Function at 0x1015119
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x1029c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 0x24]
push edi
mov edi, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x60c], edi
mov dword [ebp - 0x610], eax
call fcn.0101c4a3
test eax, eax
je 0x101532e
push 0
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x101532e
push dword [esi + 8]
call fcn.01005fdd
test eax, eax
jne 0x101532e
push dword [edi + 8]
push dword [esi + 0x14]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c897
test eax, eax
jne 0x1015227
push dword [esi + 4]
push 0x9dd
call fcn.01019fbc
push eax
lea eax, [ebp - 0x200]
push 0xfe
push eax
call fcn.01003e97
add esp, 0x10
lea eax, [ebp - 0x200]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x20001
add eax, 0x40
push eax
call fcn.01019fd4
mov eax, 0x80004005
jmp 0x101597b
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x1015320
xor edi, edi
inc edi
cmp eax, 0x50010001
je 0x1015257
cmp eax, 0xa0010001
je 0x1015320
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x1015260
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push 0
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x1015979
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 0xc], 0
je 0x1015310
cmp dword [esi + 0x1bf0], 0
jne 0x1015979
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebx]
push 0x1ab
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
mov esi, dword [ebp - 0x610]
add esp, 0x14
push 0xfe
push esi
call fcn.01018ec9
test eax, eax
je 0x101521d
push 0
push esi
call fcn.010181d0
test eax, eax
jne 0x1015303
push 0x20a
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [ebp - 0x5fc]
mov dword [eax], esi
jmp 0x1015971
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
jmp 0x1015971
mov eax, dword [ebp - 0x600]
and dword [eax], 0
jmp 0x101520a
push dword [esi + 4]
call fcn.0101c4a3
xor edi, edi
inc edi
test eax, eax
jne 0x1015584
cmp word [esi + 0x1be8], di
jne 0x1015584
mov eax, dword [ebp - 0x60c]
push dword [eax + 8]
push dword [esi + 0x14]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c897
test eax, eax
je 0x10151d3
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x1015320
cmp eax, 0x50010001
je 0x10153a8
cmp eax, 0xa0010001
je 0x1015320
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x10153b1
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push 0
push dword [esi + 0x10]
call fcn.010181d0
test eax, eax
jne 0x10154c4
lea eax, [ebp - 0x614]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x614], 0xfe
push 2
call sub.SspiCli.dll_GetUserNameExW
test al, al
jne 0x1015400
push 0x90
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
jmp 0x101521d
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
push 0x30
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebx]
push 0x1ad
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
add esp, 0x14
cmp dword [esi + 0x1bf0], 0
jne 0x10154c4
push dword [ebx]
push 0x1ab
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
add esp, 0x14
push dword [esi + 0xc]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0xc]
call fcn.01018ec9
test eax, eax
je 0x101521d
cmp dword [esi + 0x1bf0], 0
jne 0x10154af
push 0
push dword [esi + 0xc]
call fcn.010181d0
test eax, eax
jne 0x10154af
push 0x20a
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
jmp 0x10154ca
mov ecx, dword [ebp - 0x5fc]
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
test byte [esi + 0x1be8], 0x10
je 0x1015571
mov ecx, dword [ebp - 0x60c]
cmp dword [ecx + 0xc], 0
je 0x1015969
push eax
push 0x1ab
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
add esp, 0x14
push 0x1fc
add esi, 0xc
push esi
call fcn.01018857
test eax, eax
jne 0x1015528
call fcn.01017fa1
jmp 0x101520a
push dword [esi]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi]
call fcn.01018ec9
test eax, eax
je 0x101521d
push 0
push dword [esi]
call fcn.010181d0
test eax, eax
jne 0x1015567
push 0x20a
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [esi]
mov ecx, dword [ebp - 0x5fc]
jmp 0x101557d
cmp dword [ecx], 0
jne 0x1015969
mov eax, dword [esi + 0x14]
mov dword [ecx], eax
jmp 0x1015969
cmp word [esi + 0x1be8], 2
jne 0x1015770
mov eax, dword [ebp - 0x60c]
push dword [eax + 8]
push dword [esi + 0x14]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c897
test eax, eax
je 0x10151d3
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x1015744
cmp eax, 0x50010001
je 0x10155f4
cmp eax, 0xa0010001
je 0x1015744
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x10155fd
mov eax, dword [ebp - 0x600]
and dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [ebx], eax
test byte [esi + 0x1be8], 0x10
je 0x101569b
mov ecx, dword [ebp - 0x60c]
cmp dword [ecx + 0xc], 0
je 0x1015726
push eax
push 0x1ab
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
add esp, 0x14
push 0x1fc
add esi, 0xc
push esi
call fcn.01018857
test eax, eax
je 0x101551e
push dword [esi]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi]
call fcn.01018ec9
test eax, eax
je 0x101521d
push 0
push dword [esi]
call fcn.010181d0
test eax, eax
jne 0x1015694
push 0x20a
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [esi]
jmp 0x1015729
cmp dword [esi + 0x1bf0], 0
jne 0x1015739
push 0
push dword [esi + 0x14]
call fcn.010181d0
test eax, eax
je 0x10156c3
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
jmp 0x1015739
push dword [ebx]
push 0x1ab
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
add esp, 0x14
push dword [esi + 0xc]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0xc]
call fcn.01018ec9
test eax, eax
je 0x101521d
push 0
push dword [esi + 0xc]
call fcn.010181d0
test eax, eax
jne 0x1015726
push 0x20a
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x5fc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
mov eax, dword [ebp - 0x608]
jmp 0x1015977
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push 0x1fc
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
call fcn.01017f0e
jmp 0x10153ec
push 0
push dword [esi + 4]
call fcn.010181d0
test eax, eax
je 0x1015979
test byte [esi + 0x1be8], 8
je 0x1015979
mov eax, dword [ebp - 0x60c]
push dword [eax + 8]
push dword [esi + 0x14]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.010184e9
shr eax, 1
push eax
push dword [esi + 0x10]
push dword [esi + 4]
call fcn.0101c897
test eax, eax
je 0x10151d3
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x1015744
cmp eax, 0x50010001
je 0x10157f1
cmp eax, 0xa0010001
je 0x1015744
mov eax, dword [ebp - 0x600]
mov dword [eax], edi
jmp 0x10157fa
mov eax, dword [ebp - 0x600]
and dword [eax], 0
push dword [esi + 8]
call fcn.01005fdd
test eax, eax
je 0x1015892
mov eax, dword [esi + 8]
mov dword [ebx], eax
lea eax, [esi + 0x818]
push eax
push 0xca
call fcn.01019fbc
push eax
lea eax, [ebp - 0x5f8]
push 0x1fc
push eax
call fcn.01003e97
add esp, 0x10
lea eax, [ebp - 0x5f8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call fcn.01018c64
test byte [esi + 0x1be8], 0x10
je 0x101587a
push 0
push dword [esi + 0xc]
call fcn.010181d0
test eax, eax
je 0x101587a
push 0xfc
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
mov eax, dword [ebp - 0x614]
jmp 0x10158ab
push 0
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x10158ad
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
push 0
push edi
push dword [esi + 0x10]
push dword [esi + 8]
call fcn.010181f1
test eax, eax
je 0x10159b3
test byte [esi + 0x1be8], 0x10
je 0x101598c
push 0
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x10159da
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 0xc], 0
je 0x10159da
push dword [esi + 8]
call fcn.01005fdd
test eax, eax
jne 0x10159da
push dword [ebx]
push 0x1ab
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x20
push edi
push eax
call fcn.01019e69
mov esi, dword [ebp - 0x610]
add esp, 0x14
push 0xfe
push esi
call fcn.01018ec9
test eax, eax
je 0x101521d
push 0
push esi
call fcn.010181d0
test eax, eax
jne 0x1015961
push 0x20a
call fcn.01019fbc
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
mov eax, dword [ebp - 0x5fc]
mov dword [eax], esi
mov eax, dword [ebp - 0x608]
mov dword [eax], edi
mov eax, dword [ebp - 0x604]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010175b3
leave
ret 0x24
cmp dword [esi + 0x1bf0], 0
jne 0x1015969
mov eax, dword [ebp - 0x614]
cmp dword [eax], 0
jne 0x1015969
push 0
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x1015969
jmp 0x1015902
test byte [esi + 0x1be8], 0x10
push 0
je 0x10159e2
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x10159da
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 0xc], 0
jne 0x1015902
mov eax, dword [esi + 0xc]
jmp 0x1015569
push dword [esi + 0x14]
call fcn.010181d0
test eax, eax
je 0x10159f6
mov eax, dword [esi + 0x14]
jmp 0x1015569
cmp dword [esi + 0x1bf0], 0
jne 0x1015969
push 0
push dword [esi + 8]
call fcn.010181d0
test eax, eax
je 0x1015969
push dword [esi + 8]
call fcn.01005fdd
test eax, eax
jne 0x1015969
jmp 0x1015902