Function at 0x486f20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x520404]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x528b00]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x334], ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x52809c]
mov dword [ebp - 0x320], ebx
cmp eax, dword [ecx + 4]
jg 0x487276
cmp byte [0x51ff0c], 0
je 0x48724f
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004ac800
add esp, 0xc
mov dword [ebp - 0x324], 0x104
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x486fbc
mov ecx, dword [0x528098]
add ecx, 0xfffffff0
mov byte [0x51ff0c], al
push ecx
jmp 0x487258
lea eax, [ebp - 0x310]
push str.SYSTEM
push eax
call fcn.004af5ae
add esp, 8
test eax, eax
jne 0x487248
push str.Program_Manager
push str.Progman
mov dword [ebp - 0x31c], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x487248
push esi
lea ecx, [ebp - 0x31c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 0x318]
push eax
push dword [ebp - 0x31c]
mov dword [ebp - 0x318], 0
call esi
test eax, eax
je 0x487247
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
test eax, eax
je 0x487247
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x314]
jne 0x487247
push edi
push dword [ebp - 0x31c]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x320], edi
test edi, edi
je 0x487246
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48723f
mov esi, dword [ebp - 0x318]
test esi, esi
je 0x48723f
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004ac800
add esp, 0xc
mov dword [ebp - 0x328], 0
lea eax, [ebp - 0x328]
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x487233
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push dword [ebp - 0x108]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov ecx, dword [ebp - 0x314]
mov dword [ebp - 0x330], ecx
test ecx, ecx
je 0x48721d
mov esi, ecx
lea edx, [esi + 2]
lea ecx, [ecx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x487130
sub esi, edx
sar esi, 1
je 0x48721d
mov eax, dword [0x528098]
mov ebx, ecx
sub ebx, eax
sar ebx, 1
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x32c], edx
test esi, esi
js 0x4872ce
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or edx, ecx
jge 0x487182
push esi
mov ecx, 0x528098
call fcn.00478400
mov eax, dword [0x528098]
lea edi, [esi + esi]
mov ecx, dword [eax - 8]
cmp ebx, dword [ebp - 0x32c]
ja 0x4871bb
lea edx, [eax + ebx*2]
test edi, edi
je 0x4871f8
test edx, edx
jne 0x4871a8
call fcn.004b4a32
mov dword [eax], 0x16
jmp 0x4871ee
add ecx, ecx
cmp ecx, edi
jb 0x4871e3
push edi
push edx
push eax
call fcn.004ac280
add esp, 0xc
jmp 0x4871f3
add ecx, ecx
test edi, edi
je 0x4871f8
cmp ecx, edi
jb 0x4871d7
push edi
push dword [ebp - 0x330]
push eax
call fcn.004ac280
add esp, 0xc
jmp 0x4871f3
push ecx
push 0
push eax
call fcn.004ac800
add esp, 0xc
call fcn.004b4a32
mov dword [eax], 0x22
call fcn.004af44f
mov eax, dword [0x528098]
cmp esi, dword [eax - 8]
jg 0x4872ce
mov ebx, dword [ebp - 0x334]
xor ecx, ecx
mov dword [eax - 0xc], esi
mov eax, dword [0x528098]
mov word [edi + eax], cx
mov edi, dword [ebp - 0x320]
jmp 0x487227
mov ecx, 0x528098
call fcn.0047bb00
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x318]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov byte [0x51ff0c], 0
mov eax, dword [0x528098]
add eax, 0xfffffff0
push eax
call fcn.00477fc0
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [ebx], eax
mov eax, ebx
pop ebx
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret
push 0x52809c
call fcn.004a7e78
add esp, 4
cmp dword [0x52809c], 0xffffffff
jne 0x486f63
call fcn.004782d0
mov ecx, eax
test ecx, ecx
jne 0x4872a5
push 0x80004005
call fcn.00477ec0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x4e3160
mov dword [0x528098], eax
call fcn.004a7c9b
push 0x52809c
call fcn.004a7e2e
add esp, 8
jmp 0x486f63
push 0x80070057
call fcn.00477ec0
int3