Function at 0x4f2240
Capabilities:
Get session user name

Disassembly:
sub esp, 0xbf8
xor eax, eax
mov ecx, 0x64
push ebx
push esi
push edi
lea edi, [esp + 0x2a4]
push ebp
rep stosd dword es:[edi], eax
lea edi, [esp + 0x118]
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea edi, [esp + 0x438]
mov ecx, 0x64
rep stosd dword es:[edi], eax
xor ebx, ebx
push 0x40
mov byte [esp + 0x30], bl
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x9c]
mov byte [esp + 0xdc], bl
mov byte [esp + 0x9c], bl
push eax
mov byte [esp + 0x40], bl
call fcn.004f5c10
add esp, 8
test eax, eax
jne 0x4f22c6
lea eax, [esp + 0x38]
push ebx
lea ecx, [esp + 0x9c]
push eax
push ecx
call fcn.004f89c0
add esp, 0xc
test eax, eax
je 0x4f22c6
mov byte [esp + 0x38], bl
cmp byte [esp + 0x38], 0
jne 0x4f2301
lea eax, [esp + 0x38]
push 0x40
push eax
call fcn.004f8e80
add esp, 8
test eax, eax
je 0x4f2301
mov bx, word [0x4e9248]
mov eax, dword [0x4e9244]
mov ecx, 0x4e9244
lea edx, [esp + 0x38]
mov cl, byte [ecx + 6]
mov dword [edx], eax
mov word [edx + 4], bx
mov byte [edx + 6], cl
mov eax, dword [esp + 0xc14]
push 0x4e920c
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4f234e
mov eax, dword [0x4e920c]
mov ebx, dword [0x4e9210]
lea edx, [esp + 0x98]
mov ebp, dword [0x4e9214]
mov ecx, 0x4e920c
mov dword [edx], eax
mov ax, word [ecx + 0xc]
mov dword [edx + 4], ebx
mov cl, byte [ecx + 0xe]
mov dword [edx + 8], ebp
mov word [edx + 0xc], ax
mov byte [edx + 0xe], cl
lea eax, [esp + 0x10]
lea ecx, [esp + 0x58]
mov dword [esp + 0x10], 0x40
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x4f23b1
lea eax, [esp + 0xd8]
push 0x40
lea ecx, [esp + 0x5c]
push eax
push ecx
call fcn.004f9c90
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f23b1
lea edi, [esp + 0xd8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f23d2
mov bx, word [0x4e9248]
mov eax, dword [0x4e9244]
mov ecx, 0x4e9244
lea edx, [esp + 0x58]
mov cl, byte [ecx + 6]
mov dword [edx], eax
mov word [edx + 4], bx
mov byte [edx + 6], cl
lea eax, [esp + 0x14]
xor esi, esi
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea eax, [esp + 0x20]
mov dword [eax], esi
lea ecx, [esp + 0x14]
mov dword [eax + 4], esi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [eax + 8], esi
mov eax, dword [esp + 0xc10]
and eax, 0xffff
push eax
push 0x4e9240
push ecx
call edi
mov ebx, dword [esp + 0xc18]
lea ecx, [esp + 0x2c]
add esp, 0xc
mov eax, dword [ebx + 0x6c]
push eax
push 0x4e9240
push ecx
call edi
lea ecx, [esp + 0x20]
lea edx, [esp + 0x44]
lea eax, [esp + 0xa4]
add esp, 0xc
push ecx
push edx
lea ecx, [esp + 0x60]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
push 5
push 0x4e923c
call fcn.004f97e0
add esp, 0x1c
mov edx, eax
test edx, edx
jne 0x4f246f
push ebx
push 0x4a
call fcn.004f2a00
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x438]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [sym.imp.MSVCRT.dll_free]
call ebp
lea eax, [esp + 0x30]
lea ecx, [esp + 0x43c]
add esp, 4
push eax
push ecx
push 0x4e922c
push 3
push 0x4e91fc
call fcn.004f97e0
add esp, 0x14
mov edx, eax
test edx, edx
jne 0x4f24d7
mov ax, 0x4a
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
lea ecx, [esp + 0x11c]
add esp, 4
push ecx
call fcn.004f98e0
add esp, 4
mov edx, eax
test edx, edx
jne 0x4f2528
mov ax, 0x4a
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
lea ecx, [esp + 0x2ac]
lea eax, [esp + 0x11c]
add esp, 4
push ecx
push ebx
push eax
call fcn.004f6b50
add esp, 0xc
test ax, ax
je 0x4f2587
push ebx
push eax
call fcn.004f2940
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
lea eax, [esp + 0x2a8]
push eax
call fcn.004f95b0
add esp, 4
mov esi, eax
test esi, esi
jne 0x4f25ac
mov ax, 0x42
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
lea eax, [esp + 0x2c]
lea edi, [esp + 0x5c8]
mov ecx, 0x64
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
xor eax, eax
lea edx, [esp + 0x5c8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2a8]
lea eax, [esp + 0x758]
push ecx
push edx
push eax
push esi
push 3
push 0x4e91fc
call fcn.004f93d0
mov di, ax
add esp, 0x18
push esi
call ebp
add esp, 4
test di, di
je 0x4f2619
mov ax, 0x42
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
mov bp, 0
lea esi, [esp + 0x758]
mov edi, 0x4e9224
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
jne 0x4f2659
lea eax, [esp + 0x5c8]
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
push eax
call esi
mov bp, ax
add esp, 4
cmp bp, 0x46
je 0x4f265f
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
lea eax, [esp + 0xa78]
lea ecx, [esp + 0x8e8]
lea edx, [esp + 0x2a8]
push eax
push ecx
push edx
push 2
push 0x4e923c
call fcn.004f93d0
add esp, 0x14
test eax, eax
je 0x4f2699
mov ax, 0x42
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret
lea eax, [esp + 0x8e8]
push eax
call esi
mov word [ebx + 0x44], ax
add esp, 4
mov ax, word [esp + 0xc10]
mov word [ebx + 0x42], ax
mov ax, word [ebx + 0x74]
cmp ax, 1
je 0x4f26c6
cmp ax, 2
jne 0x4f26d7
mov eax, dword [esp + 0xc14]
push eax
push ebx
call fcn.004f2140
add esp, 8
test bp, bp
je 0x4f26e2
cmp bp, 0x46
jne 0x4f2725
movsx edi, word [ebx + 0x5a]
cmp edi, 9
jge 0x4f26f2
inc edi
mov word [ebx + 0x5a], di
jmp 0x4f26fa
mov word [ebx + 0x5a], 0
xor edi, edi
lea eax, [esp + 0xa78]
push eax
call esi
mov word [ebx + edi*2 + 0x46], ax
add esp, 4
test bp, bp
jne 0x4f2725
lea eax, [ebx + 0x64]
push eax
call dword [sym.imp.MSVCRT.dll_time]
mov dword [ebx + 0x68], 0x78
add esp, 4
mov ax, bp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xbf8
ret