Function at 0x59b804
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27
push 0
push 0
dec ecx
jne 0x59b80c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x59c1fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x39]
call fcn.00407b30
mov byte [ebp - 0x19], 0
lea eax, [ebx + 4]
call fcn.00407b30
lea eax, [ebx + 8]
call fcn.00407b30
lea eax, [ebx + 0xc]
mov edx, 0x59c21c
call fcn.00407f10
lea eax, [ebx + 0x10]
mov edx, 0x59c22c
call fcn.00407f10
lea eax, [ebx + 0x14]
mov edx, 0x59c248
call fcn.00407f10
lea eax, [ebx + 0x18]
call fcn.00407b30
lea eax, [ebx + 0x1c]
mov edx, 0x59c248
call fcn.00407f10
call sub.kernel32.dll_GetACP_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x6c]
call fcn.00421b28
mov edx, dword [ebp - 0x6c]
lea eax, [ebx + 0x20]
call fcn.00407f10
mov byte [ebx + 0x24], 0
lea eax, [ebx + 0x25]
call fcn.00407b30
lea eax, [ebx + 0x61]
call fcn.00407b30
lea eax, [ebx + 0x65]
call fcn.00407b30
lea eax, [ebx + 0x69]
call fcn.00407b30
lea eax, [ebx + 0x6d]
call fcn.00407b30
mov dl, 1
mov eax, dword [0x471f14]
call fcn.00473060
mov edi, eax
mov edx, 0x80000002
mov eax, edi
call fcn.00473148
mov edx, 0x59c25c
mov eax, edi
call fcn.004733d4
test al, al
jne 0x59b911
lea eax, [ebx + 0x39]
mov edx, 0x59c298
call fcn.00407f10
mov eax, edi
call fcn.00473118
mov eax, edi
call fcn.00405de4
jmp 0x59c18a
lea ecx, [ebp - 0x70]
mov edx, 0x59c2b8
mov eax, edi
call fcn.00473c5c
mov edx, dword [ebp - 0x70]
lea eax, [ebx + 4]
call fcn.00407f10
lea ecx, [ebp - 0xc]
mov edx, 0x59c2dc
mov eax, edi
call fcn.00473c5c
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00407f10
mov eax, edi
call fcn.00473118
mov eax, edi
call fcn.00405de4
cmp dword [ebx + 4], 0
je 0x59c18a
mov eax, dword [ebx + 4]
test eax, eax
je 0x59b969
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx + 4]
cmp word [edx + eax*2 - 2], 0x5c
je 0x59b981
lea eax, [ebx + 4]
mov edx, 0x59c300
call fcn.00408dc8
cmp dword [ebp - 0xc], 0
je 0x59b996
mov eax, dword [ebp - 0xc]
mov edx, 0x59c21c
call fcn.00408fb8
jne 0x59b9a3
lea eax, [ebx + 8]
mov edx, dword [ebx + 4]
call fcn.00407f10
jmp 0x59b9f4
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
call sub.advapi32.dll_GetUserNameW
push dword [ebx + 4]
push 0x59c310
lea eax, [ebp - 0x74]
lea edx, [ebp - 0x68]
mov ecx, 0x20
call fcn.00408c70
push dword [ebp - 0x74]
push 0x59c300
lea eax, [ebx + 8]
mov edx, 4
call fcn.00408ea8
lea eax, [ebx + 0x10]
lea edx, [ebp - 0x68]
mov ecx, 0x20
call fcn.00408c70
lea eax, [ebx + 0x25]
mov ecx, 0x59c330
mov edx, dword [ebx + 8]
call fcn.00408e20
mov dl, 1
mov eax, dword [ebx + 0x25]
call fcn.0042242c
test al, al
jne 0x59ba2d
lea eax, [ebx + 8]
mov edx, dword [ebx + 4]
call fcn.00407f10
lea eax, [ebx + 0x25]
mov ecx, 0x59c330
mov edx, dword [ebx + 8]
call fcn.00408e20
mov ecx, dword [ebx + 0x25]
mov dl, 1
mov eax, dword [0x47058c]
call fcn.00470948
mov esi, eax
push 0x59c35c
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x59c370
mov edx, 0x59c390
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x78]
lea eax, [ebx + 0x3d]
call fcn.00407f10
push 0x59c35c
lea eax, [ebp - 0x7c]
push eax
mov ecx, 0x59c3c0
mov edx, 0x59c390
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x7c]
lea eax, [ebx + 0x41]
call fcn.00407f10
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 4]
call fcn.00407f58
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00429ba4
lea eax, [ebp - 0x84]
mov ecx, 0x59c3e0
mov edx, dword [ebp - 0x18]
call fcn.00408e20
mov eax, dword [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x59c3f8
mov edx, 0x59c390
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x80]
lea eax, [ebx + 0x5d]
call fcn.00407f10
mov dword [ebx + 0x59], 1
push 0
lea eax, [ebp - 0x88]
push eax
mov ecx, 0x59c418
mov edx, 0x59c434
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x88]
lea eax, [ebx + 0x49]
call fcn.00407f10
push 0x59c248
lea eax, [ebp - 0x8c]
push eax
mov ecx, 0x59c460
mov edx, 0x59c484
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x8c]
lea eax, [ebx + 0x14]
call fcn.00407f10
push 0
lea eax, [ebp - 0x90]
push eax
mov ecx, 0x59c4a4
mov edx, 0x59c484
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x90]
lea eax, [ebx + 0x18]
call fcn.00407f10
push 0x59c248
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x59c4c8
mov edx, 0x59c484
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x94]
lea eax, [ebx + 0x1c]
call fcn.00407f10
push 0
lea eax, [ebp - 0x98]
push eax
mov ecx, 0x59c4ec
mov edx, 0x59c50c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0x98]
lea eax, [ebx + 0x61]
call fcn.00407f10
cmp dword [ebx + 0x61], 0
jne 0x59bc07
lea edx, [ebp - 0x9c]
mov eax, 0x59c530
call fcn.0059b744
mov edx, dword [ebp - 0x9c]
lea eax, [ebx + 0x61]
call fcn.00407f10
mov eax, dword [0x669f08]
cmp dword [eax], 6
jge 0x59bbea
lea eax, [ebx + 0x61]
mov edx, 0x59c554
call fcn.00408dc8
jmp 0x59bbf7
lea eax, [ebx + 0x61]
mov edx, 0x59c57c
call fcn.00408dc8
lea eax, [ebx + 0x6d]
mov ecx, 0x59c5a0
mov edx, dword [ebx + 0x61]
call fcn.00408e20
lea eax, [ebx + 0x61]
mov edx, 0x59c300
call fcn.00408dc8
push 0
lea eax, [ebp - 0xa0]
push eax
mov ecx, 0x59c5cc
mov edx, 0x59c50c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0xa0]
lea eax, [ebx + 0x65]
call fcn.00407f10
push 0
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x59c5f8
mov edx, 0x59c50c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0xa4]
lea eax, [ebx + 0x69]
call fcn.00407f10
push 0x59c21c
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x59c624
mov edx, 0x59c650
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 0x10]
call fcn.00420d10
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 0x10]
call fcn.00407f58
mov eax, dword [ebp - 0x10]
mov edx, 0x59c684
call fcn.00408fb8
je 0x59bcd6
mov eax, dword [ebp - 0x10]
mov edx, 0x59c694
call fcn.00408fb8
je 0x59bcd6
mov eax, dword [ebp - 0x10]
mov edx, 0x59c6a4
call fcn.00408fb8
je 0x59bcd6
mov eax, dword [ebp - 0x10]
mov edx, 0x59c6b8
call fcn.00408fb8
jne 0x59bcdc
mov byte [ebx + 0x24], 1
jmp 0x59bce0
mov byte [ebx + 0x24], 0
push 0x59c6d0
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x59c6f0
mov edx, 0x59c650
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 4]
call fcn.00421218
push 0xd3
mov ecx, 0x59c718
mov edx, 0x59c650
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebx + 0x45]
mov edx, 0x59c73c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x54]
push 0x59c760
lea eax, [ebp - 0xb0]
push eax
mov ecx, 0x59c780
mov edx, 0x59c390
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0xb0]
lea eax, [ebx + 0x51]
call fcn.00407f10
push 0
lea eax, [ebp - 0xb4]
push eax
mov ecx, 0x59c7a4
mov edx, 0x59c390
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0xb4]
lea eax, [ebx + 0x4d]
call fcn.00407f10
push 0
lea eax, [ebp - 0xb8]
push eax
mov ecx, 0x59c7d0
mov edx, 0x59c390
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebp - 0xb8]
lea eax, [ebx + 0x55]
call fcn.00407f10
cmp dword [ebx + 0x4d], 0
jne 0x59bf02
lea edx, [ebp - 0xbc]
mov eax, dword [ebx + 0x51]
call fcn.00420d10
mov eax, dword [ebp - 0xbc]
mov edx, 0x59c7f4
call fcn.00408fb8
jne 0x59be69
mov dl, 1
mov eax, dword [0x471f14]
call fcn.00473060
mov edi, eax
mov edx, 0x80000002
mov eax, edi
call fcn.00473148
mov edx, 0x59c814
mov eax, edi
call fcn.004733d4
test al, al
jne 0x59be10
lea eax, [ebx + 0x4d]
call fcn.00407b30
jmp 0x59be56
lea ecx, [ebp - 0xc0]
mov edx, 0x59c848
mov eax, edi
call fcn.00473c5c
mov edx, dword [ebp - 0xc0]
lea eax, [ebx + 0x4d]
call fcn.00407f10
cmp dword [ebx + 0x55], 0
jne 0x59be56
lea ecx, [ebp - 0xc4]
mov edx, 0x59c85c
mov eax, edi
call fcn.00473c5c
mov edx, dword [ebp - 0xc4]
lea eax, [ebx + 0x55]
call fcn.00407f10
mov eax, edi
call fcn.00473118
mov eax, edi
call fcn.00405de4
jmp 0x59bf02
mov dl, 1
mov eax, dword [0x471f14]
call fcn.00473060
mov edi, eax
mov edx, 0x80000002
mov eax, edi
call fcn.00473148
mov edx, 0x59c884
mov eax, edi
call fcn.004733d4
test al, al
jne 0x59becc
mov edx, 0x59c8c4
mov eax, edi
call fcn.004733d4
test al, al
jne 0x59bead
lea eax, [ebx + 0x4d]
call fcn.00407b30
jmp 0x59bee9
lea ecx, [ebp - 0xc8]
xor edx, edx
mov eax, edi
call fcn.00473c5c
mov edx, dword [ebp - 0xc8]
lea eax, [ebx + 0x4d]
call fcn.00407f10
jmp 0x59bee9
lea ecx, [ebp - 0xcc]
xor edx, edx
mov eax, edi
call fcn.00473c5c
mov edx, dword [ebp - 0xcc]
lea eax, [ebx + 0x4d]
call fcn.00407f10
lea eax, [ebx + 0x55]
mov edx, dword [ebx + 0x4d]
call fcn.00407f10
mov eax, edi
call fcn.00473118
mov eax, edi
call fcn.00405de4
mov eax, esi
call fcn.00405de4
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x59bf17
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x59bf4a
mov eax, edx
test eax, eax
je 0x59bf26
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
cmp word [ecx + eax*2 - 2], 0x3b
jne 0x59bf4a
mov eax, edx
test eax, eax
je 0x59bf3c
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 4]
mov ecx, 1
xchg edx, eax
call fcn.00409038
xor esi, esi
cmp dword [ebp - 4], 0
je 0x59bfa2
lea eax, [ebp - 0xdc]
push eax
xor eax, eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], 1
xor eax, eax
mov dword [ebp - 0xe4], eax
xor eax, eax
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xec]
mov cx, 0xc
mov edx, 3
call fcn.00439e0c
lea edx, [ebp - 0xdc]
lea eax, [ebx + 0x29]
call fcn.0043237c
jmp 0x59c0a1
lea eax, [ebx + 0x39]
mov edx, 0x59c92c
call fcn.00407f10
jmp 0x59c18a
mov edx, dword [ebp - 4]
mov eax, 0x59c94c
call fcn.00429c44
mov edi, eax
mov edx, esi
lea eax, [ebx + 0x29]
call fcn.00439f10
test edi, edi
jle 0x59c04a
push esi
push 0
push 2
lea eax, [ebp - 0x100]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408ff0
mov edx, dword [ebp - 0x100]
lea eax, [ebp - 0xfc]
call fcn.004377a8
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebx + 0x29]
push eax
call fcn.0043a1b0
add esp, 0x14
push esi
push 1
push 2
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0x20]
mov cl, 0xfc
call fcn.004374a0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebx + 0x29]
push eax
call fcn.0043a1b0
add esp, 0x14
lea eax, [ebp - 4]
mov ecx, edi
mov edx, 1
call fcn.00409038
jmp 0x59c0a0
push esi
push 0
push 2
lea eax, [ebp - 0x120]
mov edx, dword [ebp - 4]
call fcn.004377a8
lea eax, [ebp - 0x120]
push eax
lea eax, [ebx + 0x29]
push eax
call fcn.0043a1b0
add esp, 0x14
push esi
push 1
push 2
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 0x20]
mov cl, 0xfc
call fcn.004374a0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebx + 0x29]
push eax
call fcn.0043a1b0
add esp, 0x14
lea eax, [ebp - 4]
call fcn.00407b30
inc esi
cmp dword [ebp - 4], 0
jne 0x59bfb4
mov eax, dword [ebx + 0x45]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x59c0dd
lea eax, [ebp - 0x134]
mov ecx, 0x59c95c
mov edx, dword [ebx + 4]
call fcn.00408e20
mov edx, dword [ebp - 0x134]
mov eax, dword [ebx + 0x45]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x59c186
mov eax, dword [ebx + 0x45]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x59c186
inc eax
mov dword [ebp - 0x28], eax
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebx + 0x45]
call fcn.004509cc
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x45]
call fcn.00450bc8
mov edi, dword [ebp - 8]
test edi, edi
je 0x59c11b
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x138]
push eax
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00408ff0
mov eax, dword [ebp - 0x138]
mov edx, 0x59c300
call fcn.00408fb8
je 0x59c150
lea eax, [ebp - 8]
mov edx, 0x59c300
call fcn.00408dc8
lea ecx, [ebp - 0x13c]
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 8]
call fcn.0059b658
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 8]
call fcn.00407f58
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebx + 0x45]
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec dword [ebp - 0x28]
jne 0x59c0f4
mov byte [ebp - 0x19], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c203
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.00407b90
lea eax, [ebp - 0x130]
mov edx, dword [0x4012c0]
mov ecx, 3
call fcn.004094fc
lea eax, [ebp - 0x100]
call fcn.00407b30
lea eax, [ebp - 0xfc]
call fcn.00431a98
lea eax, [ebp - 0xdc]
call fcn.00431a98
lea eax, [ebp - 0xcc]
mov edx, 0x19
call fcn.00407b90
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00407b90
ret