Function at 0x1014434
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x1029c7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc34], eax
xor eax, eax
xor ebx, ebx
mov esi, 0x1fc
push esi
mov word [ebp - 0x5f8], ax
mov word [ebp - 0x200], ax
push 0x1001b68
lea eax, [ebp - 0x5f8]
push eax
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xc20], ebx
call fcn.01018bde
push ebx
push edi
call fcn.010181d0
test eax, eax
je 0x10148e5
push edi
call fcn.01013477
test eax, eax
jne 0x10148e5
cmp edi, ebx
je 0x101452c
movzx eax, word [edi]
mov ecx, edi
cmp ax, bx
je 0x101451e
movzx eax, ax
cmp ax, 0x5c
jne 0x10144fb
inc ecx
inc ecx
movzx eax, word [ecx]
inc dword [ebp - 0xc08]
cmp ax, bx
jne 0x10144e5
cmp word [ebp - 0xc08], 2
jne 0x1014515
push esi
push edi
lea eax, [ebp - 0x5f8]
push eax
call fcn.01018bde
jmp 0x101452c
cmp word [ebp - 0xc08], bx
jne 0x101452c
push esi
push edi
lea eax, [ebp - 0x5f8]
push eax
call fcn.01018c21
mov eax, 0x103
mov dword [ebp - 0xc2c], eax
mov ecx, eax
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc24], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xc14], ebx
lea eax, [ebp - 0xa00]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1014557
push ebx
push dword [ebp - 0xc00]
call fcn.010181d0
test eax, eax
jne 0x10145ab
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0xa00]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x101459f
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd4
xor eax, eax
jmp 0x10149b6
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xc00], eax
push 0x5c
push ebx
push dword [ebp - 0xc00]
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
cmp eax, ebx
je 0x10145c7
add eax, 2
mov dword [ebp - 0xc00], eax
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xc30]
push eax
lea eax, [ebp - 0xc24]
push eax
push dword [ebp - 0xc08]
lea eax, [ebp - 0xc1c]
push eax
push dword [ebp - 0xc14]
push dword [ebp - 0xc00]
push edi
call esi
cmp dword [ebp - 0xc1c], ebx
je 0x1014585
push dword [ebp - 0xc1c]
call fcn.01018440
mov dword [ebp - 0xc14], eax
cmp eax, ebx
jne 0x1014621
push 0xe
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
jmp 0x1014585
mov eax, dword [ebp - 0xc24]
add eax, eax
push eax
call fcn.01018440
mov dword [ebp - 0xc08], eax
cmp eax, ebx
jne 0x1014665
push 0xe
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd4
lea eax, [ebp - 0xc14]
push eax
call fcn.010187dc
jmp 0x1014598
lea ecx, [ebp - 0xc30]
push ecx
lea ecx, [ebp - 0xc24]
push ecx
push eax
lea eax, [ebp - 0xc1c]
push eax
push dword [ebp - 0xc14]
push dword [ebp - 0xc00]
push edi
call esi
test eax, eax
jne 0x10146b5
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd4
lea eax, [ebp - 0xc14]
push eax
call fcn.010187dc
lea eax, [ebp - 0xc08]
jmp 0x101465a
lea eax, [ebp - 0xbfc]
push eax
push dword [ebp - 0xc14]
call fcn.01013ff5
test eax, eax
je 0x101468e
lea eax, [ebp - 0xc14]
push eax
call fcn.010187dc
lea eax, [ebp - 0xc08]
push eax
call fcn.010187dc
mov esi, 0xfe
push esi
lea eax, [ebp - 0xbfc]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.01018bde
push esi
push 0x10013d4
lea eax, [ebp - 0x200]
push eax
call fcn.01018c21
push esi
mov edi, 0x1001d38
push edi
lea eax, [ebp - 0x200]
push eax
call fcn.01018c21
mov esi, dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
lea eax, [ebp - 0xc10]
push eax
push 0x80000002
lea eax, [ebp - 0x5f8]
push eax
call esi
mov dword [ebp - 0xc00], eax
cmp eax, ebx
je 0x101478c
lea eax, [ebp - 0x5f8]
push eax
push 0x9dc
call fcn.01019fbc
push eax
lea eax, [ebp - 0x7f8]
push 0x100
push eax
call fcn.01003e97
add esp, 0x10
lea eax, [ebp - 0x7f8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call fcn.01018c64
push dword [ebp - 0xc00]
jmp 0x1014616
lea eax, [ebp - 0xc18]
push eax
push 0x80000003
lea eax, [ebp - 0x5f8]
push eax
call esi
mov dword [ebp - 0xc00], eax
cmp eax, ebx
jne 0x1014746
cmp dword [ebp - 0xc10], ebx
je 0x1014808
lea eax, [ebp - 0xc04]
push eax
mov esi, 0x20019
push esi
push ebx
push edi
push dword [ebp - 0xc10]
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
call edi
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xc04], ebx
jne 0x1014814
cmp dword [ebp - 0xc18], ebx
je 0x10148b4
lea eax, [ebp - 0xc04]
push eax
push esi
push ebx
lea eax, [ebp - 0x200]
push eax
push dword [ebp - 0xc18]
call edi
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xc04], ebx
je 0x10148b4
lea eax, [ebp - 0xc20]
push eax
push dword [ebp - 0xc28]
push dword [ebp - 0xc04]
call fcn.010131fe
test eax, eax
jne 0x101489a
push dword [ebp - 0xc00]
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd4
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0xc04], ebx
je 0x101486b
push dword [ebp - 0xc04]
call esi
mov dword [ebp - 0xc04], ebx
cmp dword [ebp - 0xc10], ebx
je 0x1014881
push dword [ebp - 0xc10]
call esi
mov dword [ebp - 0xc10], ebx
cmp dword [ebp - 0xc18], ebx
je 0x1014598
push dword [ebp - 0xc18]
call esi
jmp 0x1014598
cmp dword [ebp - 0xc04], ebx
je 0x10148b4
push dword [ebp - 0xc04]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [ebp - 0xc04], ebx
cmp dword [ebp - 0xc10], ebx
je 0x10148ce
push dword [ebp - 0xc10]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [ebp - 0xc10], ebx
cmp dword [ebp - 0xc18], ebx
je 0x10149a5
push dword [ebp - 0xc18]
jmp 0x101499f
lea eax, [ebp - 0xc0c]
push eax
mov esi, 0x20019
push esi
push ebx
mov edi, 0x1001d38
push edi
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0xc00], eax
cmp eax, ebx
je 0x1014931
cmp dword [ebp - 0xc0c], ebx
jne 0x1014939
lea eax, [ebp - 0xc0c]
push eax
push esi
push ebx
push edi
push 0x80000001
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0xc0c], ebx
je 0x10149a5
lea eax, [ebp - 0xc20]
push eax
push dword [ebp - 0xc28]
push dword [ebp - 0xc0c]
call fcn.010131fe
test eax, eax
jne 0x1014991
push dword [ebp - 0xc00]
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x10001
add eax, 0x40
push eax
call fcn.01019fd4
cmp dword [ebp - 0xc0c], ebx
je 0x1014598
push dword [ebp - 0xc0c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1014598
cmp dword [ebp - 0xc0c], ebx
je 0x10149a5
push dword [ebp - 0xc0c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0xc20]
mov ecx, dword [ebp - 0xc34]
mov dword [ecx], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010175b3
leave
ret 0x10