Function at 0x406b20
Capabilities:
Get session user name
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x358c
call fcn.0052c8c0
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x3588], eax
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x3598]
push esi
mov esi, dword [esp + 0x35a4]
push 0x3f
lea eax, [esp + 0x1e5]
push ebx
push eax
mov dword [esp + 0x28], esi
mov byte [esp + 0x2c], bl
mov dword [esp + 0x2d], ebx
mov dword [esp + 0x31], ebx
mov word [esp + 0x35], bx
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov dword [esp + 0x39], ebx
mov dword [esp + 0x3d], ebx
mov word [esp + 0x41], bx
mov byte [esp + 0x43], bl
mov byte [esp + 0x1ec], bl
call sub.VCRUNTIME140.dll_memset
push 0x7f
lea ecx, [esp + 0x335]
push ebx
push ecx
mov byte [esp + 0x33c], bl
call sub.VCRUNTIME140.dll_memset
push 0x7f
lea edx, [esp + 0x441]
push ebx
push edx
mov byte [esp + 0x448], bl
call sub.VCRUNTIME140.dll_memset
push 0x7f
lea eax, [esp + 0x3cd]
push ebx
push eax
mov byte [esp + 0x3d4], bl
call sub.VCRUNTIME140.dll_memset
push 0x3f8
lea ecx, [esp + 0xea5]
push ebx
push ecx
mov byte [esp + 0xeac], bl
call sub.VCRUNTIME140.dll_memset
push 0x29
lea edx, [esp + 0x1f5]
push ebx
push edx
mov byte [esp + 0x80], bl
mov dword [esp + 0x81], ebx
mov dword [esp + 0x85], ebx
mov dword [esp + 0x89], ebx
mov dword [esp + 0x8d], ebx
mov word [esp + 0x91], bx
mov byte [esp + 0x93], bl
mov byte [esp + 0x1fc], bl
call sub.VCRUNTIME140.dll_memset
add esp, 0x48
push 0x29
lea eax, [esp + 0x161]
push ebx
push eax
mov byte [esp + 0x168], bl
call sub.VCRUNTIME140.dll_memset
push 0x29
lea ecx, [esp + 0x199]
push ebx
push ecx
mov byte [esp + 0x1a0], bl
call sub.VCRUNTIME140.dll_memset
push 0x80
lea edx, [esp + 0x2bd]
push ebx
push edx
mov byte [esp + 0x2c4], bl
call sub.VCRUNTIME140.dll_memset
mov byte [esp + 0x4c8], bl
push 0x1fb
lea eax, [esp + 0x4cd]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x3e8
lea ecx, [esp + 0x6d4]
push ebx
push ecx
mov dword [esp + 0x50], ebx
mov byte [esp + 0x88], bl
mov dword [esp + 0x89], ebx
mov dword [esp + 0x8d], ebx
mov dword [esp + 0x91], ebx
mov word [esp + 0x95], bx
mov byte [esp + 0x97], bl
call sub.VCRUNTIME140.dll_memset
push 0x3e8
lea edx, [esp + 0xac8]
push ebx
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0x48
push 0x3e8
lea eax, [esp + 0x25f8]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [esp + 0x22c]
push 0x40
push ecx
mov byte [esp + 0x88], bl
mov byte [esp + 0x130], bl
mov byte [esp + 0x274], bl
mov byte [esp + 0x234], bl
mov byte [esp + 0xc4], bl
mov byte [esp + 0xac], bl
mov byte [esp + 0xb8], bl
mov byte [esp + 0xa0], bl
call fcn.004031d0
add esp, 0x14
test eax, eax
jne 0x406d7e
push ebx
push 0x20
lea edx, [esp + 0xb8]
push edx
lea eax, [esp + 0x22c]
push eax
call fcn.004026d0
add esp, 0x10
test eax, eax
je 0x406d7e
mov byte [esp + 0xb0], bl
jmp 0x406d87
cmp byte [esp + 0xb0], bl
jne 0x406db4
lea ecx, [esp + 0xb0]
push 0x40
push ecx
call fcn.00402a20
add esp, 8
test eax, eax
je 0x406db4
push str.NoName
lea edx, [esp + 0xb4]
push 0x20
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
add esp, 0xc
push 0x5b1c60
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
add esp, 8
test eax, eax
jne 0x406ddd
push 0x5b1c60
lea eax, [esp + 0x224]
push 0x40
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x120]
push edx
mov dword [esp + 0x20], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x406e30
push 0x40
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x124]
push ecx
call fcn.00414570
add esp, 0xc
cmp eax, 0xffffffff
je 0x406e30
lea eax, [esp + 0x260]
push eax
push 0x40
lea ecx, [esp + 0x124]
push ecx
jmp 0x406e3f
push str.NoName
push 0x40
lea edx, [esp + 0x124]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
movzx eax, word [esp + 0x35ac]
add esp, 0xc
push eax
lea ecx, [esp + 0x6c]
push 0x58c3d8
push ecx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
call fcn.00410db0
mov edx, dword [ebp + 0x90]
push edx
lea eax, [esp + 0x6c]
push 0x58c37c
push eax
call fcn.00410db0
movzx ecx, word [esp + 0x35c0]
push ecx
lea edx, [esp + 0x10c]
push 0x58c3d8
push edx
call fcn.00410db0
mov eax, dword [0x8030ac]
push eax
lea ecx, [esp + 0x130]
push 0x58c37c
push ecx
call fcn.00410db0
movzx edx, word [esp + 0x35dc]
push edx
lea eax, [esp + 0x130]
push 0x58c3d8
push eax
call fcn.00410db0
mov ecx, dword [ebp + 0x1cc]
push ecx
lea edx, [esp + 0x110]
push 0x58c37c
push edx
call fcn.00410db0
add esp, 0x48
push 0x2c6
lea eax, [esp + 0xe8]
push 0x58c3d8
push eax
call fcn.00410db0
push ebx
lea ecx, [esp + 0xa8]
push 0x58c3d8
push ecx
call fcn.00410db0
push ebx
lea edx, [esp + 0xc0]
push 0x58c3d8
push edx
call fcn.00410db0
add esp, 0x24
cmp word [ebp + 0x1d0], bx
jne 0x406f69
push ebx
lea eax, [esp + 0x10c]
push 0x58c37c
push eax
call fcn.00410db0
push ebx
lea ecx, [esp + 0xe0]
push 0x58c37c
push ecx
call fcn.00410db0
add esp, 0x18
cmp word [ebp + 0x1d0], 1
jne 0x406f92
cmp word [ebp + 0x1d2], bx
jne 0x406f92
push ebx
lea edx, [esp + 0xd4]
push 0x58c37c
push edx
call fcn.00410db0
add esp, 0xc
mov eax, dword [esp + 0x35b4]
cmp eax, 0x400
ja 0x40768c
cmp eax, ebx
push edi
jne 0x40705a
push ebx
lea eax, [esp + 0x28]
push 0x58c3d8
push eax
call fcn.00410db0
push ebx
lea ecx, [esp + 0x40]
push 0x58c3d8
push ecx
call fcn.00410db0
push ebx
lea edx, [esp + 0xa0]
push 0x58c3d8
push edx
call fcn.00410db0
push ebx
lea eax, [esp + 0x20c]
push 0x58c3d8
push eax
call fcn.00410db0
push ebx
lea ecx, [esp + 0x35c]
push 0x58c3d8
push ecx
call fcn.00410db0
push ebx
lea edx, [esp + 0x468]
push 0x58c3d8
push edx
call fcn.00410db0
add esp, 0x48
push ebx
lea eax, [esp + 0x3ac]
push 0x58c3d8
push eax
call fcn.00410db0
push ebx
lea ecx, [esp + 0x4c]
push 0x58c3d8
push ecx
call fcn.00410db0
push ebx
lea edx, [esp + 0xe90]
push 0x58c3d8
push edx
call fcn.00410db0
add esp, 0x24
jmp 0x407225
lea esi, [ebp + 0x5fc]
mov ecx, 0xa
lea edi, [esp + 0x1b8]
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebp + 0x6a9]
movsw word es:[edi], word [esi]
mov dl, byte [ebp + 0x6a8]
lea esi, [ebp + 0xcb0]
mov ecx, 0xa
lea edi, [esp + 0x160]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebp + 0xcda]
mov ecx, 0xa
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
mov cl, byte [ebp + 0x6a7]
mov byte [esp + 0x13], al
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x15], cl
lea ecx, [esp + 0x4ac]
mov byte [esp + 0x16], dl
mov edx, dword [ebp + 0xab0]
push ecx
push edx
lea eax, [ebp + 0xab4]
push eax
movsw word es:[edi], word [esi]
mov dword [esp + 0x28], 0x1fc
call fcn.00409800
lea esi, [ebp + 0x626]
mov ecx, 0x20
lea edi, [esp + 0x2b4]
rep movsd dword es:[edi], dword [esi]
movsx ecx, byte [esp + 0x23]
push ecx
lea edx, [esp + 0x38]
push 0x58c3d8
push edx
movsb byte es:[edi], byte [esi]
call fcn.00410db0
movsx eax, byte [esp + 0x2d]
push eax
lea ecx, [esp + 0x50]
push 0x58c3d8
push ecx
call fcn.00410db0
movsx edx, byte [esp + 0x3a]
push edx
lea eax, [esp + 0xb0]
push 0x58c3d8
push eax
call fcn.00410db0
lea eax, [esp + 0x2d8]
add esp, 0x34
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x407146
sub eax, edx
je 0x407199
lea eax, [esp + 0x2a4]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x407160
push 0x10
lea ecx, [esp + 0x54]
sub eax, edx
push ecx
push eax
lea edx, [esp + 0x2b0]
push edx
call fcn.00416180
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x64]
push 0x10
push ecx
call fcn.00402af0
add esp, 0x1c
jmp 0x4071af
push ebx
lea edx, [esp + 0x1e8]
push 0x58c3d8
push edx
call fcn.00410db0
add esp, 0xc
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x1bc]
push 0x2a
push ecx
call fcn.00402af0
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x170]
push 0x2a
push eax
call fcn.00402af0
lea ecx, [esp + 0x3c0]
push ecx
lea edx, [esp + 0x1a8]
push 0x2a
push edx
call fcn.00402af0
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x64]
push 0x58c3d8
push ecx
call fcn.00410db0
mov eax, dword [esp + 0x48]
lea edx, [esp + 0xea4]
push edx
push eax
lea ecx, [esp + 0x4e0]
push ecx
call fcn.00402af0
add esp, 0x3c
mov eax, dword [ebp + 0x78]
cmp eax, 0xffffffff
jne 0x407232
mov eax, 1
cmp dword [ebp + 0x1e4], 1
jne 0x407240
or eax, 0x1000000
push eax
lea edx, [esp + 0x94]
push 0x598eb8
push edx
call fcn.00410db0
lea eax, [esp + 0xe80]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x3bc]
push edx
lea eax, [esp + 0x440]
push eax
lea ecx, [esp + 0x344]
push ecx
lea edx, [esp + 0x204]
push edx
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x144]
push edx
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x27c]
push ecx
lea edx, [esp + 0x17c]
push edx
lea eax, [esp + 0xc0]
push eax
push 0x16
push 0x5b20e4
call fcn.004149c0
mov esi, eax
add esp, 0x6c
cmp esi, ebx
jne 0x407333
mov eax, 0x4a
mov dword [ebp + 0x94], eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3588]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x358c
ret
push esi
lea ecx, [esp + 0x25fc]
push 0x3e8
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x260c]
push eax
push str.findFirstUnitEx2
push 3
push 0x5b1f90
call fcn.004149c0
mov esi, eax
add esp, 0x24
cmp esi, ebx
je 0x4073a5
push esi
lea ecx, [esp + 0xa90]
push 0x3e8
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea edx, [esp + 0xa9c]
push edx
call fcn.00414c50
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x4073ae
mov ax, 0x4a
jmp 0x40731a
push esi
lea eax, [esp + 0xa90]
push 0x3e8
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea ecx, [esp + 0x6b4]
push ecx
lea edx, [esp + 0xaa0]
push ebp
push edx
call fcn.00413590
movzx eax, ax
add esp, 0x1c
cmp ax, bx
je 0x4073f7
push ebp
push eax
call fcn.00406990
add esp, 8
jmp 0x40731a
lea eax, [esp + 0x6a4]
push eax
call fcn.004151e0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x407508
push 0x3e8
lea ecx, [esp + 0x1274]
push ebx
push ecx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x6b0]
push edx
lea eax, [esp + 0x1280]
push eax
lea ecx, [esp + 0x31c4]
push ecx
push esi
push 3
push 0x5b1f90
call fcn.00414ff0
push esi
movzx edi, ax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x28
cmp di, bx
jne 0x407508
mov edi, 0x5b2108
lea esi, [esp + 0x31b0]
mov ecx, 6
xor edx, edx
mov byte [esp + 0x3597], bl
repe cmpsb byte [esi], byte es:[edi]
mov dword [esp + 0x14], ebx
jne 0x4074bd
lea eax, [esp + 0x1270]
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
movzx eax, ax
add esp, 4
cmp ax, 0x46
mov dword [esp + 0x14], eax
je 0x4074bd
cmp ax, 0x50
je 0x4074bd
jmp 0x40731a
lea ecx, [esp + 0x2210]
push ecx
lea edx, [esp + 0x1a44]
push edx
lea eax, [esp + 0x1660]
push eax
lea ecx, [esp + 0x2dd4]
push ecx
lea edx, [esp + 0x29f0]
push edx
lea eax, [esp + 0x1e3c]
push eax
lea ecx, [esp + 0x6bc]
push ecx
push 6
push 0x5b20e4
call fcn.00414ff0
add esp, 0x24
test eax, eax
je 0x407511
mov ax, 0x42
jmp 0x40731a
lea edx, [esp + 0x1e28]
push edx
mov byte [esp + 0x2213], bl
mov byte [esp + 0x2dcb], bl
mov byte [esp + 0x31b3], bl
mov byte [esp + 0x1a43], bl
mov byte [esp + 0x1e2b], bl
mov byte [esp + 0x25fb], bl
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov word [ebp + 0x44], ax
mov ax, word [esp + 0x35a8]
lea ecx, [esp + 0x2dcc]
push ecx
mov word [ebp + 0x42], ax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
lea edx, [esp + 0x1660]
push edx
mov word [ebp + 0x1c8], ax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov dword [ebp + 0x1d8], eax
lea eax, [esp + 0x1a4c]
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
lea ecx, [esp + 0x2220]
push ecx
mov dword [ebp + 0x1e0], eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov ecx, dword [ebp + 0x1d8]
add esp, 0x14
xor edx, edx
cmp ecx, 5
je 0x4075b4
cmp ecx, 7
jne 0x4075d8
test eax, 0x4000
mov edx, 8
je 0x4075c5
mov edx, 0xd
test eax, 0x2000
je 0x4075d8
test byte [ebp + 0x1e0], 0x10
je 0x4075d8
or edx, 2
movzx eax, word [ebp + 0x98]
cmp ax, 1
mov dword [ebp + 0x1dc], edx
je 0x4075f1
cmp ax, 2
jne 0x4075ff
mov edx, dword [esp + 0x20]
push edx
push ebp
call fcn.00406190
add esp, 8
mov edi, dword [esp + 0x14]
cmp di, bx
je 0x407614
cmp di, 0x46
je 0x407614
cmp di, 0x50
jne 0x407675
movsx esi, word [ebp + 0x70]
cmp esi, 9
jge 0x407626
add esi, 1
mov word [ebp + 0x70], si
jmp 0x40762c
mov word [ebp + 0x70], bx
xor esi, esi
lea eax, [esp + 0x29e0]
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
cmp di, bx
mov dword [ebp + esi*4 + 0x48], eax
jne 0x40767d
add dword [ebp + 0x74], 1
lea ecx, [ebp + 0x80]
push ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
lea esi, [ebp + 0x88]
push esi
mov dword [esi], 0x78
mov dword [esi + 4], ebx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov edx, dword [ebp + 0x78]
add esp, 8
add dword [esi], edx
adc dword [esi + 4], ebx
mov ax, di
jmp 0x40731a
cmp di, 0x50
jne 0x407675
mov ax, 0x46
jmp 0x40731a
mov ecx, dword [esp + 0x3594]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov ax, 0x4a
call fcn.0052bfb9
add esp, 0x358c
ret