Function at 0x4cae60
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea903
mov eax, dword fs:[0]
push eax
mov eax, 0x1460
call fcn.005c2160
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1424], ecx
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.005c0cf0
add esp, 0xc
mov byte [ebp - 0x514], 0
push 0xff
push 0
lea ecx, [ebp - 0x513]
push ecx
call fcn.005c0cf0
add esp, 0xc
mov dword [ebp - 0x518], 0x400
mov dword [ebp - 0x51c], pe_nt_image_headers32
call fcn.00506990
test eax, eax
je 0x4cb370
call fcn.0041ac50
mov edx, dword [eax + 0x178]
mov dword [ebp - 0x52c], edx
call fcn.0041ac50
mov eax, dword [eax + 0x17c]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
cmp dword [ebp - 0x52c], 0
je 0x4cafac
lea ecx, [ebp - 0x524]
push ecx
lea edx, [ebp - 0x528]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
push 0
call dword [ebp - 0x52c]
test eax, eax
je 0x4cafac
cmp dword [ebp - 0x528], 0
je 0x4caf85
mov ecx, dword [ebp - 0x524]
cmp ecx, dword [ebp - 0x518]
jae 0x4caf85
mov edx, dword [ebp - 0x524]
push edx
mov eax, dword [ebp - 0x528]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.005c3170
add esp, 0xc
jmp 0x4caf91
mov dl, byte [0x61784f]
mov byte [ebp - 0x414], dl
cmp dword [ebp - 0x520], 0
je 0x4cafa7
mov eax, dword [ebp - 0x528]
push eax
call dword [ebp - 0x520]
jmp 0x4cb36b
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x6a6
jne 0x4cb2ad
call fcn.005069d0
test eax, eax
jne 0x4cb2ad
push 1
push 2
lea ecx, [ebp - 0x5bc]
call fcn.0040a750
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x530]
push ecx
push 0x61ee5c
lea edx, [ebp - 0x5bc]
push edx
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.00419990
lea eax, [ebp - 0x1340]
push eax
lea ecx, [ebp - 0x5bc]
call fcn.00408c00
mov dword [ebp - 0x1428], eax
mov ecx, dword [ebp - 0x1428]
mov dword [ebp - 0x142c], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x142c]
call fcn.0040b520
push eax
push 0x61ee78
push 0x4e
push 0x61ee98
push 0x18
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1340]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.004094e0
lea ecx, [ebp - 0x531]
call fcn.0053a4c0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x538]
push edx
push 0x61eeac
lea ecx, [ebp - 0x531]
call fcn.00534c50
movzx eax, al
test eax, eax
je 0x4cb200
lea ecx, [ebp - 0x6b4]
call fcn.0052d7b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x67c]
call fcn.004155f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x67c]
push ecx
mov edx, dword [ebp - 0x538]
push edx
lea ecx, [ebp - 0x6b4]
call fcn.0052f640
lea ecx, [ebp - 0x69c]
call fcn.0040b5f0
mov byte [ebp - 4], 5
push 0
push 0x61eebc
lea ecx, [ebp - 0x664]
call fcn.00425320
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 0xffffffff
je 0x4cb19a
lea ecx, [ebp - 0x664]
call fcn.0041e9f0
sub eax, dword [ebp - 0x680]
sub eax, 1
je 0x4cb19a
lea ecx, [ebp - 0x664]
call fcn.0041e9f0
sub eax, dword [ebp - 0x680]
sub eax, 1
push eax
mov eax, dword [ebp - 0x680]
add eax, 1
push eax
lea ecx, [ebp - 0x135c]
push ecx
lea ecx, [ebp - 0x664]
call fcn.00425380
mov dword [ebp - 0x1430], eax
mov edx, dword [ebp - 0x1430]
mov dword [ebp - 0x1434], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1434]
push eax
lea ecx, [ebp - 0x69c]
call fcn.0040b620
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x135c]
call fcn.0040b640
jmp 0x4cb1ac
lea ecx, [ebp - 0x664]
push ecx
lea ecx, [ebp - 0x69c]
call fcn.0040b620
lea ecx, [ebp - 0x69c]
call fcn.0040b520
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.005be4fe
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x69c]
call fcn.0040b640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x67c]
call fcn.00415560
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6b4]
call fcn.0040e850
jmp 0x4cb296
push 1
push 2
lea ecx, [ebp - 0x734]
call fcn.0040a750
mov byte [ebp - 4], 7
push 0x61eec0
lea ecx, [ebp - 0x734]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x1378]
push edx
lea ecx, [ebp - 0x734]
call fcn.00408c00
mov dword [ebp - 0x1438], eax
mov eax, dword [ebp - 0x1438]
mov dword [ebp - 0x143c], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x143c]
call fcn.0040b520
push eax
push 0x61eee4
push 0x65
push 0x61ef04
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1378]
call fcn.0040b640
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x734]
call fcn.004094e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x531]
call fcn.0053e6a0
jmp 0x4cb36b
push 1
push 2
lea ecx, [ebp - 0x7b4]
call fcn.0040a750
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x530]
push ecx
push str.WTSQuerySessionInformation:
lea edx, [ebp - 0x7b4]
push edx
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.00419990
lea eax, [ebp - 0x1394]
push eax
lea ecx, [ebp - 0x7b4]
call fcn.00408c00
mov dword [ebp - 0x1440], eax
mov ecx, dword [ebp - 0x1440]
mov dword [ebp - 0x1444], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x1444]
call fcn.0040b520
push eax
push 0x61ef34
push 0x6b
push 0x61ef54
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1394]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b4]
call fcn.004094e0
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x4cb4e7
call fcn.00506950
test eax, eax
je 0x4cb4d3
lea ecx, [ebp - 0x7b5]
call fcn.0053a4c0
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x7bc]
push ecx
push 0x61ef68
lea ecx, [ebp - 0x7b5]
call fcn.00534c50
movzx edx, al
test edx, edx
je 0x4cb429
lea ecx, [ebp - 0x894]
call fcn.0052d7b0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x87c]
call fcn.004155f0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x87c]
push eax
mov ecx, dword [ebp - 0x7bc]
push ecx
lea ecx, [ebp - 0x894]
call fcn.0052f640
lea ecx, [ebp - 0x864]
call fcn.0040b520
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.005be4fe
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x87c]
call fcn.00415560
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x894]
call fcn.0040e850
jmp 0x4cb4bf
push 1
push 2
lea ecx, [ebp - 0x914]
call fcn.0040a750
mov byte [ebp - 4], 0xe
push 0x61ef78
lea ecx, [ebp - 0x914]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x13b0]
push edx
lea ecx, [ebp - 0x914]
call fcn.00408c00
mov dword [ebp - 0x1448], eax
mov eax, dword [ebp - 0x1448]
mov dword [ebp - 0x144c], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x144c]
call fcn.0040b520
push eax
push 0x61ef9c
push 0x7f
push 0x61efbc
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x13b0]
call fcn.0040b640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x914]
call fcn.004094e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b5]
call fcn.0053e6a0
jmp 0x4cb4e7
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040b4d0
push 1
push 2
lea ecx, [ebp - 0x994]
call fcn.0040a750
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0x61efd0
lea edx, [ebp - 0x994]
push edx
call fcn.00409270
add esp, 8
push eax
call fcn.00408950
add esp, 8
lea eax, [ebp - 0x13cc]
push eax
lea ecx, [ebp - 0x994]
call fcn.00408c00
mov dword [ebp - 0x1450], eax
mov ecx, dword [ebp - 0x1450]
mov dword [ebp - 0x1454], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1454]
call fcn.0040b520
push eax
push 0x61efe0
push 0x87
push 0x61f000
push 0x18
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x13cc]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x994]
call fcn.004094e0
mov ecx, dword [ebp + 0xc]
call fcn.0040b520
push eax
push str.system
call fcn.0046ce00
add esp, 8
test eax, eax
jne 0x4cb5c1
mov ecx, dword [ebp + 0xc]
call fcn.00420af0
call fcn.005066d0
test eax, eax
je 0x4cb8e8
mov ecx, dword [ebp + 0xc]
call fcn.0040b5d0
movzx edx, al
test edx, edx
jne 0x4cb8e8
mov byte [ebp - 0xd94], 0
push 0x3ff
push 0
lea eax, [ebp - 0xd93]
push eax
call fcn.005c0cf0
add esp, 0xc
mov dword [ebp - 0xd9c], 0x400
mov dword [ebp - 0xd98], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xd98]
push edx
call fcn.0050d7d0
add esp, 8
test eax, eax
je 0x4cb726
mov eax, dword [ebp - 0xd98]
push eax
lea ecx, [ebp - 0x11a0]
call fcn.00445e90
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0xd9c]
push ecx
lea edx, [ebp - 0xd94]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x11a0]
call fcn.0048acf0
push eax
call fcn.00506cf0
add esp, 0x14
test eax, eax
jne 0x4cb714
push 1
push 2
lea ecx, [ebp - 0x1224]
call fcn.0040a750
mov byte [ebp - 4], 0x13
push 0x61f01c
lea edx, [ebp - 0x1224]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x13e8]
push eax
lea ecx, [ebp - 0x1224]
call fcn.00408c00
mov dword [ebp - 0x1458], eax
mov ecx, dword [ebp - 0x1458]
mov dword [ebp - 0x145c], ecx
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x145c]
call fcn.0040b520
push eax
push 0x61f030
push 0x9a
push 0x61f050
push 0x18
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x13e8]
call fcn.0040b640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1224]
call fcn.004094e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a0]
call fcn.004cd610
mov byte [ebp - 0x119c], 0
push 0x3ff
push 0
lea edx, [ebp - 0x119b]
push edx
call fcn.005c0cf0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0xd94]
push ecx
push str._s_s
lea edx, [ebp - 0x119c]
push edx
call fcn.004cd640
add esp, 0x10
push 1
push 2
lea ecx, [ebp - 0x12a4]
call fcn.0040a750
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x119c]
push eax
push 0x61f06c
lea ecx, [ebp - 0x12a4]
push ecx
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x1404]
push edx
lea ecx, [ebp - 0x12a4]
call fcn.00408c00
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x1460]
mov dword [ebp - 0x1464], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1464]
call fcn.0040b520
push eax
push 0x61f07c
push 0xa0
push 0x61f09c
push 0x18
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1404]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12a4]
call fcn.004094e0
lea ecx, [ebp - 0x51c]
push ecx
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x119c]
push eax
call fcn.00506f10
add esp, 0xc
test eax, eax
jne 0x4cb8d9
push 1
push 2
lea ecx, [ebp - 0x1324]
call fcn.0040a750
mov dword [ebp - 4], 0x17
push 0x61f0b0
lea ecx, [ebp - 0x1324]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0x1420]
push edx
lea ecx, [ebp - 0x1324]
call fcn.00408c00
mov dword [ebp - 0x1468], eax
mov eax, dword [ebp - 0x1468]
mov dword [ebp - 0x146c], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x146c]
call fcn.0040b520
push eax
push str.CSLogonUser::GetLogonUserName
push 0xa4
push 0x61f0e4
push 0x18
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1420]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1324]
call fcn.004094e0
mov eax, 1
jmp 0x4cb8ed
lea ecx, [ebp - 0x514]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040b4d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret 0xc