Function at 0x437480
Capabilities:
Get session user name

Disassembly:
sub esp, 0x174
push ebx
mov ebx, dword [esp + 0x184]
push ebp
xor ebp, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp ebx, ebp
push edi
je 0x4375cd
push ebx
call esi
test eax, eax
je 0x4375cd
push 0x4795fc
push ebx
call fcn.00452b10
add esp, 8
test eax, eax
je 0x43751a
push 0x4795f8
push ebx
mov esi, 2
call fcn.00452b10
add esp, 8
cmp eax, ebp
je 0x4374f0
inc eax
push eax
call fcn.004527ec
mov esi, eax
add esp, 4
cmp esi, 2
je 0x4374f0
cmp esi, 3
je 0x4374f0
mov esi, 2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
call edi
push 0x3e8
call edi
push ebp
call edi
push ebp
push esi
call fcn.004461d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
push 0x4795e8
push ebx
call fcn.00452b10
add esp, 8
test eax, eax
je 0x437555
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
call esi
push 0x3e8
call esi
push ebp
call esi
push ebp
call fcn.004466a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
push 0x4795e0
call esi
push eax
push 0x4795e0
push ebx
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x4375cd
push 0x4795c8
push 0x4795a8
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebp
je 0x4375a4
push ebp
push 0x9c49
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x174
ret 0x10
push 0x2710
push 0x10
push 0x474e90
push 0x479520
push ebp
call fcn.0042f2f0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x174
ret 0x10
call fcn.0042b620
test eax, eax
je 0x437603
push 0x462cc4
push ebx
call fcn.00452b10
add esp, 8
test eax, eax
jne 0x437603
call fcn.0042b690
test eax, eax
jne 0x4375f9
call fcn.0042b930
push ebp
jmp 0x4375fb
push 1
call fcn.0042beb0
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], ebp
mov dword [0x481a90], eax
mov dword [esp + 0x20], ebp
mov dword [0x481a94], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov dword [0x485b18], ebp
mov dword [0x481a98], eax
mov dword [0x481a90], 0x1805
call fcn.00437cc0
push ebx
xor edi, edi
call esi
test eax, eax
jle 0x43765a
movsx ecx, byte [edi + ebx]
push ecx
call fcn.00452c7c
add esp, 4
mov byte [edi + ebx], al
inc edi
push ebx
call esi
cmp edi, eax
jl 0x437642
push ebx
mov dword [esp + 0x18], ebp
xor edi, edi
call esi
test eax, eax
jle 0x4378c9
mov al, byte [edi + ebx]
lea ebp, [edi + ebx]
cmp al, 0x20
jle 0x43787b
push 0x462cb0
mov dword [esp + 0x18], 1
call esi
push eax
push 0x462cb0
push ebp
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x4376ad
mov dword [esp + 0x18], 1
push 0x462cb0
jmp 0x437877
push 0x462c94
call esi
push eax
push 0x462c94
push ebp
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x4376d9
mov dword [esp + 0x1c], 1
push 0x462c94
jmp 0x437877
push 0x462ca0
call esi
push eax
push 0x462ca0
push ebp
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x437705
mov dword [esp + 0x20], 1
push 0x462ca0
jmp 0x437877
push 0x462ca8
call esi
push eax
push 0x462ca8
push ebp
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x437733
mov dword [0x485b18], 1
push 0x462ca8
jmp 0x437877
push 0x462cc4
call esi
push eax
push 0x462cc4
push ebp
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x4377ff
mov dl, byte [0x481910]
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
push 0x481a94
mov dword [esp + 0x35], eax
mov byte [esp + 0x2c], dl
mov dword [esp + 0x39], eax
mov dword [0x481a98], 1
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], al
call fcn.0042fe30
add esp, 4
mov dword [esp + 0x14], 0
push 0x462cc4
call esi
add edi, eax
lea edx, [esp + 0x28]
mov cl, byte [edi + ebx]
lea eax, [edi + ebx]
cmp cl, 0x20
jne 0x4377b8
test cl, cl
je 0x4377b8
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x4377ab
mov cl, byte [eax]
cmp cl, 0x3a
jne 0x4377cc
test cl, cl
je 0x4377cc
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x3a
je 0x4377bf
mov cl, byte [eax]
cmp cl, 0x20
je 0x4377e3
test cl, cl
je 0x4377e3
mov byte [edx], cl
mov cl, byte [eax + 1]
inc edx
inc eax
cmp cl, 0x20
jne 0x4377d3
lea ecx, [esp + 0x28]
mov byte [edx], 0
push ecx
call fcn.00452877
add esp, 4
lea edx, [esp + 0x28]
mov dword [0x481a90], eax
push edx
jmp 0x437877
push 0x462cbc
call esi
push eax
push 0x462cbc
push ebp
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x437889
push 0x462cbc
mov dword [esp + 0x14], 1
call esi
add edi, eax
lea edx, [esp + 0x3c]
mov cl, byte [edi + ebx]
lea eax, [edi + ebx]
cmp cl, 0x20
jne 0x437846
test cl, cl
je 0x437846
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x437839
mov cl, byte [eax]
cmp cl, 0x20
je 0x43785d
test cl, cl
je 0x43785d
mov byte [edx], cl
mov cl, byte [eax + 1]
inc edx
inc eax
cmp cl, 0x20
jne 0x43784d
lea eax, [esp + 0x3c]
mov byte [edx], 0
push eax
call fcn.00452877
add esp, 4
lea ecx, [esp + 0x3c]
mov dword [0x481b80], eax
push ecx
call esi
add edi, eax
push ebx
inc edi
call esi
cmp edi, eax
jl 0x43766b
jmp 0x4378b7
mov ecx, 0xb
mov esi, 0x4794f0
lea edi, [esp + 0x50]
push 0x2710
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x40
lea edx, [esp + 0x58]
push 0x474e90
push edx
push 0
movsb byte es:[edi], byte [esi]
call fcn.0042f2f0
add esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4378ee
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4378ee
xor ebp, ebp
cmp dword [0x481a98], ebp
jne 0x4378ee
call fcn.00445b80
test eax, eax
je 0x4378e1
call fcn.00438620
jmp 0x4378e6
call fcn.004388a0
cmp eax, ebp
je 0x4375be
mov eax, dword [esp + 0x188]
mov dword [0x481a8c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x481a88], eax
call fcn.0042dca0
test eax, eax
jne 0x437931
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4794b0
call fcn.00446e00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
mov edi, 1
mov dword [0x481aa8], edi
call fcn.0042e040
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x43795b
push 0
call fcn.00437d80
add esp, 4
test eax, eax
je 0x4375be
call fcn.0042df70
call fcn.004455e0
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4379d6
call fcn.00437f60
test eax, eax
je 0x4379d1
call fcn.004455e0
test eax, eax
push 1
je 0x437990
push 0x4794a4
jmp 0x437995
push 0x479494
call fcn.0042b430
mov esi, eax
add esp, 8
test esi, esi
je 0x4379b5
push 0x47947c
push esi
call ebx
test eax, eax
je 0x4379b5
call eax
test eax, eax
jne 0x4379b9
xor eax, eax
jmp 0x4379d1
lea ecx, [esp + 0x24]
push ecx
push 0x479474
call dword [eax + 0x44]
test eax, eax
je 0x4379cc
xor edi, edi
push esi
call ebp
mov eax, edi
mov dword [0x481ba0], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4379e5
call fcn.0042deb0
jmp 0x4379ea
call fcn.0042de00
mov eax, dword [esp + 0x20]
test eax, eax
je 0x437a15
mov edi, dword [0x485b18]
xor edx, edx
test edi, edi
sete dl
push edx
call fcn.004466a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
call fcn.004455e0
test eax, eax
je 0x437ae7
mov edi, 1
call fcn.00437f60
test eax, eax
je 0x437a87
call fcn.004455e0
test eax, eax
push 1
je 0x437a42
push 0x4794a4
jmp 0x437a47
push 0x479494
call fcn.0042b430
mov esi, eax
add esp, 8
test esi, esi
je 0x437a67
push 0x47947c
push esi
call ebx
test eax, eax
je 0x437a67
call eax
test eax, eax
jne 0x437a6b
xor eax, eax
jmp 0x437a87
lea ecx, [esp + 0x24]
push ecx
push 0x479474
call dword [eax + 0x44]
test eax, eax
je 0x437a7e
xor edi, edi
push esi
call ebp
test edi, edi
mov eax, edi
jne 0x437a91
mov dword [0x481aa4], 1
test eax, eax
mov dword [0x481ba0], eax
jne 0x437ae7
call fcn.0042df70
test eax, eax
jne 0x437ae7
mov dword [0x481aa8], eax
mov eax, dword [0x485b18]
test eax, eax
jne 0x437ae7
mov eax, dword [0x482b34]
test eax, eax
je 0x437ad5
push 1
call fcn.0042dcd0
add esp, 4
test eax, eax
jne 0x437ae7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
push 0
call fcn.0042dcd0
add esp, 4
test eax, eax
je 0x4375be
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x437b14
mov edi, dword [0x485b18]
xor edx, edx
test edi, edi
sete dl
push edx
push 2
call fcn.004461d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x437b81
mov eax, dword [0x481a98]
test eax, eax
jne 0x437b81
call fcn.004455e0
test eax, eax
jne 0x437b81
lea eax, [esp + 0x10]
lea ecx, [esp + 0x80]
push eax
push ecx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x80]
push 0x46eff0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x437b81
push 0x57
push 0x4793a0
call fcn.00446e00
add esp, 8
call fcn.00445c00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
mov eax, dword [esp + 0x18]
test eax, eax
je 0x437b9b
call fcn.00445c00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
test esi, esi
jne 0x4375be
call fcn.004455e0
test eax, eax
jne 0x437c2a
mov eax, dword [0x481a98]
test eax, eax
jne 0x437c13
push 0x479318
call fcn.00446ef0
mov eax, dword [0x481aa8]
add esp, 4
test eax, eax
jne 0x437bd4
call fcn.0042df70
test eax, eax
je 0x437bdd
mov eax, dword [0x481b9c]
test eax, eax
jne 0x437c13
mov eax, dword [0x482b34]
test eax, eax
je 0x437c01
push 1
call fcn.0042dcd0
add esp, 4
test eax, eax
jne 0x4375be
mov eax, dword [0x482b34]
test eax, eax
jne 0x437c13
push 0
call fcn.0042dcd0
add esp, 4
test eax, eax
jne 0x4375be
push 0
call fcn.00438170
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
call fcn.004455e0
test eax, eax
je 0x4375be
mov eax, dword [0x481aa8]
test eax, eax
jne 0x437c49
call fcn.0042df70
test eax, eax
je 0x437c52
mov eax, dword [0x481b9c]
test eax, eax
jne 0x437c13
mov eax, dword [0x482b34]
test eax, eax
je 0x437c8a
push 1
call fcn.0042dcd0
add esp, 4
test eax, eax
jne 0x437c81
push 0x2710
push 0x30
push 0x474e90
push 0x4792b0
push 0
jmp 0x4375b6
mov eax, dword [0x482b34]
test eax, eax
jne 0x437c98
push 0
call fcn.0042dcd0
add esp, 4
test eax, eax
je 0x437c69
mov eax, dword [0x481aa8]
test eax, eax
jne 0x437caa
call fcn.0042df70
test eax, eax
je 0x437c69
mov eax, dword [0x481b9c]
test eax, eax
jne 0x437c13
jmp 0x437c69