Function at 0x4cdb40
Capabilities:
Get session user name
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc6c
push ebx
push ebp
push esi
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x31c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x64
lea edi, [esp + 0x18c]
rep stosd dword es:[edi], eax
mov ecx, 0x64
lea edi, [esp + 0x63c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10c]
push 0x40
push eax
mov byte [esp + 0x2c], bl
mov byte [esp + 0x90], bl
mov byte [esp + 0x154], bl
mov byte [esp + 0x114], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x70], bl
mov byte [esp + 0x64], bl
call fcn.004d5610
add esp, 8
test eax, eax
jne 0x4cdbd3
lea ecx, [esp + 0x3c]
push ebx
lea edx, [esp + 0x110]
push ecx
push edx
call fcn.004d91b0
add esp, 0xc
test eax, eax
je 0x4cdbd3
mov byte [esp + 0x3c], bl
jmp 0x4cdbd9
cmp byte [esp + 0x3c], bl
jne 0x4cdc0b
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.004d9620
add esp, 8
test eax, eax
je 0x4cdc0b
mov ecx, dword [0x56a47c]
mov dx, word [0x56a480]
mov al, byte [0x56a482]
mov dword [esp + 0x3c], ecx
mov word [esp + 0x40], dx
mov byte [esp + 0x42], al
mov ecx, dword [esp + 0xc88]
push 0x56a3e0
push ecx
call fcn.00503600
add esp, 8
test eax, eax
jne 0x4cdc59
mov edx, dword [0x56a3e0]
mov eax, dword [0x56a3e4]
mov ecx, dword [0x56a3e8]
mov dword [esp + 0x10c], edx
mov dx, word [0x56a3ec]
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], ecx
mov word [esp + 0x118], dx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x88]
push eax
push ecx
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.advapi32.dll_GetUserNameA]
cmp eax, 1
jne 0x4cdcc5
lea edx, [esp + 0x14c]
push 0x40
lea eax, [esp + 0x8c]
push edx
push eax
call fcn.004d88f0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4cdcc5
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x88]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4cdced
mov ecx, dword [0x56a47c]
mov dx, word [0x56a480]
mov al, byte [0x56a482]
mov dword [esp + 0x88], ecx
mov word [esp + 0x8c], dx
mov byte [esp + 0x8e], al
mov eax, dword [esp + 0xc84]
xor ecx, ecx
mov dword [esp + 0x30], ecx
xor edx, edx
mov dword [esp + 0x34], ecx
and eax, 0xffff
mov dword [esp + 0x38], ecx
mov dword [esp + 0x18], edx
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], edx
push 0x56a478
push ecx
mov dword [esp + 0x2c], edx
call fcn.004fa9f4
mov ebp, dword [esp + 0xc8c]
lea eax, [esp + 0x24]
mov edx, dword [ebp + 0x6c]
push edx
push 0x56a474
push eax
call fcn.004fa9f4
mov ecx, dword [esp + 0xca4]
lea edx, [esp + 0xec]
and ecx, 0xffff
push ecx
push 0x56a478
push edx
call fcn.004fa9f4
mov eax, dword [0x573ec0]
lea ecx, [esp + 0x11c]
push eax
push 0x56a474
push ecx
call fcn.004fa9f4
mov edx, dword [esp + 0xcc0]
lea eax, [esp + 0x11c]
and edx, 0xffff
push edx
push 0x56a478
push eax
call fcn.004fa9f4
mov ecx, dword [ebp + 0x1a8]
lea edx, [esp + 0xb0]
push ecx
push 0x56a474
push edx
call fcn.004fa9f4
add esp, 0x48
lea eax, [esp + 0xc8]
push 0x6e
push 0x56a478
push eax
call fcn.004fa9f4
push 1
lea ecx, [esp + 0x78]
push 0x56a478
push ecx
call fcn.004fa9f4
push 1
lea edx, [esp + 0x78]
push 0x56a478
push edx
call fcn.004fa9f4
add esp, 0x24
cmp word [ebp + 0x1ac], bx
jne 0x4cde1e
push ebx
lea eax, [esp + 0xfc]
push 0x56a474
push eax
call fcn.004fa9f4
push ebx
lea ecx, [esp + 0x84]
push 0x56a474
push ecx
call fcn.004fa9f4
add esp, 0x18
cmp word [ebp + 0x1ac], 1
jne 0x4cde44
cmp word [ebp + 0x1ae], bx
jne 0x4cde44
push ebx
lea edx, [esp + 0x78]
push 0x56a474
push edx
call fcn.004fa9f4
add esp, 0xc
lea eax, [esp + 0xc8]
lea ecx, [esp + 0x5c]
push eax
lea edx, [esp + 0x6c]
push ecx
lea eax, [esp + 0x7c]
push edx
lea ecx, [esp + 0xf8]
push eax
lea edx, [esp + 0xe4]
push ecx
lea eax, [esp + 0x10c]
push edx
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0x58]
push ecx
lea eax, [esp + 0x12c]
push edx
lea ecx, [esp + 0xac]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
push 0xc
push 0x56a470
call fcn.004d8790
mov edx, eax
add esp, 0x38
cmp edx, ebx
jne 0x4cdebd
push ebp
push 0x4a
call fcn.004cd880
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x63c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004f9aad
lea ecx, [esp + 0x28]
lea edx, [esp + 0x640]
push ecx
push edx
push 0x56a4e8
push 3
push 0x56a46c
call fcn.004d8790
mov edx, eax
add esp, 0x18
cmp edx, ebx
jne 0x4cdf25
pop edi
pop esi
pop ebp
mov ax, 0x4a
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x18c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004f9aad
lea ecx, [esp + 0x190]
push ecx
call fcn.004d8870
mov edx, eax
add esp, 8
cmp edx, ebx
jne 0x4cdf7c
pop edi
pop esi
pop ebp
mov ax, 0x4a
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x18c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004f9aad
lea ecx, [esp + 0x320]
lea edx, [esp + 0x190]
push ecx
push ebp
push edx
call fcn.004d6570
add esp, 0x10
cmp ax, bx
je 0x4cdfe1
push ebp
push eax
call fcn.004cd7b0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
lea eax, [esp + 0x31c]
push eax
call fcn.004d8560
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x4ce006
pop edi
pop esi
pop ebp
mov ax, 0x42
pop ebx
add esp, 0xc6c
ret
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x4ac]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x31c]
mov dword [esp + 0x2c], ecx
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4ac]
push edx
lea ecx, [esp + 0x7d0]
push eax
push ecx
push esi
push 3
push 0x56a46c
call fcn.004d83c0
push esi
mov edi, eax
call fcn.004f9aad
add esp, 0x1c
cmp di, bx
je 0x4ce068
pop edi
pop esi
pop ebp
mov ax, 0x42
pop ebx
add esp, 0xc6c
ret
xor edi, edi
mov esi, 0x56a464
lea eax, [esp + 0x7cc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4ce09a
cmp cl, bl
je 0x4ce096
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4ce09a
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4ce076
xor eax, eax
jmp 0x4ce09f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4ce0bf
lea eax, [esp + 0x4ac]
push eax
call fcn.004fb9d8
mov edi, eax
add esp, 4
cmp di, 0x46
jne 0x4ce19e
lea ecx, [esp + 0xe0]
lea edx, [esp + 0xaec]
push ecx
lea eax, [esp + 0x960]
push edx
lea ecx, [esp + 0x324]
push eax
push ecx
push 3
push 0x56a470
call fcn.004d83c0
add esp, 0x18
test eax, eax
je 0x4ce101
pop edi
pop esi
pop ebp
mov ax, 0x42
pop ebx
add esp, 0xc6c
ret
lea edx, [esp + 0x95c]
push edx
call fcn.004fb9d8
mov word [ebp + 0x44], ax
mov ax, word [esp + 0xc88]
lea ecx, [esp + 0xe4]
mov word [ebp + 0x42], ax
push ecx
call fcn.004fb9d8
mov word [ebp + 0x1a4], ax
mov ax, word [ebp + 0x74]
add esp, 8
cmp ax, 1
je 0x4ce145
cmp ax, 2
jne 0x4ce156
mov edx, dword [esp + 0xc88]
push edx
push ebp
call fcn.004cd6c0
add esp, 8
cmp di, bx
je 0x4ce161
cmp di, 0x46
jne 0x4ce19e
movsx esi, word [ebp + 0x5a]
lea eax, [esp + 0xaec]
inc esi
push eax
mov word [ebp + 0x5a], si
call fcn.004fb9d8
add esp, 4
cmp di, bx
mov word [ebp + esi*2 + 0x46], ax
jne 0x4ce19e
mov esi, dword [ebp + 0x5c]
lea ecx, [ebp + 0x64]
inc esi
push ecx
mov dword [ebp + 0x5c], esi
call fcn.004fbea1
add esp, 4
mov dword [ebp + 0x68], 0x78
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret