Function at 0x43dde0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ec
push ebx
push esi
push edi
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x5c], 0x14d
mov dword [ebp - 4], 0x42a
mov dword [ebp - 0x50], 0
cmp dword [ebp + 0x18], 0
je 0x43de32
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x43e020
mov eax, dword [ebp + 0x10]
push eax
push 0xf00ff
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [ebp - 0x54], eax
cmp dword [0x462058], 0
je 0x43df5f
cmp dword [ebp + 0x18], 0
je 0x43df5f
lea eax, [ebp - 0x894]
mov dword [ebp - 0x490], eax
mov word [ebp - 0x494], 0x400
mov word [ebp - 0x492], 0x400
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x494]
and eax, 0xffff
push eax
lea eax, [ebp - 0x494]
push eax
push 0x1b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [0x462058]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x43df5a
mov eax, dword [ebp - 0x490]
push eax
call fcn.00453060
add esp, 4
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0
jle 0x43df5a
dec dword [ebp - 0x898]
mov eax, dword [ebp - 0x490]
mov ecx, dword [ebp - 0x898]
xor edx, edx
mov dx, word [eax + ecx*2]
cmp edx, 0x5c
jne 0x43df55
mov eax, dword [ebp - 0x898]
lea eax, [eax*2 + 2]
add eax, dword [ebp - 0x490]
push eax
push 0x47beec
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x898], 0
jmp 0x43def7
jmp 0x43df5f
mov byte [ebp - 0x9e8], 0
mov dword [ebp - 0x5c], 0x14d
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x9e8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x9ec], eax
xor eax, eax
mov al, byte [0xb4bb40]
test eax, eax
je 0x43dff3
mov edi, 0xb4bb40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0x14]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x9e8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
mov edi, dword [ebp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43e01b
lea edi, [ebp - 0x9e8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0x14]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43e020
mov eax, dword [ebp - 0x58]
jmp 0x43e028
pop edi
pop esi
pop ebx
leave
ret