Function at 0x52e5cc
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x64c], edx
mov dword [ebp - 0x610], edx
mov esi, eax
xor eax, eax
push ebp
push 0x52e886
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x52e857
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x10], 0x3e8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x222]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x60b]
push eax
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x52e857
mov eax, esi
mov edx, 0x52e8a0
call fcn.00404e08
mov dword [ebp - 4], 0xfffffffd
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x60b]
push eax
call sub.advapi32.dll_GetSidIdentifierAuthority
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x52e857
mov edi, ebx
mov bl, byte [edi]
test bl, bl
jne 0x52e6ae
cmp byte [edi + 1], 0
je 0x52e753
lea eax, [ebp - 0x610]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x648], eax
mov byte [ebp - 0x644], 0xb
xor eax, eax
mov al, bl
mov dword [ebp - 0x640], eax
mov byte [ebp - 0x63c], 0
xor eax, eax
mov al, byte [edi + 1]
mov dword [ebp - 0x638], eax
mov byte [ebp - 0x634], 0
xor eax, eax
mov al, byte [edi + 2]
mov dword [ebp - 0x630], eax
mov byte [ebp - 0x62c], 0
xor eax, eax
mov al, byte [edi + 3]
mov dword [ebp - 0x628], eax
mov byte [ebp - 0x624], 0
xor eax, eax
mov al, byte [edi + 4]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0x61c], 0
xor eax, eax
mov al, byte [edi + 5]
mov dword [ebp - 0x618], eax
mov byte [ebp - 0x614], 0
lea edx, [ebp - 0x648]
mov ecx, 6
mov eax, 0x52e8b0
call fcn.0040afd8
mov edx, dword [ebp - 0x610]
mov eax, esi
call fcn.00404e08
jmp 0x52e7bb
xor ebx, ebx
mov bl, byte [edi + 2]
shl ebx, 8
xor eax, eax
mov al, byte [edi + 3]
add ebx, eax
shl ebx, 8
xor eax, eax
mov al, byte [edi + 4]
add ebx, eax
shl ebx, 8
xor eax, eax
mov al, byte [edi + 5]
add ebx, eax
lea eax, [ebp - 0x64c]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 0x658], 0xb
mov dword [ebp - 0x654], ebx
mov byte [ebp - 0x650], 0
lea edx, [ebp - 0x65c]
mov ecx, 1
mov eax, 0x52e8d8
call fcn.0040afd8
mov edx, dword [ebp - 0x64c]
mov eax, esi
call fcn.00404e08
mov dword [ebp - 4], 0xfffffffc
lea eax, [ebp - 0x60b]
push eax
call sub.advapi32.dll_GetSidSubAuthorityCount
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x52e857
movzx edi, byte [ebx]
dec edi
test edi, edi
jl 0x52e852
inc edi
xor ebx, ebx
mov dword [ebp - 4], 0xfffffffb
push ebx
lea eax, [ebp - 0x60b]
push eax
call sub.advapi32.dll_GetSidSubAuthority
mov dword [ebp - 0x18], eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x52e857
lea eax, [ebp - 0x660]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 0x658], 0xb
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x654], eax
mov byte [ebp - 0x650], 0
lea edx, [ebp - 0x65c]
mov ecx, 1
mov eax, 0x52e8e8
call fcn.0040afd8
mov edx, dword [ebp - 0x660]
mov eax, esi
call fcn.00404e08
inc ebx
dec edi
jne 0x52e7e4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e88d
lea eax, [ebp - 0x660]
call fcn.00404db4
lea eax, [ebp - 0x64c]
call fcn.00404db4
lea eax, [ebp - 0x610]
call fcn.00404db4
ret