Function at 0x100c03b
Capabilities:
Get session user name

Disassembly:
push 0x1c
push 0x100c208
call fcn.010015a0
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.0100bccd
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101fc44
push dword [esi + 0x30]
push 0x100c1f0
push ebx
call fcn.0100bd54
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101fc82
push dword [esi + 0x34]
push 0x100c1d8
push ebx
call fcn.0100bd54
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101fcb2
mov eax, dword [esi + 0x80]
add eax, 0x60
push eax
call fcn.0100bcf8
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x100c0ce
push eax
push 0x100c1c0
push ebx
call fcn.0100bd54
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
call fcn.01001fac
cmp dword [ebp - 0x1c], edi
jne 0x101fce2
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x54], edi
jne 0x101fd15
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x44], edi
jne 0x101fd62
mov eax, dword [esi + 0x80]
mov ecx, dword [eax + 0x5c]
cmp ecx, edi
jne 0x101fdaf
mov dword [ebp + 8], edi
mov dword [ebp - 0x24], 0x4b
push 0x96
mov ecx, esi
call fcn.01003587
mov dword [ebp + 8], eax
cmp eax, edi
je 0x100c252
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], 3
jae 0x100c168
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push 0xc
call sub.SspiCli.dll_GetUserNameExW
test al, al
jne 0x100c168
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp eax, 0x7a
je 0x101fe1d
cmp eax, 0xea
je 0x101fe1d
cmp eax, 0x54b
je 0x100c168
cmp eax, 0x534
jne 0x101fe15
mov eax, dword [0x1040184]
mov edi, 0x1040184
cmp eax, edi
je 0x100c19c
test byte [eax + 0x1c], 0x20
je 0x100c19c
cmp byte [eax + 0x19], 2
jb 0x100c19c
push dword [ebp - 0x1c]
push 0x100186c
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
mov eax, dword [0x1040184]
cmp dword [ebp - 0x1c], 0
jne 0x10193d8
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
movzx edx, word [ecx]
test dx, dx
je 0x100c224
cmp dx, 0x5c
je 0x100c224
inc ecx
inc ecx
jmp 0x100c1a9
cmp word [ecx], 0x5c
jne 0x101fe3a
xor eax, eax
mov word [ecx], ax
push dword [ebp + 8]
push 0x100c26c
push ebx
call fcn.0100bd54
cmp dword [ebp + 8], 0
je 0x100c252
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.01003520
mov dword [ebp - 4], 0xfffffffe
call fcn.0100c28d
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret 4
and dword [ebp - 0x1c], 0
jmp 0x100c241
mov dword [ebp + 8], eax
cmp eax, edi
je 0x100c168
jmp 0x100c121
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x100c252
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x18
jmp 0x101fc72
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x19
jmp 0x101fc72
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x1a
jmp 0x101fc72
add eax, 0x50
push eax
push 0x101fea0
push ebx
call fcn.0100bdab
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x100c0dd
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x1b
jmp 0x101fc72
add eax, 0x40
push eax
push 0x101fe84
push ebx
call fcn.0100bdab
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x100c0ec
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x1c
jmp 0x101fc72
add eax, 0x58
push 4
pop edx
cmp dx, word [eax]
jne 0x100c0fd
push 0x3a
pop edx
cmp dx, word [ecx + 2]
jne 0x100c0fd
push eax
push 0x101fe70
push ebx
call fcn.0100bdab
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x100c0fd
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x100c252
test byte [eax + 0x1c], 0x20
je 0x100c252
cmp byte [eax + 0x19], 2
jb 0x100c252
push dword [ebp - 0x1c]
push 0x100186c
push 0x1d
jmp 0x101fc72
inc dword [ebp - 0x20]
jmp 0x100c121
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.01003520
mov eax, dword [ebp - 0x24]
add eax, eax
push eax
mov ecx, esi
call fcn.01003587
jmp 0x10193e1
cmp eax, edi
je 0x100c241
test byte [eax + 0x1c], 0x20
je 0x100c241
cmp byte [eax + 0x19], 2
jb 0x100c241
push 0x100186c
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
jmp 0x100c241