Function at 0x10001181
Capabilities:
Get session user name
Print debug messages

Disassembly:
jmp 0x1000b710
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1002120c
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x180
cmp eax, 1
push ebx
jne 0x1000bae0
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x198], ebx
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x8d]
mov byte [esp + 0x8c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x8c]
push 0x104
push eax
push ebx
mov byte [esp + 0x1a4], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x8c]
push ecx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
call fcn.100011cc
lea ecx, [esp + 0x14]
mov byte [esp + 0x198], 2
call fcn.100016f9
push 0x1002e244
push str.XFNETLOG
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x1002e248
push str.XFNETFORCELOG
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x1002e24c
push str.NOPROTECTFILE
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x10029ba4
push str.WEBPORT
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x1002e29c
push str.NOHOOKUDP
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x1002e2a0
push str.NOHOOKALL
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x1002e2a8
push str.NOHOOKEXE
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
push 0x1002e2b0
push str.ALLIE
push str.YTSTATUS
lea ecx, [esp + 0x20]
call fcn.100010d7
mov ecx, dword [0x10029ba4]
push ecx
push str.web_port_is__d
push ebx
call fcn.100015f5
add esp, 0xc
call fcn.1000173f
push 0x1002e0f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x1a0]
lea ecx, [esp + 0x28]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x24]
mov dword [0x1002dae0], edx
push eax
push ecx
mov dword [esp + 0x2c], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x28]
lea ecx, [esp + 0x1c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x1c]
push str.system
push eax
mov byte [esp + 0x1a0], 3
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x1000b928
mov byte [0x1002e2ac], 1
push ebx
push 0x10029d4c
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find_3
test eax, eax
jle 0x1000b942
mov byte [0x1002e2ac], 1
push ebx
push str.LSASS.EXE
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find_3
test eax, eax
jle 0x1000b95c
mov byte [0x1002e2ad], 1
push str.Global_spi_mutex_2
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1002e2ac]
mov edx, dword [0x1002e2a0]
and ecx, 0xff
xor eax, eax
mov al, byte [0x1002e2ad]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x24]
push eax
push esi
push ecx
push edx
push str.DLL_PROCESS_ATTACH____cUserName:__s___s____hHookHandle:__x____g_bIsHookMainEXE:_d___g_nNoHookALL:_d__g_bIsSystemProcess:_d
call fcn.10001672
mov eax, dword [0x1002e2a8]
add esp, 0x1c
cmp eax, ebx
jne 0x1000b9db
cmp esi, ebx
jne 0x1000b9db
call fcn.10001136
cmp byte [0x1002e2ad], bl
jne 0x1000ba83
cmp byte [0x1002e2ac], bl
jne 0x1000ba83
call fcn.100015b4
jmp 0x1000b9e8
push str.DLL_PROCESS_ATTACH____NOHOOK1_or_hHookHandle_NULL_tDo_Nothing
call fcn.10001672
add esp, 4
cmp byte [0x1002e2ad], bl
jne 0x1000ba83
cmp byte [0x1002e2ac], bl
jne 0x1000ba83
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x804
jne 0x1000ba13
push str.jian_ti_CHS
jmp 0x1000ba2c
cmp ax, 0x404
jne 0x1000ba27
push str.fan_ti_cht
call ebp
push 0x10029c24
jmp 0x1000ba33
push str.other_CHS
call ebp
push 0x10029c14
push 2
call dword [sym.imp.MSVCRT.dll_setlocale]
add esp, 8
mov ecx, 0x1002daf8
call fcn.1000125d
test al, al
je 0x1000ba67
push str.__________
call fcn.10001672
add esp, 4
push str.__________
call ebp
mov byte [0x1002e296], 1
call fcn.10001212
call fcn.1000135c
call fcn.1000154b
cmp byte [0x1002e290], bl
je 0x1000ba83
call fcn.10001609
push str.DLL_PROCESS_ATTACH______End
call fcn.10001717
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x198], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x198], 1
call fcn.10001654
lea ecx, [esp + 0x20]
mov byte [esp + 0x198], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebp
jmp 0x1000bb22
xor ebx, ebx
cmp eax, ebx
jne 0x1000bb1d
push 0x1002e0f8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push str._______DLL_PROCESS_DETACH
call fcn.10001672
mov eax, dword [0x1002e254]
add esp, 4
cmp eax, ebx
je 0x1000bb16
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [0x1002e254], ebx
mov byte [0x1002e298], 1
mov eax, 1
mov ecx, dword [esp + 0x184]
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 0xc