Function at 0x401260
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x417f40
push 0x4071e0
mov eax, dword fs:[0]
push eax
sub esp, 0x748
mov eax, dword [0x41b2c4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x6f0], ecx
xor ebx, ebx
mov dword [ebp - 0x69c], ebx
mov dword [ebp - 0x694], ebx
mov edx, dword [0x41d184]
mov dword [ebp - 0x458], edx
xor eax, eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov eax, dword [0x41d188]
push eax
call dword [sym.imp.WS2_32.dll_WSALookupServiceEnd]
mov esi, eax
add esi, 2
mov dword [ebp - 0x6b4], esi
xor eax, eax
mov dword [ebp - 0x690], eax
jmp 0x401300
cmp eax, dword [ebp - 0x6f0]
jge 0x40190d
mov ecx, dword [ebp - 0x698]
mov dl, byte [ecx + eax]
mov byte [ebp - 0x689], dl
cmp dword [0x41d188], ebx
jne 0x401397
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x688], 0x128
jmp 0x401340
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x664]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401376
cmp dx, bx
je 0x401372
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401376
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401350
xor eax, eax
jmp 0x40137b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401386
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x688]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401340
mov ecx, dword [ebp - 0x694]
imul ecx, dword [ebp + 0xc]
imul ecx, ecx, 0x26
lea ecx, [ecx + esi + 7]
mov dword [ebp - 0x6a0], ecx
movzx eax, word [ebp - 0x698]
lea edx, [eax + eax*2]
mov edi, edx
mov eax, 0x78787879
imul dword [0x41d17c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x41d190]
movzx edx, al
sub edi, edx
movzx edx, byte [ebp - 0x450]
add edi, edx
mov dword [0x41d17c], edi
cmp eax, ebx
je 0x40141a
lea edi, [esi + 5]
imul edi, dword [ebp - 0x690]
sub edi, 1
mov eax, dword [ebp - 0x694]
cdq
idiv edi
imul eax, dword [ebp + 0xc]
add eax, ecx
mov ecx, 9
sub ecx, esi
imul eax, ecx
add dword [ebp - 0x69c], eax
mov dword [ebp - 0x6c0], ebx
mov byte [ebp - 0x438], bl
mov byte [ebp - 0x437], bl
mov byte [ebp - 0x436], bl
mov byte [ebp - 0x435], bl
mov byte [ebp - 0x434], bl
mov byte [ebp - 0x433], 1
lea edx, [ebp - 0x6c0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x438]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call edi
test eax, eax
jne 0x40146f
mov dword [0x41d178], ebx
mov cl, byte [ebp - 0x6a0]
xor cl, byte [ebp - 0x689]
mov byte [ebp - 0x689], cl
cmp dword [0x41d184], ebx
je 0x40152b
lea edx, [ebp - 0x708]
push edx
push 0xf003f
push ebx
lea eax, [ebp - 0x228]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x430], bl
mov byte [ebp - 0x42f], bl
mov byte [ebp - 0x42e], bl
mov byte [ebp - 0x42d], bl
mov byte [ebp - 0x42c], bl
mov byte [ebp - 0x42b], 5
mov dword [ebp - 0x6ec], ebx
mov dword [ebp - 0x6c8], ebx
lea ecx, [ebp - 0x6ec]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea edx, [ebp - 0x430]
push edx
call edi
test eax, eax
jne 0x401502
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x6c8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x430]
push ecx
call edi
test eax, eax
jne 0x40152b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp - 0x698], bl
jne 0x401547
movzx edx, word [0x41d17c]
imul edx, dword [ebp - 0x6ac]
sub dword [ebp - 0x6b8], edx
mov dword [ebp - 0x6c4], ebx
mov byte [ebp - 0x448], bl
mov byte [ebp - 0x447], bl
mov byte [ebp - 0x446], bl
mov byte [ebp - 0x445], bl
mov byte [ebp - 0x444], bl
mov byte [ebp - 0x443], 0xf
lea eax, [ebp - 0x6c4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 2
push 2
lea ecx, [ebp - 0x448]
push ecx
call edi
test eax, eax
jne 0x401598
mov dword [0x41d178], ebx
push 0x40
push ebx
lea edx, [ebp - 0x758]
push edx
call fcn.00408860
add esp, 0xc
mov dword [ebp - 0x758], 0x1f0001
wait
mov dword [ebp - 4], ebx
mov ecx, dword [0x41d18c]
mov eax, dword [0x41d17c]
mov dword [ecx], eax
wait
mov dword [ebp - 4], 0xfffffffe
jmp 0x40160d
lea eax, [ebp - 0x228]
movzx eax, ax
movzx edx, byte [ebp - 0x450]
sub edx, eax
sub edx, dword [ebp - 0x454]
sub edx, dword [ebp - 0x698]
add edx, 7
mov dword [0x41d178], edx
mov edx, dword [ebp - 0x458]
cmp edx, ebx
je 0x401646
imul eax, edx
mov dword [0x41d178], eax
cmp cx, bx
je 0x40166b
movzx eax, word [ebp - 0x454]
imul eax, dword [ebp - 0x458]
movzx ecx, cx
imul ecx, dword [ebp - 0x6ac]
sub ecx, eax
mov dword [ebp - 0x6ac], ecx
cmp dword [ebp + 0xc], ebx
je 0x401687
mov edx, dword [ebp - 0x698]
mov al, byte [ebp - 0x6a4]
mov ecx, dword [ebp - 0x690]
mov byte [edx + ecx], al
jmp 0x401696
mov eax, dword [ebp - 0x698]
mov edx, dword [ebp - 0x690]
mov byte [eax + edx], al
mov eax, 3
sub eax, esi
mov edi, dword [ebp - 0x69c]
add edi, eax
mov dword [ebp - 0x69c], edi
mov dword [ebp - 0x6e8], ebx
xor eax, eax
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x6f8], ebx
mov dword [ebp - 0x704], ebx
mov dword [ebp - 0x700], ebx
mov dword [ebp - 0x6fc], ebx
mov byte [ebp - 0x440], bl
mov byte [ebp - 0x43f], bl
mov byte [ebp - 0x43e], bl
mov byte [ebp - 0x43d], bl
mov byte [ebp - 0x43c], bl
mov byte [ebp - 0x43b], 1
mov dword [ebp - 0x6a8], ebx
lea ecx, [ebp - 0x6a8]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea edx, [ebp - 0x440]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40174c
mov dword [0x41d178], 1
mov ecx, 0x20
lea eax, [ebp - 0x6e8]
mov byte [eax], bl
add eax, 1
sub ecx, 1
jne 0x401757
mov dword [ebp - 0x6e8], 0x1fffff
mov dword [ebp - 0x6e4], 2
mov dword [ebp - 0x6e0], ebx
mov dword [ebp - 0x6d4], ebx
mov dword [ebp - 0x6d0], 5
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6cc], eax
lea ecx, [ebp - 0x6f8]
push ecx
push ebx
lea edx, [ebp - 0x6e8]
push edx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4017cb
mov dword [0x41d178], ebx
cmp dword [0x41d188], ebx
je 0x4017f1
mov eax, dword [ebp - 0x6a0]
imul eax, edi
imul eax, eax, 0xffffffb8
mov ecx, dword [ebp - 0x690]
add ecx, 4
cdq
idiv ecx
mov dword [ebp - 0x694], eax
mov eax, dword [0x41d184]
mov dword [ebp - 0x6b0], ebx
lea edx, [ebp - 0x6b0]
push edx
push ebx
lea ecx, [ebp - 0x718]
push ecx
push 0x1c
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40184b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x40182a
add dword [0x41d178], 1
mov edx, dword [ebp - 0x6b0]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x40184b
add dword [0x41d17c], 1
mov ecx, dword [0x41d184]
cmp ecx, ebx
jne 0x401878
cmp dword [ebp - 0x6a0], edi
jle 0x401874
mov eax, esi
imul eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x694]
add edx, eax
lea eax, [edx + eax*4]
mov dword [ebp - 0x694], eax
cmp ecx, ebx
je 0x4018c6
mov dword [ebp - 0x6f4], 0x200
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6bc]
push eax
push 1
lea ecx, [ebp - 0x428]
push ecx
push ebx
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
je 0x4018ba
mov dword [0x41d178], 1
mov edx, dword [ebp - 0x6bc]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [0x41d18c], ebx
jne 0x4018fb
mov eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0x690]
jge 0x4018fb
mov eax, dword [ebp - 0x6a0]
imul eax, edi
cdq
idiv esi
mov ecx, dword [ebp - 0x694]
imul ecx, ecx, 0xffffffe3
sub ecx, eax
add edi, ecx
mov dword [ebp - 0x69c], edi
add dword [ebp - 0x690], 1
mov eax, dword [ebp - 0x690]
jmp 0x401300
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004040b2
mov esp, ebp
pop ebp
ret 8