Function at 0x11167ec0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e8e94
mov eax, dword fs:[0]
push eax
mov eax, 0x17b4
call fcn.111d92c0
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x17b4], edi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x17ac], ebx
mov byte [esi + 0xcc0], 0
cmp dword [esi + 0xcbc], edi
jne 0x11167f28
push 0x11216130
mov ecx, ebx
call fcn.1113ccd0
mov eax, ebx
jmp 0x11168903
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
call edx
cmp word [eax], di
jne 0x11167f57
push str.no_user_groups_as_no_logged_on_user_n
call fcn.111bd7b0
add esp, 4
push 0x11216130
mov ecx, ebx
call fcn.1113ccd0
mov eax, ebx
jmp 0x11168903
mov eax, dword [esi + 0xcbc]
push edi
push eax
call fcn.111b7990
add esp, 8
mov dword [ebp - 0x17a0], eax
push 0x100
lea ecx, [ebp - 0x1798]
mov dword [ebp - 4], 1
call fcn.1113c0e0
push edi
mov byte [ebp - 4], 2
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x1780]
push ecx
push 0x112477b4
push 5
push edi
push edi
push str.LDAP:__rootDSE
mov dword [ebp - 0x17a8], eax
mov dword [ebp - 0x1780], edi
call sub.ACTIVEDS.dll_ADsOpenObject
xor edx, edx
mov dword [ebp - 0x1754], edi
mov word [ebp - 0x94], dx
cmp eax, edi
jl 0x11168860
lea eax, [ebp - 0x1754]
push eax
push 0x11247974
push 1
push edx
push 0x11247984
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x111680ff
mov eax, dword [ebp - 0x1754]
test eax, eax
je 0x11168860
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push 0x11247f3c
push 3
push eax
call edx
test eax, eax
js 0x1116835f
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x1780]
mov ecx, dword [eax]
lea edx, [ebp - 0x1774]
push edx
push str.defaultNamingContext
push eax
mov eax, dword [ecx + 0x3c]
call eax
mov edx, dword [ebp - 0x176c]
mov eax, dword [ebp - 0x1754]
mov ecx, dword [eax]
push edx
push 1
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
js 0x1116806c
mov eax, dword [ebp - 0x1754]
mov ecx, dword [eax]
lea edx, [ebp - 0x176c]
push edx
push 3
push eax
mov eax, dword [ecx + 0x2c]
call eax
mov eax, dword [ebp - 0x176c]
lea edx, [ebp - 0x94]
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x11168080
cmp word [ebp - 0x94], cx
je 0x111680d8
lea eax, [ebp - 0x94]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x111680a1
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x96], 0x5c
je 0x111680d8
lea edi, [ebp - 0x94]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x111680c4
mov ecx, dword [0x11203288]
mov dword [edi], ecx
cmp byte [ebp + 0xc], 0
je 0x111680f2
lea edx, [ebp - 0x94]
push edx
push str.ad_dom_ls_n
call fcn.111bd7b0
add esp, 8
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x1754], 0
je 0x11168860
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x90]
xor ebx, ebx
push ebx
push 0xffffffffffffffff
call edx
lea eax, [ebp - 0x17b8]
push eax
lea ecx, [ebp - 0x1724]
push ecx
push 1
mov dword [ebp - 0x17b8], 0x400
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0x90]
push ebx
push ebx
call eax
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.LDAP:__]
mov word [ebp + eax - 0xf24], cx
add eax, 2
cmp cx, bx
jne 0x11168150
lea eax, [ebp - 0x1724]
mov esi, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x11168170
lea edi, [ebp - 0xf24]
sub eax, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x11168186
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x1778]
push edx
push 0x112477c4
push 5
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push ebx
lea eax, [ebp - 0xf24]
xor ecx, ecx
push eax
mov dword [ebp - 0x1784], ebx
mov dword [ebp - 0x177c], ebx
mov word [ebp - 0x114], cx
mov dword [ebp - 0x1778], ebx
call sub.ACTIVEDS.dll_ADsOpenObject
cmp eax, ebx
jl 0x111682d3
mov eax, dword [ebp - 0x1778]
cmp eax, ebx
je 0x111682d3
mov ecx, dword [eax]
lea edx, [ebp - 0x1784]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [ebp - 0x1778]
mov ecx, dword [eax]
lea edx, [ebp - 0x177c]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [ebp - 0x1784]
cmp eax, ebx
je 0x1116822e
cmp byte [ebp + 0xc], bl
je 0x1116822e
push eax
push str.objuser_get_path_ls_n
call fcn.111bd7b0
add esp, 8
mov esi, dword [ebp - 0x177c]
cmp esi, ebx
je 0x11168251
cmp byte [ebp + 0xc], bl
je 0x11168251
push esi
push str.objuser_get_GUID_ls_n
call fcn.111bd7b0
mov esi, dword [ebp - 0x177c]
add esp, 8
xor eax, eax
mov dword [ebp - 0x1734], eax
mov dword [ebp - 0x1730], eax
mov dword [ebp - 0x172c], eax
mov dword [ebp - 0x1728], eax
mov eax, esi
lea edi, [ebp - 0x1734]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x11168276
sub eax, edx
sar eax, 1
and eax, 0xfffffffe
cmp eax, 0x20
ja 0x111682d3
cmp word [esi], bx
je 0x111682bb
movzx ecx, word [esi + 2]
push ecx
call fcn.111b8a10
movzx edx, word [esi]
push edx
mov ebx, eax
call fcn.111b8a10
shl al, 4
or bl, al
mov byte [edi], bl
add esi, 4
add esp, 8
inc edi
cmp word [esi], 0
jne 0x11168292
push 0x27
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1734]
push ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
xor ebx, ebx
lea ecx, [ebp - 0x1774]
call fcn.110ad840
mov edx, dword [ebp - 0x17a0]
push ebx
push edx
mov byte [ebp - 4], 3
call fcn.111b7990
add esp, 8
mov dword [ebp - 0x1788], eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x175c], eax
cmp word [eax], bx
je 0x1116880c
jmp 0x11168310
mov esi, dword [ebp - 0x175c]
mov edi, dword [sym.imp.MSVCR100.dll_wcschr]
push 0x3b
push esi
call edi
add esp, 8
mov dword [ebp - 0x17a4], eax
test eax, eax
je 0x11168333
xor ecx, ecx
mov word [eax], cx
push 7
xor edx, edx
push str.LDAP:__
push esi
mov word [ebp - 0x314], dx
call dword [sym.imp.MSVCR100.dll_wcsncmp]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
je 0x11168384
add esi, 0xe
mov dword [ebp - 0x175c], esi
jmp 0x111683c8
mov eax, dword [ebp - 0x1754]
test eax, eax
je 0x11168860
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x1754], 0
jmp 0x11168860
cmp word [esi], 0x2e
jne 0x1116839a
cmp word [esi + 2], 0x5c
jne 0x1116839a
add esi, 4
mov dword [ebp - 0x175c], esi
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x111683c8
jmp 0x111683b0
movzx ecx, word [ebp + eax - 0x94]
mov word [ebp + eax - 0x314], cx
add eax, 2
test cx, cx
jne 0x111683b0
lea eax, [ebp - 0x314]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x111683d1
sub eax, edx
sar eax, 1
mov ecx, 0x100
sub ecx, eax
add ecx, ecx
push ecx
lea edx, [ebp + eax*2 - 0x314]
push edx
push esi
call fcn.111b8020
mov eax, dword [ebp - 0x1754]
mov ecx, dword [eax]
add esp, 0xc
lea edx, [ebp - 0x314]
push edx
push 8
push eax
mov eax, dword [ecx + 0x28]
call eax
mov dword [ebp - 0x1760], eax
test eax, eax
js 0x111685c5
mov eax, dword [ebp - 0x1754]
lea edx, [ebp - 0x179c]
push edx
mov dword [ebp - 0x179c], 0
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x2c]
call eax
xor eax, eax
jmp 0x11168450
movzx ecx, word [eax + str.LDAP:__]
mov word [ebp + eax - 0x714], cx
add eax, 2
test cx, cx
jne 0x11168450
mov ebx, dword [ebp - 0x179c]
test ebx, ebx
je 0x111684b3
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11168475
lea edi, [ebp - 0x714]
sub eax, edx
add edi, 0xfffffffe
jmp 0x11168490
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x11168490
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x111684de
cmp dword [ebp - 0x1760], 0
jl 0x111684de
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x314]
push ecx
push str.Group_translated_from__ls_to__ls_n
call fcn.111bd7b0
add esp, 0xc
lea edx, [ebp - 0x1764]
push edx
push 0x112477d4
xor esi, esi
push 5
push esi
push esi
lea eax, [ebp - 0x714]
push eax
mov dword [ebp - 0x1764], esi
mov dword [ebp - 0x1758], esi
xor edi, edi
call sub.ACTIVEDS.dll_ADsOpenObject
cmp eax, esi
jl 0x1116875a
test bl, bl
je 0x1116852a
lea ecx, [ebp - 0x714]
push ecx
push str.Opened_Group_ok___ls__n
call fcn.111bd7b0
add esp, 8
xor edx, edx
lea eax, [ebp - 0x714]
mov word [ebp - 0x1750], dx
mov dword [ebp - 0x173c], 7
mov dword [ebp - 0x1740], esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x11168550
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x1750]
call fcn.11004e40
lea ecx, [ebp - 0x1750]
push ecx
lea ecx, [ebp - 0x1774]
mov byte [ebp - 4], 5
call fcn.111be330
mov dword [ebp - 0x1760], eax
cmp eax, dword [ebp - 0x1770]
je 0x111685f0
mov ecx, dword [eax + 0x1c]
add eax, 0xc
cmp dword [eax + 0x14], 8
jb 0x111685a4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1740]
push ecx
push eax
push edx
push esi
lea ecx, [ebp - 0x1750]
call fcn.11005050
test eax, eax
js 0x111685f0
lea eax, [ebp - 0x1760]
jmp 0x11168602
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x111684de
mov ecx, dword [ebp - 0x1760]
push ecx
lea edx, [ebp - 0x314]
push edx
push str.set_translate_for_group__ls_failed__hr_x_n
call fcn.111bd7b0
add esp, 0xc
jmp 0x111684b6
mov eax, dword [ebp - 0x1770]
mov dword [ebp - 0x17b0], eax
lea eax, [ebp - 0x17b0]
cmp dword [ebp - 0x173c], 8
mov esi, dword [eax]
mov byte [ebp - 4], 4
jb 0x11168620
mov ecx, dword [ebp - 0x1750]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
mov dword [ebp - 0x173c], 7
mov dword [ebp - 0x1740], 0
mov word [ebp - 0x1750], dx
cmp esi, dword [ebp - 0x1770]
je 0x11168678
movzx eax, word [esi + 0x28]
mov dword [ebp - 0x1758], eax
test ax, ax
je 0x11168666
push str.already_in_group__skipping_n
call fcn.111bd7b0
add esp, 4
jmp 0x1116875a
push str.already_not_in_group__skipping_n
call fcn.111bd7b0
add esp, 4
jmp 0x1116875a
mov eax, dword [ebp - 0x1764]
mov ecx, dword [eax]
lea edx, [ebp - 0x1758]
push edx
lea edx, [ebp - 0xf24]
push edx
push eax
mov eax, dword [ecx + 0x5c]
call eax
test bl, bl
je 0x111686bb
movsx ecx, word [ebp - 0x1758]
push ecx
lea edx, [ebp - 0xf24]
push edx
lea eax, [ebp - 0x714]
push eax
push str.IsMember__ls___ls__ret__d_n
call fcn.111bd7b0
add esp, 0x10
cmp word [ebp - 0x1758], 0
je 0x1116870c
lea ecx, [ebp - 0x714]
push 0
lea edx, [ebp - 0x17c0]
mov dword [ebp - 0x17c0], ecx
push edx
lea ecx, [ebp - 0x1774]
mov dword [ebp - 0x17bc], 1
call fcn.110ab820
push eax
lea eax, [ebp - 0x172c]
push eax
lea ecx, [ebp - 0x1774]
call fcn.111bea20
cmp word [ebp - 0x1758], 0
jne 0x1116875a
mov eax, dword [ebp - 0x1784]
lea ecx, [ebp - 0x1774]
push ecx
push 0
push 0
movzx edx, bl
push edx
mov edx, dword [ebp - 0x1764]
push eax
lea ecx, [ebp - 0x114]
push ecx
push edx
call fcn.110ad170
add esp, 0x1c
mov edi, eax
test bl, bl
je 0x1116875a
push edi
lea eax, [ebp - 0xf24]
push eax
lea ecx, [ebp - 0x714]
push ecx
push str.RecIsMember__ls___ls__ret__d_n
call fcn.111bd7b0
add esp, 0x10
mov eax, dword [ebp - 0x1764]
test eax, eax
je 0x1116876c
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
test bl, bl
je 0x1116878b
xor ecx, ecx
cmp word [ebp - 0x1758], cx
push edi
setne cl
push ecx
push str.inGroup___d__bRecursiveMember___d_n
call fcn.111bd7b0
add esp, 0xc
cmp word [ebp - 0x1758], 0
jne 0x11168799
test edi, edi
je 0x111687ef
mov edx, dword [ebp - 0x1798]
mov eax, dword [edx]
lea ecx, [ebp - 0x1798]
call eax
test al, al
jne 0x111687c4
push 0x264
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
cmp dword [ebp - 0x1790], 0
je 0x111687dd
push 0x112053e0
lea ecx, [ebp - 0x1798]
call fcn.1113dca0
mov ecx, dword [ebp - 0x175c]
push ecx
lea ecx, [ebp - 0x1798]
call fcn.1113dca0
mov eax, dword [ebp - 0x17a4]
test eax, eax
je 0x1116880c
add eax, 2
cmp word [eax], 0
mov dword [ebp - 0x175c], eax
jne 0x11168310
mov edx, dword [ebp - 0x1788]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x1770]
mov ecx, dword [eax]
push eax
push ecx
lea eax, [ebp - 0x1788]
push eax
lea ecx, [ebp - 0x1774]
mov byte [ebp - 4], 6
call fcn.11071bb0
mov ecx, dword [ebp - 0x1770]
push ecx
mov byte [ebp - 4], 2
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x1754]
add esp, 4
test eax, eax
je 0x11168860
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x1780]
test eax, eax
je 0x11168872
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [ebp - 0x17a8], 0
jl 0x11168881
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x1798]
mov edx, dword [eax]
lea ecx, [ebp - 0x1798]
call edx
test al, al
jne 0x111688ac
push 0x263
push str.e:_nsmsrc_nsm14101410fctl32NSMString.h
push str.IsA__
call fcn.11067750
add esp, 0xc
cmp dword [ebp - 0x1790], 0
jne 0x111688c5
push 0x11216130
lea ecx, [ebp - 0x1798]
call fcn.1113dbf0
mov esi, dword [ebp - 0x17ac]
lea eax, [ebp - 0x1798]
push eax
mov ecx, esi
call fcn.1113cc10
lea ecx, [ebp - 0x1798]
mov dword [ebp - 0x17b4], 1
mov byte [ebp - 4], 1
call fcn.1113cd80
mov ecx, dword [ebp - 0x17a0]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8