Function at 0x404e80
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x465100
push 0x453acc
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x46af24]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x270], 1
xor esi, esi
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x260], esi
xor eax, eax
mov word [ebp - 0x5c], ax
push 0x3e
push esi
lea ecx, [ebp - 0x5a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, edi
call dword [sym.imp.mfc100u.dll_CWinApp::InitInstance]
push esi
call dword [sym.imp.mfc100u.dll_AfxEnableControlContainer]
add esp, 4
mov eax, dword [edi + 0x50]
cmp eax, esi
je 0x404f17
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push str.AVIRA_AntiVir
call dword [sym.imp.MSVCR100.dll__wcsdup]
add esp, 4
mov dword [edi + 0x50], eax
lea esi, [edi + 0xe90]
mov ebx, dword [edi + 0x48]
call fcn.00407d70
test eax, eax
jg 0x404f4e
push 0
push 0
push str.INVALID_PARAMETER_n_nThe_application_will_be_closed_
call dword [sym.imp.mfc100u.dll_AfxMessageBox]
jmp 0x4055d4
cmp dword [edi + 0xeac], 0
je 0x404fa4
xor edx, edx
mov word [ebp - 0x25c], dx
push 0x1fe
push edx
lea eax, [ebp - 0x25a]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x26c], pe_nt_image_headers32
lea ecx, [ebp - 0x26c]
push ecx
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.mfc100u.dll_AfxMessageBox]
mov ecx, esi
call fcn.00408110
test eax, eax
je 0x4055d4
lea ecx, [edi + 0xf2c]
mov dword [edi + 0xa84], ecx
lea edx, [edi + 0xf30]
mov dword [edi + 0xa88], edx
push 0x10000
call dword [sym.imp.mfc100u.dll_new__]
add esp, 4
mov dword [ebp - 0x268], eax
test eax, eax
je 0x4055d4
push 0x10000
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
lea ebx, [edi + 0xb8]
mov dword [ebp - 0x26c], ebx
mov eax, dword [ebx]
push esi
mov ecx, ebx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x274], eax
mov dword [ebp - 4], 0xfffffffe
mov esi, 1
mov dword [ebp - 4], esi
test eax, eax
je 0x4052d4
mov dword [ebp - 0x260], esi
mov eax, dword [edi + 0xaf8]
cmp dword [eax - 0xc], 0
je 0x405081
mov dword [ebp - 0x260], 2
mov eax, dword [edi + 0x50]
test eax, eax
je 0x405068
mov dword [ebp - 0x260], 3
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
add dword [ebp - 0x260], esi
mov eax, dword [edi + 0xaf8]
push eax
call dword [sym.imp.MSVCR100.dll__wcsdup]
add esp, 4
mov dword [edi + 0x50], eax
mov ecx, ebx
call fcn.004455f4
mov ecx, ebx
test eax, eax
je 0x405236
mov dword [ebp - 0x260], 0xa
call fcn.00445609
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4050a4
sub eax, edx
push 0x30
mov ecx, ebx
sar eax, 1
je 0x405174
mov dword [ebp - 0x260], 0xb
call fcn.00445609
push eax
mov ecx, ebx
call fcn.00445b75
mov dword [ebp - 0x260], 0xc
cmp dword [edi + 0xa6c], 0
je 0x405136
mov dword [ebp - 0x260], 0x14
mov ecx, ebx
call fcn.00445609
mov ecx, dword [edi + 0xa6c]
push eax
call fcn.004024a0
mov dword [ebp - 0x260], 0x15
mov ecx, ebx
call fcn.00445602
test eax, eax
je 0x405136
mov dword [ebp - 0x260], 0x16
mov ecx, ebx
call fcn.00445602
mov ecx, dword [edi + 0xa6c]
push eax
call fcn.004024a0
mov dword [ebp - 0x260], 0x1e
mov ecx, ebx
call fcn.004455f4
mov edi, eax
mov ecx, ebx
call fcn.00445609
mov ebx, eax
mov esi, dword [ebp - 0x264]
call fcn.00404e30
mov dword [ebp - 0x260], 0x1f
mov edi, esi
mov ebx, dword [ebp - 0x26c]
jmp 0x4052b1
cmp dword [edi + 0xa78], 0
je 0x405220
call fcn.004455f4
push eax
mov ecx, dword [edi + 0xa78]
call fcn.00443acb
push eax
mov ecx, ebx
call fcn.00445b75
cmp dword [edi + 0xa6c], 0
je 0x4051ea
mov ecx, ebx
call fcn.004455f4
push eax
mov ecx, dword [edi + 0xa78]
call fcn.00443acb
mov ecx, dword [edi + 0xa6c]
push eax
call fcn.004024a0
mov ecx, ebx
call fcn.00445602
test eax, eax
je 0x4051ea
mov dword [ebp - 0x260], 0xb
mov ecx, ebx
call fcn.00445602
mov ecx, dword [edi + 0xa6c]
push eax
call fcn.004024a0
mov ecx, ebx
call fcn.004455f4
mov edi, eax
mov ecx, ebx
call fcn.004455f4
push eax
mov esi, dword [ebp - 0x264]
mov ecx, dword [esi + 0xa78]
call fcn.00443acb
mov ebx, eax
call fcn.00404e30
mov edi, esi
mov ebx, dword [ebp - 0x26c]
jmp 0x4052b1
push str.UNKNOWN_ERROR_n_nThe_application_will_be_closed_
call fcn.00445b75
mov dword [ebp - 0x260], 0xb
jmp 0x4052b1
call fcn.004455fb
push 0x30
mov ecx, ebx
test eax, eax
je 0x405293
call fcn.00445602
push eax
mov ecx, ebx
call fcn.00445b75
cmp dword [edi + 0xa6c], 0
je 0x40526c
mov ecx, ebx
call fcn.00445602
mov ecx, dword [edi + 0xa6c]
push eax
call fcn.004024a0
mov ecx, ebx
call fcn.004455fb
mov edi, eax
mov ecx, ebx
call fcn.00445602
mov ebx, eax
mov esi, dword [ebp - 0x264]
call fcn.00404e30
mov edi, esi
mov ebx, dword [ebp - 0x26c]
jmp 0x4052b1
mov dword [ebp - 0x260], 0x3c
push str.UNKNOWN_ERROR_n_nThe_application_will_be_closed_
call fcn.00445b75
mov dword [ebp - 0x260], 0x3d
mov dword [ebp - 0x260], 0x46
mov dword [edi + 0xf28], 0x64
mov dword [ebp - 0x270], 0
mov esi, 1
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.mfc100u.dll_delete__]
add esp, 4
cmp dword [ebp - 0x270], 0
je 0x4055d4
mov ecx, dword [edi + 0xa74]
call fcn.004448fa
test eax, eax
je 0x405321
push 0x30
push 0xbf
mov ecx, dword [edi + 0xa64]
call fcn.004410cb
push eax
mov ecx, ebx
call fcn.00445b75
mov edx, dword [edi + 0xaf8]
cmp dword [edx - 0xc], 0
je 0x405351
mov eax, dword [edi + 0x50]
test eax, eax
je 0x40533e
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, dword [edi + 0xaf8]
push eax
call dword [sym.imp.MSVCR100.dll__wcsdup]
add esp, 4
mov dword [edi + 0x50], eax
push ebx
call fcn.00445d7c
add esp, 4
mov eax, esi
jmp 0x4055d6
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004534b8
mov esp, ebp
pop ebp
ret