword [esp + 0x18], ebx
pop ecx
xor eax, eax
mov dword [esp + 0x4c], edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], ebx
push eax
push ebx
push ebx
push 4
push edx
mov ebp, ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x30], eax
test eax, eax
je 0x1001dc9e
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x18]
push eax
push 4
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov ebp, eax
test ebp, ebp
je 0x1001dc89
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x50]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
mov ebp, eax
test ebp, ebp
je 0x1001dc89
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x400
push eax
push 0x10050bb8
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push ebx
xor eax, eax
inc eax
push eax
push 0xb
push 0x10050bb8
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x58]
push eax
xor eax, eax
inc eax
push eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x1001dc89
lea eax, [esp + 0x20]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
lea eax, [esp + 0x38]
push eax
push ebx
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x34]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
mov esi, dword [esp + 0x2c]
call edi
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x1001dc89
mov esi, dword [esp + 0x28]
call edi
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x34], eax
test eax, eax
je 0x1001dc89
mov esi, dword [esp + 0x24]
call edi
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x38], eax
test eax, eax
je 0x1001dc89
mov esi, dword [esp + 0x20]
call edi
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x3c], eax
test eax, eax
je 0x1001dc89
mov esi, dword [esp + 0x14]
call edi
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1001dc89
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x44]
push eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x48]
push eax
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
mov ebp, eax
test ebp, ebp
je 0x1001dc89
push dword [esp + 0x40]
push dword [esp + 0x48]
push dword [esp + 0x50]
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov ebp, eax
test ebp, ebp
je 0x1001dc89
push ebx
push 4
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov ebp, eax
push 1
test ebp, ebp
pop eax
cmovne ebp, eax
jmp 0x1001dc8c
xor eax, eax
inc eax
push dword [esp + 0x30]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
jmp 0x1001dca4
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
test eax, eax
je 0x1001dcbd
call edi
push dword [esp + 0x4c]
xor ecx, ecx
inc ecx
push ecx
push eax
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1001dccf
push eax
xor eax, eax
inc eax
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1001dce1
push eax
xor eax, eax
inc eax
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1001dcf3
push eax
xor eax, eax
inc eax
push eax
call edi
push eax
call esi
test ebx, ebx
je 0x1001dd01
xor eax, eax
push ebx
inc eax
push eax
call edi
push eax
call esi
pop edi
pop esi
test ebp, ebp
pop ebp
setne al
pop ebx
add esp, 0x64
ret