Function at 0x414aff
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 8], 0xffffffff
push ebx
mov dword [ebp - 4], fcn.00414aff
mov eax, dword [ebp - 4]
xor ebx, ebx
push esi
cmp dword [0x44333c], ebx
jne 0x414b65
push 0x28
call fcn.0042141f
pop ecx
cmp eax, ebx
je 0x414b36
mov ecx, eax
call fcn.00425d8a
jmp 0x414b38
xor eax, eax
mov dword [0x44333c], eax
cmp eax, ebx
je 0x414b65
push 0x12c
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x44333c]
push eax
push 0x406568
push 0x4081e8
push 2
call fcn.00426024
push 0x443348
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x414b87
push 0x4081c4
push ebx
push 0x64
call fcn.00426404
push 0x444630
push 0x444640
push 0x4064cf
push 0x406938
call fcn.0041264c
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x3c93
lea ecx, [ebp - 8]
call fcn.00413f4d
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jge 0x414bd8
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x414c08
push eax
push 0x408178
push ebx
push 0x3c
push ecx
jmp 0x414c00
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_PowerSetRequest]
test eax, eax
jne 0x414c08
cmp dword [0x44333c], ebx
je 0x414c08
call esi
push eax
push 0x40813c
push ebx
push 0x3c
push dword [0x44333c]
call fcn.004264d9
add esp, 0x14
push edi
mov edi, 0x4442c8
mov ecx, edi
call fcn.00416ba0
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x414cbe
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x414c3d
push dword [ebp - 4]
push 0x4080e8
push ebx
push 0x3c
push eax
call fcn.004264d9
add esp, 0x14
push 2
call fcn.00413283
test eax, eax
je 0x4153b2
cmp dword [0x444664], ebx
je 0x4153b2
mov al, byte [0x444668]
cmp al, 2
jae 0x414c69
cmp al, bl
jne 0x4153b2
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b2
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b2
cmp ecx, edx
jne 0x4153b2
push dword [ebp - 4]
push 0x406a38
push dword [0x444634]
push dword [0x444630]
call fcn.004126bb
jmp 0x4153b2
push edi
call fcn.004161ed
push 0x4442b8
push dword [ebp + 8]
call fcn.0041490e
mov edi, eax
cmp edi, ebx
jge 0x414d45
push 9
call fcn.00413283
test eax, eax
je 0x4153b2
cmp dword [0x444664], ebx
je 0x4153b2
mov al, byte [0x444668]
cmp al, 2
jae 0x414d03
cmp al, bl
jne 0x4153b2
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b2
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b2
cmp ecx, edx
jne 0x4153b2
push edi
push 0x406998
jmp 0x414ca8
push ebx
push dword [0x4442b8]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
test eax, eax
jne 0x414def
call esi
cmp eax, ebx
jle 0x414d69
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x414d86
push esi
push 0x408078
push ebx
push 0x3c
push eax
call fcn.004264d9
add esp, 0x14
push 0xa
call fcn.00413283
test eax, eax
je 0x4153b2
cmp dword [0x444664], ebx
je 0x4153b2
mov al, byte [0x444668]
cmp al, 2
jae 0x414db2
cmp al, bl
jne 0x4153b2
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b2
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b2
cmp ecx, edx
jne 0x4153b2
push esi
jmp 0x414ca3
push 2
push ebx
push ebx
push 0x414560
push ebx
push 0x20
push 0x20
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [0x443354], eax
cmp eax, ebx
jne 0x414e94
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x414e27
push 0x408028
push ebx
push 0x3c
call fcn.00426404
push 2
call fcn.00413283
test eax, eax
je 0x4153b2
cmp dword [0x444664], ebx
je 0x4153b2
mov al, byte [0x444668]
cmp al, 2
jae 0x414e53
cmp al, bl
jne 0x4153b2
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b2
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b2
cmp ecx, edx
jne 0x4153b2
push 0x57c
jmp 0x414ca3
lea eax, [ebp - 0xc]
push eax
mov edi, 0x443108
push edi
push 3
mov dword [ebp - 0xc], 0x104
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x414ee4
call esi
cmp eax, ebx
jle 0x414ec0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x414edd
push esi
push 0x407fd8
push ebx
push 0x3c
push eax
call fcn.004264d9
add esp, 0x14
push 2
jmp 0x414d88
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x414eff
push edi
push 0x407fac
push ebx
push 0x64
push eax
call fcn.004264d9
add esp, 0x14
push 0x80
call fcn.00415820
mov ecx, dword [0x44333c]
mov edi, 0x8000ef5c
test eax, eax
je 0x41502d
cmp ecx, ebx
je 0x414f2d
push 0x407f30
push ebx
push 0x3c
call fcn.00426404
push 0x40
call fcn.00415820
test eax, eax
je 0x415112
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x414f53
push 0x407ea0
push ebx
push 0x3c
call fcn.00426404
push 0x80
call fcn.00415820
mov ecx, dword [0x44333c]
test eax, eax
je 0x4151ee
cmp ecx, ebx
je 0x414f7c
push 0x407e20
push ebx
push 0x3c
call fcn.00426404
mov ebx, 0x4442b0
call fcn.00413162
mov edi, eax
xor esi, esi
cmp edi, esi
jge 0x415262
mov eax, dword [0x44333c]
cmp eax, esi
je 0x414fad
push edi
push 0x407dd0
push esi
push 0x3c
push eax
call fcn.004264d9
add esp, 0x14
push 2
call fcn.00413283
test eax, eax
je 0x4153b0
cmp dword [0x444664], 0
je 0x4153b0
mov al, byte [0x444668]
cmp al, 2
jae 0x414fda
test al, al
jne 0x4153b0
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b0
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b0
cmp ecx, edx
jne 0x4153b0
push edi
push 0x406a38
push dword [0x444634]
push dword [0x444630]
call fcn.004126bb
jmp 0x4153b0
cmp ecx, ebx
je 0x41503e
push 0x407d80
push ebx
push 0x64
call fcn.00426404
mov ecx, 0x444620
call fcn.004126f1
cmp eax, edi
jne 0x415070
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x414f2d
push edi
push 0x407d18
push ebx
push 0x64
push eax
call fcn.004264d9
add esp, 0x14
jmp 0x414f2d
cmp eax, ebx
jge 0x414f2d
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x415094
push eax
push 0x407cd0
push ebx
push 0x3c
push ecx
call fcn.004264d9
add esp, 0x14
push 6
call fcn.00413283
test eax, eax
je 0x4153b2
cmp dword [0x444664], ebx
je 0x4153b2
mov al, byte [0x444668]
cmp al, 2
jae 0x4150c0
cmp al, bl
jne 0x4153b2
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b2
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b2
cmp ecx, edx
jne 0x4153b2
push 0x406a18
push dword [0x444634]
push dword [0x444630]
call fcn.0041269f
jmp 0x4153b2
push dword [0x4442b8]
mov esi, 0x444610
mov ecx, esi
call fcn.00412825
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x41514f
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x415148
push dword [ebp - 4]
push 0x407c70
push ebx
push 0x3c
push eax
call fcn.004264d9
add esp, 0x14
push 0xb
jmp 0x414c3f
push 0x443108
mov ecx, esi
call fcn.004128cc
mov esi, eax
cmp esi, ebx
jge 0x414f53
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x415180
push esi
push 0x407c20
push ebx
push 0x3c
push eax
call fcn.004264d9
add esp, 0x14
push 0xb
call fcn.00413283
test eax, eax
je 0x4153b2
cmp dword [0x444664], ebx
je 0x4153b2
mov al, byte [0x444668]
cmp al, 2
jae 0x4151ac
cmp al, bl
jne 0x4153b2
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b2
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b2
cmp ecx, edx
jne 0x4153b2
push esi
push 0x406a88
jmp 0x414ca8
cmp ecx, ebx
je 0x4151ff
push 0x407bb8
push ebx
push 0x64
call fcn.00426404
push 0x8013
push 0x8014
push dword [0x4442b8]
mov ecx, 0x444620
call fcn.00413ed4
cmp eax, edi
jne 0x415241
mov eax, dword [0x44333c]
cmp eax, ebx
je 0x414f7c
push edi
push 0x407b30
push ebx
push 0x64
push eax
call fcn.004264d9
add esp, 0x14
jmp 0x414f7c
cmp eax, ebx
jge 0x414f7c
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x415094
push eax
push 0x407aa0
jmp 0x415088
call fcn.004159ba
cmp eax, esi
mov ecx, dword [0x44333c]
jge 0x4152f9
cmp ecx, esi
je 0x41528b
push eax
push 0x407a50
push esi
push 0x3c
push ecx
call fcn.004264d9
add esp, 0x14
push 7
call fcn.00413283
test eax, eax
je 0x4153b0
cmp dword [0x444664], 0
je 0x4153b0
mov al, byte [0x444668]
cmp al, 2
jae 0x4152b8
test al, al
jne 0x4153b0
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b0
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b0
cmp ecx, edx
jne 0x4153b0
push 0x406978
jmp 0x41539f
cmp ecx, esi
je 0x41530a
push 0x407a08
push esi
push 0x64
call fcn.00426404
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x41532b
cmp eax, 0xffffffff
je 0x415338
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
call ebx
cmp eax, esi
jne 0x415312
mov ecx, dword [0x44333c]
cmp ecx, esi
je 0x41534f
push 0x4079c8
push esi
push 0x64
call fcn.00426404
push esi
call fcn.00413283
test eax, eax
je 0x4153b0
cmp dword [0x444664], 0
je 0x4153b0
mov al, byte [0x444668]
cmp al, 2
jae 0x41536f
test al, al
jne 0x4153b0
mov edx, dword [0x444654]
mov eax, 0x80000000
and edx, eax
xor ecx, ecx
or ecx, edx
je 0x4153b0
mov edx, dword [0x44465c]
mov ecx, edx
and ecx, eax
xor eax, eax
cmp eax, dword [0x444658]
jne 0x4153b0
cmp ecx, edx
jne 0x4153b0
push 0x4069f8
push dword [0x444634]
push dword [0x444630]
call fcn.0041269f
xor ebx, ebx
mov ecx, dword [0x44333c]
pop edi
cmp ecx, ebx
je 0x4153ca
push 0x407998
push ebx
push 0x64
call fcn.00426404
lea ecx, [ebp - 8]
call fcn.00412f98
cmp eax, ebx
jge 0x4153f2
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x4153f2
push eax
push 0x407958
push ebx
push 0x50
push ecx
call fcn.004264d9
add esp, 0x14
push 1
call fcn.00415e4c
mov ecx, 0x4442c8
mov esi, eax
call fcn.00416c2d
push 0x444630
call fcn.00412673
push 0x443348
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x415435
mov ecx, dword [0x44333c]
cmp ecx, ebx
je 0x41542f
push 1
call fcn.00412fd3
mov dword [0x44333c], ebx
cmp dword [ebp - 8], 0xffffffff
je 0x415444
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
leave
ret 0x10