Function at 0x44cba0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50dc9f
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 2
test edi, edi
jne 0x44cbec
lea eax, [edi + 2]
jmp 0x44cede
call fcn.00449980
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x44cc32
push 0xc
call fcn.00472260
add esp, 4
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x44cc29
push 0x14
push 0
push 0x568771
mov ecx, eax
call fcn.004489d0
jmp 0x44cc2b
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0
lea esi, [ebx + 0x148]
push 0x1d0
push 0
push esi
call fcn.004b8570
mov dword [ebx + 0x10], 1
mov dword [esi], 0
mov dword [ebx + 0x14c], 0xff231ac2
mov dword [ebx + 0x150], 0x60000
push 0
call fcn.004c60d9
mov dword [ebx + 0x1ec], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x164], eax
push dword [edi + 8]
call fcn.0044c3a0
add esp, 0x14
mov dword [ebx + 0x168], eax
mov dword [ebx + 0x1fc], 0
mov dword [ebx + 0x200], 0
mov dword [ebx + 0x224], 2
mov dword [ebp - 0x34], 0
mov ecx, 0x51b980
lea esi, [ebx + 0x16c]
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x44ccc1
mov dword [ebp - 0x34], 0x80
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [edi + 0x14], 0
je 0x44cd0f
lea eax, [ebx + 0x1f8]
push eax
lea eax, [ebx + 0x1f4]
push eax
call fcn.0048bbd0
add esp, 8
push 0x50
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebx + 0x220], eax
test eax, eax
jne 0x44cd4b
jmp 0x44cd41
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 8
push edi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
mov dword [ebx + 0x1f4], eax
push 0xa
push edi
call esi
mov dword [ebx + 0x1f8], eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [ebp - 0x38]
mov dword [ebx + 0x220], 1
mov ecx, dword [edi]
mov eax, ecx
sub eax, 0x70
je 0x44cd73
sub eax, 1
je 0x44cd64
mov dword [ebx + 0x228], ecx
mov edi, dword [ebp - 0x2c]
jmp 0x44cda9
mov dword [ebx + 0x228], 0
mov edi, dword [ebp - 0x2c]
jmp 0x44cda9
push 0
mov edi, dword [ebp - 0x2c]
mov ecx, edi
call fcn.0044c450
test eax, eax
jne 0x44cd9e
mov ecx, edi
call fcn.00411ac0
test eax, eax
je 0x44cd9a
mov ecx, edi
call fcn.00411ac0
cmp byte [eax], 0
je 0x44cd9e
xor eax, eax
jmp 0x44cda3
call fcn.0044adc0
mov dword [ebx + 0x228], eax
push 0
mov ecx, edi
call fcn.0044c450
test eax, eax
jne 0x44cdd7
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.00411ac0
push eax
call fcn.0044ac20
add esp, 8
push 0x14
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.0044e6b0
mov eax, dword [ebx + 0x228]
test eax, eax
jne 0x44cdeb
push edi
mov ecx, ebx
call fcn.0044d2b0
jmp 0x44ce25
mov esi, 9
mov dword [ebp - 0x30], esi
push eax
call fcn.0044ab90
add esp, 4
mov dword [ebx + 0x334], eax
test eax, eax
je 0x44ce40
push 0
mov ecx, edi
call fcn.004189b0
push eax
push 0
mov ecx, edi
call fcn.0044c450
push eax
mov ecx, dword [ebx + 0x334]
call fcn.00483580
push dword [ebx + 0x228]
lea eax, [ebx + 0x204]
push eax
push edi
call fcn.0044ae50
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebx + 0x318], 0
mov dword [ebx + 0x31c], 0
mov dword [ebx + 0x320], 0
mov dword [ebx + 0x328], 0
mov dword [ebx + 0x324], 0
test esi, esi
jne 0x44ce93
mov ecx, ebx
call fcn.00449840
mov ecx, ebx
call fcn.0044eeb0
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffffe
add esi, 2
mov dword [ebp - 0x30], esi
test edi, edi
je 0x44cea8
mov eax, dword [ebp - 0x38]
cmp edi, dword [eax + 4]
je 0x44cea8
push 1
mov ecx, edi
call fcn.00448ec0
mov dword [ebp - 4], 0xffffffff
jmp 0x44ced5
mov ecx, ebx
call fcn.0044e640
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4566
mov esp, ebp
pop ebp
ret 4