Function at 0x100098c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006036d
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x100811d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2ac], esi
mov edi, 7
mov dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], edi
mov word [ebp - 0x248], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], edi
mov word [ebp - 0x260], ax
push 0x208
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
call fcn.1003b8a0
add esp, 0xc
mov dword [ebp - 0x2b0], 0x104
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push dword [ebp - 0x2b0]
xor eax, eax
mov dword [ebp - 0x280], 0
mov word [ebp - 0x290], ax
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x27c], edi
push eax
call fcn.10003c60
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 2
push eax
call fcn.100078f0
add esp, 4
cmp byte [esi + 0x98], 0
mov byte [ebp - 4], 3
jne 0x10009aac
cmp dword [ebp - 0x294], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x290]
cmovae ecx, dword [ebp - 0x2a8]
cmp dword [ebp - 0x27c], 8
push ecx
cmovae eax, dword [ebp - 0x290]
push eax
call fcn.10007150
add esp, 8
test al, al
je 0x10009aac
push 0
lea eax, [ebp - 0x278]
push 0x1a
push eax
call fcn.100064f0
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x248]
cmp eax, esi
je 0x10009a41
mov ecx, eax
call fcn.100037c0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x248], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x14], edi
movq qword [ebp - 0x238], xmm0
mov edi, dword [ebp - 0x234]
mov dword [esi + 0x10], 0
mov word [esi], ax
lea ecx, [ebp - 0x278]
call fcn.100037c0
push 0
lea eax, [ebp - 0x278]
push 0x1c
push eax
call fcn.100064f0
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x260]
cmp eax, esi
je 0x10009a9c
mov ecx, eax
call fcn.100037c0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x260], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
movq qword [ebp - 0x250], xmm0
mov word [esi], ax
lea ecx, [ebp - 0x278]
call fcn.100037c0
jmp 0x10009c71
lea eax, [ebp - 0x230]
push eax
call fcn.10007ab0
add esp, 4
push 0x42
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
call fcn.10003ae0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push str.AppData
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x278]
push VariantInit
push eax
call fcn.10006880
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x248]
cmp eax, esi
je 0x10009b42
mov ecx, eax
call fcn.100037c0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x248], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x238], xmm0
mov edi, dword [ebp - 0x234]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x264]
cmp edx, 8
jb 0x10009b82
mov ecx, dword [ebp - 0x278]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009b78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0b1
push edx
push ecx
call fcn.100244c7
add esp, 8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push str.Local_AppData
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x278]
push VariantInit
push eax
call fcn.10006880
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x260]
cmp eax, esi
je 0x10009bed
mov ecx, eax
call fcn.100037c0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x260], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
movq qword [ebp - 0x250], xmm0
mov word [esi], ax
mov edx, dword [ebp - 0x264]
cmp edx, 8
jb 0x10009c2d
mov ecx, dword [ebp - 0x278]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009c23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0b6
push edx
push ecx
call fcn.100244c7
add esp, 8
mov edx, dword [ebp - 0x21c]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x10009c71
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009c67
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0bb
push edx
push ecx
call fcn.100244c7
add esp, 8
mov eax, dword [ebp - 0x2ac]
lea ecx, [ebp - 0x248]
lea esi, [eax + 0x50]
cmp esi, ecx
je 0x10009ca4
push dword [ebp - 0x238]
mov eax, ecx
cmp edi, 8
mov ecx, esi
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.10003c60
mov eax, dword [ebp - 0x2ac]
lea edi, [eax + 0x68]
lea eax, [ebp - 0x260]
cmp edi, eax
je 0x10009ccd
cmp dword [ebp - 0x24c], 8
mov ecx, edi
push dword [ebp - 0x250]
cmovae eax, dword [ebp - 0x260]
push eax
call fcn.10003c60
push esi
call fcn.100070b0
add esp, 4
test eax, eax
jne 0x10009ce8
push 1
push 0x10066f44
mov ecx, esi
call fcn.10003ae0
push edi
call fcn.100070b0
add esp, 4
test eax, eax
jne 0x10009d03
push 1
push 0x10066f44
mov ecx, edi
call fcn.10003ae0
lea eax, [ebp - 0x278]
push str.SOFT_NAME_EN
push eax
call fcn.1000e440
add esp, 8
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 5
jb 0x10009d23
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x10009d2d
mov ecx, dword [esi]
push eax
push ecx
lea eax, [ebp - 0x230]
push str._s_s_
push eax
call fcn.10006cb0
mov edi, dword [ebp - 0x2ac]
add esp, 0x10
add edi, 0x20
mov dword [ebp - 0x2b4], eax
cmp edi, eax
je 0x10009d86
mov ecx, edi
call fcn.100037c0
mov eax, dword [ebp - 0x2b4]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x10009dc6
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009dbc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0c0
push edx
push ecx
call fcn.100244c7
add esp, 8
mov edx, dword [ebp - 0x264]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x10009e27
mov ecx, dword [ebp - 0x278]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009e1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0c5
push edx
push ecx
call fcn.100244c7
add esp, 8
cmp dword [edi + 0x14], 8
jb 0x10009e2f
mov edi, dword [edi]
push edi
call fcn.10006290
lea eax, [ebp - 0x278]
push str.APPDATA_RETAIN_FOLDER
push eax
call fcn.1000e440
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 6
jb 0x10009e55
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x10009e5d
mov esi, dword [esi]
push eax
push esi
lea eax, [ebp - 0x230]
push str._s_s_
push eax
call fcn.10006cb0
mov esi, dword [ebp - 0x2ac]
mov edi, eax
add esi, 0x38
add esp, 0x10
cmp esi, edi
je 0x10009eac
mov ecx, esi
call fcn.100037c0
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x10009eec
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009ee2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0ca
push edx
push ecx
call fcn.100244c7
add esp, 8
mov edx, dword [ebp - 0x264]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x10009f4d
mov ecx, dword [ebp - 0x278]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009f43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0cf
push edx
push ecx
call fcn.100244c7
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x10009f55
mov esi, dword [esi]
push esi
call fcn.10006290
mov edx, dword [ebp - 0x294]
add esp, 4
cmp edx, 8
jb 0x10009f9e
mov ecx, dword [ebp - 0x2a8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009f94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0d4
push edx
push ecx
call fcn.100244c7
add esp, 8
mov edx, dword [ebp - 0x27c]
xor eax, eax
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
cmp edx, 8
jb 0x10009ffb
mov ecx, dword [ebp - 0x290]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009ff1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0d9
push edx
push ecx
call fcn.100244c7
add esp, 8
mov edx, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
cmp edx, 8
jb 0x1000a058
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a04e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0de
push edx
push ecx
call fcn.100244c7
add esp, 8
mov edx, dword [ebp - 0x234]
cmp edx, 8
jb 0x1000a094
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a08a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a0e3
push edx
push ecx
call fcn.100244c7
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002453b
mov esp, ebp
pop ebp
ret
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
call fcn.1003fc49
int3