Function at 0x4c4f70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de393
mov eax, dword fs:[0]
push eax
mov eax, 0x1410
call fcn.005b5ef0
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13d4], ecx
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.005b4520
add esp, 0xc
mov byte [ebp - 0x514], 0
push 0xff
push 0
lea ecx, [ebp - 0x513]
push ecx
call fcn.005b4520
add esp, 0xc
mov dword [ebp - 0x518], 0x400
mov dword [ebp - 0x51c], 0x100
call fcn.004fe4c0
test eax, eax
je 0x4c5480
call fcn.0041a460
mov edx, dword [eax + 0x178]
mov dword [ebp - 0x52c], edx
call fcn.0041a460
mov eax, dword [eax + 0x17c]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
cmp dword [ebp - 0x52c], 0
je 0x4c50bc
lea ecx, [ebp - 0x524]
push ecx
lea edx, [ebp - 0x528]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
push 0
call dword [ebp - 0x52c]
test eax, eax
je 0x4c50bc
cmp dword [ebp - 0x528], 0
je 0x4c5095
mov ecx, dword [ebp - 0x524]
cmp ecx, dword [ebp - 0x518]
jae 0x4c5095
mov edx, dword [ebp - 0x524]
push edx
mov eax, dword [ebp - 0x528]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.005b64d0
add esp, 0xc
jmp 0x4c50a1
mov dl, byte [0x6095e5]
mov byte [ebp - 0x414], dl
cmp dword [ebp - 0x520], 0
je 0x4c50b7
mov eax, dword [ebp - 0x528]
push eax
call dword [ebp - 0x520]
jmp 0x4c547b
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x6a6
jne 0x4c53bd
call fcn.004fe500
test eax, eax
jne 0x4c53bd
push 1
push 2
lea ecx, [ebp - 0x5bc]
call fcn.0040b160
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x530]
push ecx
push 0x60fe78
lea edx, [ebp - 0x5bc]
push edx
call fcn.00409c80
add esp, 8
mov ecx, eax
call fcn.004024e0
lea eax, [ebp - 0x12f0]
push eax
lea ecx, [ebp - 0x5bc]
call fcn.00409610
mov dword [ebp - 0x13d8], eax
mov ecx, dword [ebp - 0x13d8]
mov dword [ebp - 0x13dc], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x13dc]
call fcn.0040bf30
push eax
push 0x60fe94
push 0x4e
push 0x60feb4
push 0x18
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x12f0]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.00409ef0
lea ecx, [ebp - 0x531]
call fcn.0052d5f0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x538]
push edx
push 0x60fec8
lea ecx, [ebp - 0x531]
call fcn.005285e0
movzx eax, al
test eax, eax
je 0x4c5310
lea ecx, [ebp - 0x68c]
call fcn.005173c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x654]
call fcn.00414df0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x654]
push ecx
mov edx, dword [ebp - 0x538]
push edx
lea ecx, [ebp - 0x68c]
call fcn.00519250
lea ecx, [ebp - 0x674]
call fcn.0040c000
mov byte [ebp - 4], 5
push 0
push 0x60fed8
lea ecx, [ebp - 0x63c]
call fcn.00425360
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0xffffffff
je 0x4c52aa
lea ecx, [ebp - 0x63c]
call fcn.004068e0
sub eax, dword [ebp - 0x658]
sub eax, 1
je 0x4c52aa
lea ecx, [ebp - 0x63c]
call fcn.004068e0
sub eax, dword [ebp - 0x658]
sub eax, 1
push eax
mov eax, dword [ebp - 0x658]
add eax, 1
push eax
lea ecx, [ebp - 0x130c]
push ecx
lea ecx, [ebp - 0x63c]
call fcn.004253c0
mov dword [ebp - 0x13e0], eax
mov edx, dword [ebp - 0x13e0]
mov dword [ebp - 0x13e4], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x13e4]
push eax
lea ecx, [ebp - 0x674]
call fcn.0040c030
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x130c]
call fcn.0040c050
jmp 0x4c52bc
lea ecx, [ebp - 0x63c]
push ecx
lea ecx, [ebp - 0x674]
call fcn.0040c030
lea ecx, [ebp - 0x674]
call fcn.0040bf30
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.005b1515
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x674]
call fcn.0040c050
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x654]
call fcn.00414d70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68c]
call fcn.0040f090
jmp 0x4c53a6
push 1
push 2
lea ecx, [ebp - 0x70c]
call fcn.0040b160
mov byte [ebp - 4], 7
push 0x60fedc
lea ecx, [ebp - 0x70c]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x1328]
push edx
lea ecx, [ebp - 0x70c]
call fcn.00409610
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x13e8]
mov dword [ebp - 0x13ec], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x13ec]
call fcn.0040bf30
push eax
push 0x60ff00
push 0x65
push 0x60ff20
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1328]
call fcn.0040c050
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70c]
call fcn.00409ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x531]
call fcn.005284a0
jmp 0x4c547b
push 1
push 2
lea ecx, [ebp - 0x78c]
call fcn.0040b160
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x530]
push ecx
push str.WTSQuerySessionInformation:
lea edx, [ebp - 0x78c]
push edx
call fcn.00409c80
add esp, 8
mov ecx, eax
call fcn.004024e0
lea eax, [ebp - 0x1344]
push eax
lea ecx, [ebp - 0x78c]
call fcn.00409610
mov dword [ebp - 0x13f0], eax
mov ecx, dword [ebp - 0x13f0]
mov dword [ebp - 0x13f4], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x13f4]
call fcn.0040bf30
push eax
push 0x60ff50
push 0x6b
push 0x60ff70
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1344]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78c]
call fcn.00409ef0
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x4c55f7
call fcn.004fe480
test eax, eax
je 0x4c55e3
lea ecx, [ebp - 0x78d]
call fcn.0052d5f0
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x794]
push ecx
push 0x60ff84
lea ecx, [ebp - 0x78d]
call fcn.005285e0
movzx edx, al
test edx, edx
je 0x4c5539
lea ecx, [ebp - 0x844]
call fcn.005173c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x82c]
call fcn.00414df0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x794]
push ecx
lea ecx, [ebp - 0x844]
call fcn.00519250
lea ecx, [ebp - 0x814]
call fcn.0040bf30
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.005b1515
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x82c]
call fcn.00414d70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x844]
call fcn.0040f090
jmp 0x4c55cf
push 1
push 2
lea ecx, [ebp - 0x8c4]
call fcn.0040b160
mov byte [ebp - 4], 0xe
push 0x60ff94
lea ecx, [ebp - 0x8c4]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x1360]
push edx
lea ecx, [ebp - 0x8c4]
call fcn.00409610
mov dword [ebp - 0x13f8], eax
mov eax, dword [ebp - 0x13f8]
mov dword [ebp - 0x13fc], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x13fc]
call fcn.0040bf30
push eax
push 0x60ffb8
push 0x7f
push 0x60ffd8
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1360]
call fcn.0040c050
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x8c4]
call fcn.00409ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78d]
call fcn.005284a0
jmp 0x4c55f7
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040bee0
push 1
push 2
lea ecx, [ebp - 0x944]
call fcn.0040b160
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0x60ffec
lea edx, [ebp - 0x944]
push edx
call fcn.00409c80
add esp, 8
push eax
call fcn.00409360
add esp, 8
lea eax, [ebp - 0x137c]
push eax
lea ecx, [ebp - 0x944]
call fcn.00409610
mov dword [ebp - 0x1400], eax
mov ecx, dword [ebp - 0x1400]
mov dword [ebp - 0x1404], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1404]
call fcn.0040bf30
push eax
push 0x60fffc
push 0x87
push 0x61001c
push 0x18
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x137c]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.00409ef0
mov ecx, dword [ebp + 0xc]
call fcn.0040bf30
push eax
push str.system
call fcn.0046bcf0
add esp, 8
test eax, eax
jne 0x4c56d1
mov ecx, dword [ebp + 0xc]
call fcn.00420b30
call fcn.004fe200
test eax, eax
je 0x4c59f8
mov ecx, dword [ebp + 0xc]
call fcn.0040bfe0
movzx edx, al
test edx, edx
jne 0x4c59f8
mov byte [ebp - 0xd44], 0
push 0x3ff
push 0
lea eax, [ebp - 0xd43]
push eax
call fcn.005b4520
add esp, 0xc
mov dword [ebp - 0xd4c], 0x400
mov dword [ebp - 0xd48], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xd48]
push edx
call fcn.00504e30
add esp, 8
test eax, eax
je 0x4c5836
mov eax, dword [ebp - 0xd48]
push eax
lea ecx, [ebp - 0x1150]
call fcn.00487ae0
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0xd4c]
push ecx
lea edx, [ebp - 0xd44]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x1150]
call fcn.0041b290
push eax
call fcn.004fe820
add esp, 0x14
test eax, eax
jne 0x4c5824
push 1
push 2
lea ecx, [ebp - 0x11d4]
call fcn.0040b160
mov byte [ebp - 4], 0x13
push 0x610038
lea edx, [ebp - 0x11d4]
push edx
call fcn.00409c80
add esp, 8
lea eax, [ebp - 0x1398]
push eax
lea ecx, [ebp - 0x11d4]
call fcn.00409610
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1408]
mov dword [ebp - 0x140c], ecx
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x140c]
call fcn.0040bf30
push eax
push 0x61004c
push 0x9a
push 0x61006c
push 0x18
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1398]
call fcn.0040c050
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x11d4]
call fcn.00409ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1150]
call fcn.004c7720
mov byte [ebp - 0x114c], 0
push 0x3ff
push 0
lea edx, [ebp - 0x114b]
push edx
call fcn.005b4520
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0xd44]
push ecx
push str._s_s
lea edx, [ebp - 0x114c]
push edx
call fcn.004c7750
add esp, 0x10
push 1
push 2
lea ecx, [ebp - 0x1254]
call fcn.0040b160
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x114c]
push eax
push 0x610088
lea ecx, [ebp - 0x1254]
push ecx
call fcn.00409c80
add esp, 8
push eax
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x13b4]
push edx
lea ecx, [ebp - 0x1254]
call fcn.00409610
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp - 0x1410]
mov dword [ebp - 0x1414], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1414]
call fcn.0040bf30
push eax
push 0x610098
push 0xa0
push 0x6100b8
push 0x18
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x13b4]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1254]
call fcn.00409ef0
lea ecx, [ebp - 0x51c]
push ecx
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x114c]
push eax
call fcn.004fea40
add esp, 0xc
test eax, eax
jne 0x4c59e9
push 1
push 2
lea ecx, [ebp - 0x12d4]
call fcn.0040b160
mov dword [ebp - 4], 0x17
push 0x6100cc
lea ecx, [ebp - 0x12d4]
push ecx
call fcn.00409c80
add esp, 8
lea edx, [ebp - 0x13d0]
push edx
lea ecx, [ebp - 0x12d4]
call fcn.00409610
mov dword [ebp - 0x1418], eax
mov eax, dword [ebp - 0x1418]
mov dword [ebp - 0x141c], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x141c]
call fcn.0040bf30
push eax
push str.CSLogonUser::GetLogonUserName
push 0xa4
push 0x610100
push 0x18
call fcn.00409980
mov ecx, eax
call fcn.004fa910
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x13d0]
call fcn.0040c050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12d4]
call fcn.00409ef0
mov eax, 1
jmp 0x4c59fd
lea ecx, [ebp - 0x514]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040bee0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0968
mov esp, ebp
pop ebp
ret 0xc