Function at 0x401f30
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5548ff
mov eax, dword fs:[0]
push eax
sub esp, 0x8a0
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x40242f
cmp dword [edi + 4], 0
jne 0x401f74
call fcn.00401e00
push 0x200
call fcn.0051ebe4
mov esi, eax
mov dword [ebp - 0x848], esi
push 0x200
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00525340
mov ecx, dword [edi + 4]
lea eax, [edi + 8]
add esp, 0x10
mov dword [edi + 4], 0
push eax
push ecx
mov ecx, esi
call fcn.00412180
mov dword [ebp - 4], 0xffffffff
mov esi, dword [edi]
mov dword [edi], eax
test esi, esi
je 0x401fd7
mov ecx, esi
call fcn.00412dc0
push 0x200
push esi
call fcn.0051ec14
add esp, 8
call fcn.004a7f70
mov ecx, 0x5843b8
mov dword [ebp - 0x18], 0
test al, al
mov dword [ebp - 0x14], 0xf
mov edx, 0x5843b4
mov byte [ebp - 0x28], 0
cmove edx, ecx
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402002
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00403f90
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x864]
push 6
push str.OSBITS
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0xf
mov byte [ebp - 0x864], 0
call fcn.00403f90
mov byte [ebp - 4], 2
mov esi, dword [edi]
lea ebx, [esi + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x84c]
push eax
lea ecx, [esi + 0x38]
call fcn.00416300
mov ecx, dword [ebp - 0x84c]
lea eax, [ebp - 0x28]
add ecx, 0x20
cmp ecx, eax
je 0x402090
cmp dword [ebp - 0x14], 0x10
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00403f90
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x850]
cmp edx, 0x10
jb 0x4020d5
mov ecx, dword [ebp - 0x864]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4020cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40244b
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0xf
mov byte [ebp - 0x864], 0
cmp edx, 0x10
jb 0x40212b
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402121
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402450
push edx
push ecx
call fcn.0051ec14
add esp, 8
push 5
push str.OSVER
lea ecx, [ebp - 0x87c]
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x868], 0xf
mov byte [ebp - 0x87c], 0
call fcn.00403f90
mov dword [ebp - 4], 4
call fcn.004a8030
lea ecx, [ebp - 0x13]
test eax, eax
jns 0x40217d
neg eax
mov edx, eax
call fcn.00404aa0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x402186
mov edx, eax
call fcn.00404aa0
mov ecx, eax
lea eax, [ebp - 0x13]
mov dword [ebp - 0x854], 0
mov byte [ebp - 0x864], 0
mov ebx, 0xf
mov dword [ebp - 0x850], ebx
cmp ecx, eax
je 0x4021be
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x864]
call fcn.00403f90
mov ebx, dword [ebp - 0x850]
mov byte [ebp - 4], 5
mov esi, dword [edi]
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x84c]
push eax
lea ecx, [esi + 0x38]
call fcn.00416300
mov ecx, dword [ebp - 0x84c]
lea eax, [ebp - 0x864]
add ecx, 0x20
cmp ecx, eax
je 0x402213
push dword [ebp - 0x854]
cmp ebx, 0x10
cmovae eax, dword [ebp - 0x864]
push eax
call fcn.00403f90
mov ebx, dword [ebp - 0x850]
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 4
cmp ebx, 0x10
jb 0x402255
mov ecx, dword [ebp - 0x864]
inc ebx
mov eax, ecx
cmp ebx, 0x1000
jb 0x40224b
mov ecx, dword [ecx - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402455
push ebx
push ecx
call fcn.0051ec14
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x868]
cmp edx, 0x10
jb 0x402296
mov ecx, dword [ebp - 0x87c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40228c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40245a
push edx
push ecx
call fcn.0051ec14
add esp, 8
push 0x800
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.00525340
add esp, 0xc
mov dword [ebp - 0x844], 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x828]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
push dword [ebp - 0x844]
xor eax, eax
mov dword [ebp - 0x830], 0
mov word [ebp - 0x840], ax
lea ecx, [ebp - 0x840]
lea eax, [ebp - 0x828]
mov dword [ebp - 0x82c], 7
push eax
call fcn.00403df0
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x894]
push 8
push str.USERNAME
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x880], 0xf
mov byte [ebp - 0x894], 0
call fcn.00403f90
lea edx, [ebp - 0x840]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8ac]
call fcn.004ad250
mov ebx, eax
mov byte [ebp - 4], 9
mov esi, dword [edi]
lea edi, [esi + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x84c]
push eax
lea ecx, [esi + 0x38]
call fcn.00416300
mov ecx, dword [ebp - 0x84c]
add ecx, 0x20
cmp ecx, ebx
je 0x402392
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x402389
mov eax, dword [ebx]
push dword [ebx + 0x10]
push eax
call fcn.00403f90
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x898]
cmp edx, 0x10
jb 0x4023d3
mov ecx, dword [ebp - 0x8ac]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4023c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40245f
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov edx, dword [ebp - 0x880]
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x898], 0xf
mov byte [ebp - 0x8ac], 0
cmp edx, 0x10
jb 0x402424
mov ecx, dword [ebp - 0x894]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40241a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402464
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x840]
call fcn.00403d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
call fcn.00528129
int3