Function at 0x1001ee20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1228
call fcn.10212f90
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x1228], eax
mov dword [ebp - 0x1220], ebx
call fcn.1001f4b0
push 0x410
mov edi, eax
lea eax, [ebp - 0x618]
push 0
push eax
call fcn.102134e7
add esp, 0xc
test edi, edi
jne 0x1001f180
push 0x400
lea eax, [ebp - 0xa18]
mov dword [ebp - 0x1224], edi
push edi
push eax
call fcn.102134e7
lea eax, [ebp - 0x1224]
push eax
push 0x200
lea eax, [ebp - 0xa18]
push eax
push esi
call fcn.1001e8b0
add esp, 0x1c
test eax, eax
je 0x1001f13d
call fcn.10003980
test eax, eax
je 0x1001f29f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x121c]
mov dword [ebp - 0x121c], eax
lea eax, [ebp - 0xa18]
push eax
call fcn.10004a70
test al, al
jne 0x1001ef12
lea ecx, [ebp - 0xa18]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001eef0
sub ecx, edx
lea eax, [ebp - 0xa18]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x121c]
call fcn.10004050
mov esi, dword [ebp - 0x121c]
xor edi, edi
mov ebx, esi
movzx eax, word [esi]
test ax, ax
je 0x1001ef9d
mov ecx, eax
jmp 0x1001ef30
push ecx
push 0x10219e0c
call fcn.10213523
add esp, 8
test eax, eax
je 0x1001ef4a
test edi, edi
jne 0x1001ef4c
mov edi, ebx
jmp 0x1001ef4c
xor edi, edi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x1001ef30
test edi, edi
je 0x1001ef9d
sub edi, esi
sar edi, 1
js 0x1001f295
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x1001ef8b
push edi
lea ecx, [ebp - 0x121c]
call fcn.10003eb0
mov esi, dword [ebp - 0x121c]
cmp edi, dword [esi - 8]
jg 0x1001f295
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
call fcn.10003980
test eax, eax
je 0x1001f29f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edi, dword [ebp - 0x1220]
lea ecx, [ebp - 0x121c]
add eax, 0x10
push edi
mov dword [ebp - 0x121c], eax
call fcn.10004a70
test al, al
jne 0x1001effc
test edi, edi
jne 0x1001efd8
xor ecx, ecx
jmp 0x1001efef
mov ecx, edi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001efe0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x121c]
call fcn.10004050
mov edi, dword [ebp - 0x121c]
mov ebx, edi
movzx eax, word [edi]
test ax, ax
je 0x1001f0f3
mov ecx, eax
push ecx
push 0x10219e0c
call fcn.10213523
add esp, 8
test eax, eax
je 0x1001f032
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x1001f012
cmp ebx, edi
je 0x1001f0f3
push dword [edi - 0xc]
sub ebx, edi
lea ecx, [ebp - 0x121c]
sar ebx, 1
call fcn.1000a5b0
mov edi, dword [ebp - 0x121c]
mov ecx, eax
lea eax, [ecx + ebx*2]
mov dword [ebp - 0x1220], eax
mov eax, dword [edi - 0xc]
sub eax, ebx
mov dword [ebp - 0x121c], eax
lea edx, [eax*2 + 2]
test edx, edx
je 0x1001f0c8
test ecx, ecx
jne 0x1001f08e
call fcn.102134ed
mov dword [eax], 0x16
call fcn.10200a90
mov eax, 0x16
jmp 0x1001f0ca
mov ebx, dword [ebp - 0x1220]
test ebx, ebx
je 0x1001f077
mov eax, dword [edi - 0xc]
lea eax, [eax*2 + 2]
cmp eax, edx
jae 0x1001f0bd
call fcn.102134ed
mov dword [eax], 0x22
call fcn.10200a90
mov eax, 0x22
jmp 0x1001f0ca
push edx
push ebx
push ecx
call fcn.102134f9
add esp, 0xc
xor eax, eax
push eax
call fcn.100049d0
mov eax, dword [ebp - 0x121c]
add esp, 4
test eax, eax
js 0x1001f295
cmp eax, dword [edi - 8]
jg 0x1001f295
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
push edi
push esi
push 0x1021b408
lea eax, [ebp - 0x618]
push 0x208
push eax
call fcn.1000bd10
lea edx, [edi - 0x10]
add esp, 0x14
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001f128
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x1001f13d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1224]
test eax, eax
je case.default.0x1001f159
add eax, 0x80000000
cmp eax, 3
ja case.default.0x1001f159
jmp dword [eax*4 + 0x1001f2ac]
mov edi, str.CLASSES_ROOT
jmp 0x1001f17a
mov edi, str.CURRENT_USER
jmp 0x1001f17a
mov edi, str.MACHINE
jmp 0x1001f17a
mov edi, str.USERS
lea ebx, [ebp - 0x618]
push 0x202
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.102134e7
push 0x800
lea eax, [ebp - 0x1218]
push 0
push eax
call fcn.102134e7
mov esi, dword [ebp + 0x10]
add esp, 0x18
test esi, esi
je 0x1001f25e
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f1c0
sub ecx, edx
sar ecx, 1
je 0x1001f25e
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001f20b
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001f204
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001f1e4
jmp 0x1001f208
test edx, edx
jne 0x1001f20b
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push ebx
push edi
push 0x1021b408
lea eax, [ebp - 0x1218]
push 0x400
push eax
call fcn.1000bd10
mov ecx, dword [ebp - 0x1228]
lea eax, [ebp - 0x208]
add esp, 0x14
push dword [ebp + 0x14]
push eax
push 2
push 4
lea eax, [ebp - 0x1218]
push eax
call fcn.1001f7b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x1220]
mov dword [ebp - 0x1220], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1001f210
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.100030c0
push 0x80004005
call fcn.100030c0
lea ecx, [ecx]
pushal
int1
add byte [eax - 0xf], ah
add dword [eax], edx
int1
add dword [eax], edx
outsb dx, byte [esi]
int1
add dword [eax], edx
jne 0x1001f2ab
add dword [eax], edx
int3