Function at 0x10151f8
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x1029c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 0x24]
push edi
mov edi, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x60c], edi
mov dword [ebp - 0x610], eax
call fcn.0101c4a4
test eax, eax
je 0x101540d
push 0
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x101540d
push dword [esi + 8]
call fcn.010060ba
test eax, eax
jne 0x101540d
push dword [edi + 8]
push dword [esi + 0x14]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c898
test eax, eax
jne 0x1015306
push dword [esi + 4]
push 0x9dd
call fcn.01019fbd
push eax
lea eax, [ebp - 0x200]
push 0xfe
push eax
call fcn.01003f97
add esp, 0x10
lea eax, [ebp - 0x200]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x20001
add eax, 0x40
push eax
call fcn.01019fd5
mov eax, 0x80004005
jmp 0x1015a5a
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x10153ff
xor edi, edi
inc edi
cmp eax, 0x50010001
je 0x1015336
cmp eax, 0xa0010001
je 0x10153ff
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x101533f
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push 0
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x1015a58
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 0xc], 0
je 0x10153ef
cmp dword [esi + 0x1bf0], 0
jne 0x1015a58
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebx]
push 0x1ab
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
mov esi, dword [ebp - 0x610]
add esp, 0x14
push 0xfe
push esi
call fcn.01018eca
test eax, eax
je 0x10152fc
push 0
push esi
call fcn.010182b0
test eax, eax
jne 0x10153e2
push 0x20a
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [ebp - 0x5fc]
mov dword [eax], esi
jmp 0x1015a50
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
jmp 0x1015a50
mov eax, dword [ebp - 0x600]
and dword [eax], 0
jmp 0x10152e9
push dword [esi + 4]
call fcn.0101c4a4
xor edi, edi
inc edi
test eax, eax
jne 0x1015663
cmp word [esi + 0x1be8], di
jne 0x1015663
mov eax, dword [ebp - 0x60c]
push dword [eax + 8]
push dword [esi + 0x14]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c898
test eax, eax
je 0x10152b2
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x10153ff
cmp eax, 0x50010001
je 0x1015487
cmp eax, 0xa0010001
je 0x10153ff
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x1015490
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push 0
push dword [esi + 0x10]
call fcn.010182b0
test eax, eax
jne 0x10155a3
lea eax, [ebp - 0x614]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x614], 0xfe
push 2
call sub.SspiCli.dll_GetUserNameExW
test al, al
jne 0x10154df
push 0x90
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
jmp 0x10152fc
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
push 0x30
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebx]
push 0x1ad
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
add esp, 0x14
cmp dword [esi + 0x1bf0], 0
jne 0x10155a3
push dword [ebx]
push 0x1ab
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
add esp, 0x14
push dword [esi + 0xc]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0xc]
call fcn.01018eca
test eax, eax
je 0x10152fc
cmp dword [esi + 0x1bf0], 0
jne 0x101558e
push 0
push dword [esi + 0xc]
call fcn.010182b0
test eax, eax
jne 0x101558e
push 0x20a
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
jmp 0x10155a9
mov ecx, dword [ebp - 0x5fc]
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
test byte [esi + 0x1be8], 0x10
je 0x1015650
mov ecx, dword [ebp - 0x60c]
cmp dword [ecx + 0xc], 0
je 0x1015a48
push eax
push 0x1ab
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
add esp, 0x14
push 0x1fc
add esi, 0xc
push esi
call fcn.01018894
test eax, eax
jne 0x1015607
call fcn.01018081
jmp 0x10152e9
push dword [esi]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi]
call fcn.01018eca
test eax, eax
je 0x10152fc
push 0
push dword [esi]
call fcn.010182b0
test eax, eax
jne 0x1015646
push 0x20a
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [esi]
mov ecx, dword [ebp - 0x5fc]
jmp 0x101565c
cmp dword [ecx], 0
jne 0x1015a48
mov eax, dword [esi + 0x14]
mov dword [ecx], eax
jmp 0x1015a48
cmp word [esi + 0x1be8], 2
jne 0x101584f
mov eax, dword [ebp - 0x60c]
push dword [eax + 8]
push dword [esi + 0x14]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c898
test eax, eax
je 0x10152b2
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x1015823
cmp eax, 0x50010001
je 0x10156d3
cmp eax, 0xa0010001
je 0x1015823
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x10156dc
mov eax, dword [ebp - 0x600]
and dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
test byte [esi + 0x1be8], 0x10
je 0x101577a
mov ecx, dword [ebp - 0x60c]
cmp dword [ecx + 0xc], 0
je 0x1015805
push eax
push 0x1ab
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
add esp, 0x14
push 0x1fc
add esi, 0xc
push esi
call fcn.01018894
test eax, eax
je 0x10155fd
push dword [esi]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi]
call fcn.01018eca
test eax, eax
je 0x10152fc
push 0
push dword [esi]
call fcn.010182b0
test eax, eax
jne 0x1015773
push 0x20a
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [esi]
jmp 0x1015808
cmp dword [esi + 0x1bf0], 0
jne 0x1015818
push 0
push dword [esi + 0x14]
call fcn.010182b0
test eax, eax
je 0x10157a2
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
jmp 0x1015818
push dword [ebx]
push 0x1ab
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
add esp, 0x14
push dword [esi + 0xc]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0xc]
call fcn.01018eca
test eax, eax
je 0x10152fc
push 0
push dword [esi + 0xc]
call fcn.010182b0
test eax, eax
jne 0x1015805
push 0x20a
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
mov eax, dword [ebp - 0x608]
jmp 0x1015a56
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push 0x1fc
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
call fcn.01017fee
jmp 0x10154cb
push 0
push dword [esi + 4]
call fcn.010182b0
test eax, eax
je 0x1015a58
test byte [esi + 0x1be8], 8
je 0x1015a58
mov eax, dword [ebp - 0x60c]
push dword [eax + 8]
push dword [esi + 0x14]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010185c9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c898
test eax, eax
je 0x10152b2
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x1015823
cmp eax, 0x50010001
je 0x10158d0
cmp eax, 0xa0010001
je 0x1015823
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x10158d9
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push dword [esi + 8]
call fcn.010060ba
test eax, eax
je 0x1015971
mov eax, dword [esi + 8]
mov dword [ebx], eax
lea eax, [esi + 0x818]
push eax
push 0xca
call fcn.01019fbd
push eax
lea eax, [ebp - 0x5f8]
push 0x1fc
push eax
call fcn.01003f97
add esp, 0x10
lea eax, [ebp - 0x5f8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call fcn.01018c65
test byte [esi + 0x1be8], 0x10
je 0x1015959
push 0
push dword [esi + 0xc]
call fcn.010182b0
test eax, eax
je 0x1015959
push 0xfc
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
mov eax, dword [ebp - 0x614]
jmp 0x101598a
push 0
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x101598c
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
push 0
push edi
push dword [esi + 0x10]
push dword [esi + 8]
call fcn.010182d1
test eax, eax
je 0x1015a92
test byte [esi + 0x1be8], 0x10
je 0x1015a6b
push 0
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x1015ab9
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 0xc], 0
je 0x1015ab9
push dword [esi + 8]
call fcn.010060ba
test eax, eax
jne 0x1015ab9
push dword [ebx]
push 0x1ab
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e6a
mov esi, dword [ebp - 0x610]
add esp, 0x14
push 0xfe
push esi
call fcn.01018eca
test eax, eax
je 0x10152fc
push 0
push esi
call fcn.010182b0
test eax, eax
jne 0x1015a40
push 0x20a
call fcn.01019fbd
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c65
mov eax, dword [ebp - 0x5fc]
mov dword [eax], esi
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01017692
leave
ret 0x24
cmp dword [esi + 0x1bf0], 0
jne 0x1015a48
mov eax, dword [ebp - 0x614]
cmp dword [eax], 0
jne 0x1015a48
push 0
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x1015a48
jmp 0x10159e1
test byte [esi + 0x1be8], 0x10
push 0
je 0x1015ac1
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x1015ab9
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 0xc], 0
jne 0x10159e1
mov eax, dword [esi + 0xc]
jmp 0x1015648
push dword [esi + 0x14]
call fcn.010182b0
test eax, eax
je 0x1015ad5
mov eax, dword [esi + 0x14]
jmp 0x1015648
cmp dword [esi + 0x1bf0], 0
jne 0x1015a48
push 0
push dword [esi + 8]
call fcn.010182b0
test eax, eax
je 0x1015a48
push dword [esi + 8]
call fcn.010060ba
test eax, eax
jne 0x1015a48
jmp 0x10159e1