Function at 0x1000fe45
Capabilities:
Get session user name

Disassembly:
mov eax, 0x1005975d
call fcn.10058c78
sub esp, 0xec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x38], edx
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x24], cl
cmp byte [ebp + 0x18], bl
je 0x1000ffc0
mov dword [ebp - 0x1c], 0x64fc
cmp dword [ebp - 0x1c], 0x677a
jle 0x1000fecb
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0xe0]
or eax, esi
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000fe9c
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xe0]
call fcn.100015c8
inc edi
cmp edi, 0x4b40
jl 0x1000fe80
inc esi
cmp esi, 0x51ac
jl 0x1000fe7e
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
cmp dword [ebp - 0x1c], 0x6319
jge 0x1000fedf
push str.jnqkryhzt_detqpsxw_deggelxxc_cmbfnzcz_ocjhvmc_utlz
call fcn.100420be
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1000ff11
mov edx, dword [ebp + 0xc]
mov dword [edx], ebx
cmp dword [edx], 2
jge 0x100105c5
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 2
jl 0x1000fefa
jmp 0x100105c5
push ecx
push ecx
mov byte [ebp + 0x1b], bl
lea edx, [ebp + 0x1b]
push ebx
call fcn.1000e8b2
mov dword [ebp - 0x14], 0x4017
add esp, 0xc
cmp dword [ebp - 0x14], 0x433f
jle 0x1000ffa3
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp + 0x18], ebx
lea eax, [edi + esi]
mov edi, 0x37ff
mov dword [ebp - 0x2c], eax
mov esi, eax
mov eax, esi
lea ecx, [ebp - 0xc8]
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000ff63
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc8]
call fcn.100015c8
dec esi
dec edi
jne 0x1000ff49
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp + 0x18], edi
cmp edi, 0x17bf
jl 0x1000ff3c
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x4690
jl 0x1000ff37
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
cmp dword [ebp - 0x14], 0x3e35
jge 0x100105c5
push str.fjcpcofmi_yaibz_dxsqefzg_ljv_hgyleyevn_qvipx_riu_fltl_hbsujzryn_ueoex_lujr
call fcn.100420be
pop ecx
jmp 0x100105c5
mov dword [ebp - 0x1c], 0x7f29
cmp dword [ebp - 0x1c], 0x82b6
jle 0x1000fffa
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x10074f78
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10009792
inc edi
cmp edi, 0x345d
jl 0x1000ffd4
inc esi
cmp esi, 0x3606
jl 0x1000ffd2
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1c], 0x7b9b
jge 0x10010019
mov edx, str.gxqjhktf_biqcy_bmbspum_fzhig_dpfr_lufzcm_tdh_copncites_bdx_shmyvaqho_ngyej
mov ecx, 0x10074f78
call fcn.1000cd04
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x24], 0
je 0x100105bd
lea eax, [ebp - 0x38]
mov dword [ebp - 0x68], 7
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x6c], ebx
mov word [ebp - 0x7c], ax
mov dword [ebp - 4], 6
lea edx, [ebp - 0x25]
mov dword [ebp - 0x2c], 0xe48d327c
xor cl, cl
mov byte [ebp - 0x25], bl
call fcn.1000fbcd
push 0x10a2
xor dl, dl
mov ecx, 0x2e1b
call fcn.1000fe28
pop ecx
lea eax, [ebp - 0x7c]
mov edx, 0x1692
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
mov ecx, 0x42e3
call fcn.1000ebed
mov eax, dword [0x101530b8]
add esp, 0xc
test al, 1
jne 0x100100ba
or eax, 1
mov dword [0x101530b8], eax
push 0x1af0
mov byte [ebp - 4], 7
call fcn.10033fc3
mov word [0x10151d18], ax
mov byte [ebp - 4], 6
mov eax, dword [0x101530b8]
pop ecx
test al, 2
jne 0x100100df
or eax, 2
mov dword [0x101530b8], eax
push 0x2b10
mov byte [ebp - 4], 8
call fcn.10033fc3
pop ecx
mov word [0x10151d1c], ax
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], 0x7e20
cmp dword [ebp - 0x20], 0x7f72
jle 0x10010154
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov dword [ebp - 0x14], 0x70fe
mov dword [ebp - 0x1c], edi
mov esi, edi
mov edi, 0x1b22
mov eax, esi
lea ecx, [ebp - 0xf8]
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001011f
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xf8]
call fcn.100015c8
dec esi
dec edi
jne 0x10010105
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
add edi, esi
dec dword [ebp - 0x14]
mov dword [ebp - 0x1c], edi
jne 0x100100fe
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x1df0
jl 0x100100f2
cmp dword [ebp - 0x20], 0x7df3
jge 0x10010168
push str.adzcqjuyx_ttgpjgb_siepul_crfcdk_plyimtndr
call fcn.100420be
pop ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x18], 0x82062403
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], 0xb2f67ab6
mov dword [ebp - 0x14], ebx
jmp 0x100101bb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0xbf0a6441
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100101aa
mov dword [ebp - 0x18], ebx
jmp 0x100101d0
xor cl, cl
call fcn.1000ecba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
jg 0x100101c6
mov dword [ebp - 0x14], 0xb590
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x18]
test edx, edx
jne 0x100101f5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, 0x796a0b59
jne 0x10010202
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
imul ecx, eax
cmp ecx, dword [ebp - 0x18]
jne 0x10010223
cmp dword [ebp - 0x18], ebx
je 0x10010223
xor eax, eax
inc eax
jmp 0x10010225
mov eax, ebx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, 2
setg cl
imul ecx, edx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x10010260
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
jmp 0x1001027c
mov dword [ebp - 0x14], ebx
jmp 0x10010276
sub esp, 0x10
lea edx, [ebp - 0x18]
call fcn.10010c7c
add esp, 0x10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
jle 0x10010265
push 3
mov edi, ebx
pop esi
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], edi
cmp edi, dword [eax]
jae 0x10010526
mov dword [ebp - 0x1c], 0xf6af1124
mov dword [ebp - 0x1c], 0xffffffea
cmp dword [ebp - 0x1c], esi
jge 0x10010432
push 4
lea ecx, [ebp - 0x94]
call fcn.1000995a
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xb
push eax
push 1
lea eax, [ebp - 0x94]
mov dword [ebp - 0x14], 0xfffffff8
push eax
push 0x67fc
push 0x3469
xor dl, dl
mov cl, 1
call fcn.1000fd17
mov dword [ebp - 0x34], 0x6444
add esp, 0x14
cmp dword [ebp - 0x34], 0x66d5
jle 0x10010350
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ebx
mov edi, ebx
mov edx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [edi + esi]
and eax, edx
or eax, ecx
mov ecx, 0x10074f78
cdq
push edx
push eax
call fcn.10009792
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
inc edx
mov dword [ebp - 0x20], edx
cmp edx, 0x18c1
jl 0x10010302
inc edi
cmp edi, 0x3f4a
jl 0x100102fd
inc esi
cmp esi, 0x240c
jl 0x100102fb
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x5ffd
jl 0x100102f9
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 3
pop esi
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x34], 0x6334
jge 0x10010393
mov edx, str.xjx_wcyplgcqz_ywuefa_qoxazslu
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10010393
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x10010406
push 1
lea ecx, [ebp - 0x58]
call fcn.1000995a
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0xe
push 1
push eax
lea ecx, [ebp - 0x58]
call fcn.1000de34
pop ecx
call fcn.1000edb7
mov edi, dword [ebp - 0x58]
pop ecx
mov dword [edi], esi
mov dl, 1
push 0x5204
mov cl, dl
call fcn.1000e2c8
lea eax, [ebp - 0x27]
mov byte [ebp - 0x27], bl
push eax
push 0x267c
xor cl, cl
call fcn.1000e65d
add esp, 0xc
dec dword [edi]
jns 0x100103cd
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.100099dd
dec dword [ebp - 0x14]
jns 0x100103a2
lea eax, [ebp - 0x26]
mov byte [ebp - 0x26], bl
push 0x528f
push eax
mov cl, 1
call fcn.1000e65d
pop ecx
pop ecx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 6
call fcn.100099dd
inc dword [ebp - 0x1c]
jmp 0x1001029d
call fcn.1000dcd1
push 0x24
pop ecx
xor edx, edx
div ecx
push 4
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x3c], edx
call fcn.1000995a
push ecx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xf
push eax
push ecx
mov dword [ebp - 0x1c], 0xfffffff7
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 1
call fcn.100105d6
add esp, 0xc
mov dword [ebp - 0x30], ebx
jmp 0x1001048a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xb0], 0x2fdcba86
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10010479
mov ecx, dword [ebp - 0x88]
mov dword [ecx + 8], ebx
cmp dword [ebp - 0x14], ebx
jne 0x100104a0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ecx + 8]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x5fac
mov dword [ebp - 0xac], eax
sete cl
imul ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14]
sub ecx, 0x91f6
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x14]
jne 0x100104e9
cmp dword [ebp - 0x1c], ebx
jne 0x100104e9
mov eax, ebx
jmp 0x100104ec
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call fcn.100099dd
push 0x10151d18
lea eax, [ebp - 0x7c]
push eax
push 0x10151d1c
push ecx
lea edx, [ebp - 0x3c]
mov ecx, 0x4c51
call fcn.1000fa15
mov edi, dword [ebp - 0x2c]
add esp, 0x10
inc edi
jmp 0x10010281
push 4
lea ecx, [ebp - 0x64]
call fcn.1000995a
push ebx
xor eax, eax
mov byte [ebp - 4], 0x10
inc eax
lea ecx, [ebp - 0xa4]
push 0x351a
push eax
mov dword [ebp - 0x14], eax
mov edx, 0x389
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
push 0x348c
push eax
call fcn.1000f073
add esp, 0x14
mov dword [ebp - 0x14], ebx
jmp 0x1001058a
push 1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], 0x1bd97a88
push eax
push 0x27cb
push 1
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x4c]
call fcn.1000e6bf
add esp, 0x10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10010565
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.100099dd
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x7c]
cmp eax, ecx
je 0x100105b0
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.1000165a
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.10001734
jmp 0x100105c5
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret