Function at 0x443455
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477e60
mov eax, dword fs:[0]
push eax
mov eax, 0x12a4
call fcn.0045f950
mov eax, dword [0x4bfd60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12ac], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x12b0], eax
mov dword [ebp - 0x1298], ebx
call fcn.0044825c
push eax
lea ecx, [ebp - 0x12a4]
call fcn.0041872d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
mov edi, 0x104
lea ecx, [ebp - 0x12a4]
cmp dword [eax], ebx
je 0x4434d2
push str.SYSTEM
call fcn.0040211a
jmp 0x4434f9
lea eax, [ebp - 0x12a0]
push eax
push edi
mov dword [ebp - 0x12a0], edi
call fcn.0040241d
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x12a4]
call fcn.0040b00b
push dword [ebp - 0x12ac]
lea ecx, [ebp - 0x12a8]
call fcn.004020ea
lea eax, [ebp - 0x12a4]
push eax
lea eax, [ebp - 0x12a8]
push eax
mov byte [ebp - 4], 1
call fcn.00443954
pop ecx
pop ecx
cmp eax, ebx
je 0x44355e
mov ecx, dword [ebp - 0x12a8]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x12a4]
add ecx, 0xfffffff0
call fcn.004025d2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00458e0e
leave
ret
mov eax, dword [ebp - 0x12a8]
cmp dword [eax - 0xc], ebx
je 0x443915
mov eax, dword [ebp - 0x12a4]
cmp dword [eax - 0xc], ebx
je 0x443915
call fcn.00441d74
mov dword [ebp - 0x1298], eax
cmp eax, ebx
je 0x4438f5
xor eax, eax
push 0x206
mov word [ebp - 0x1294], ax
lea eax, [ebp - 0x1292]
push ebx
push eax
call fcn.00459cf0
add esp, 0xc
push 0xc34
lea eax, [ebp - 0x108c]
push ebx
push eax
call fcn.00459cf0
add esp, 0xc
push dword [ebp - 0x12a8]
mov eax, edi
lea edx, [ebp - 0x1294]
call fcn.00416a65
cmp eax, ebx
mov dword [ebp - 0x12a0], eax
jge 0x443642
push str.failed_to_copy_command_line_into_SM:
lea ecx, [ebp - 0x1298]
call fcn.004020a6
mov byte [ebp - 4], 2
push dword [ebp - 0x12a0]
lea eax, [ebp - 0x12a8]
push eax
lea eax, [ebp - 0x1298]
push eax
push 2
call fcn.00414e01
mov ecx, dword [ebp - 0x1298]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x12a8]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x12a4]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, ebx
jmp 0x443545
lea eax, [ebp - 0x1294]
push eax
lea ecx, [ebp - 0x129c]
call fcn.004020a6
push str.SM_command_line:
lea ecx, [ebp - 0x1298]
mov byte [ebp - 4], 3
call fcn.004020a6
push ebx
lea eax, [ebp - 0x129c]
push eax
lea eax, [ebp - 0x1298]
push eax
push 2
mov byte [ebp - 4], 4
call fcn.00414e01
mov ecx, dword [ebp - 0x1298]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x129c]
add ecx, 0xfffffff0
call fcn.004025d2
push dword [esi]
mov eax, edi
lea edx, [ebp - 0x108c]
call fcn.00416a65
lea eax, [ebp - 0x108c]
push eax
lea ecx, [ebp - 0x1298]
call fcn.004020a6
push str.SM_ARM_update_folder:
lea ecx, [ebp - 0x129c]
mov byte [ebp - 4], 5
call fcn.004020a6
push ebx
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x129c]
push eax
push 2
mov byte [ebp - 4], 6
call fcn.00414e01
mov ecx, dword [ebp - 0x129c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1298]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, dword [ebp - 0x12b0]
push dword [eax]
mov eax, edi
lea edx, [ebp - 0xc78]
call fcn.00416a65
lea eax, [ebp - 0xc78]
push eax
lea ecx, [ebp - 0x1298]
call fcn.004020a6
push str.SM_manifest_path:
lea ecx, [ebp - 0x129c]
mov byte [ebp - 4], 7
call fcn.004020a6
push ebx
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x129c]
push eax
push 2
mov byte [ebp - 4], 8
call fcn.00414e01
mov ecx, dword [ebp - 0x129c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1298]
add ecx, 0xfffffff0
call fcn.004025d2
push dword [ebp - 0x12a4]
mov eax, edi
lea edx, [ebp - 0xe80]
call fcn.00416a65
lea eax, [ebp - 0x12ac]
push eax
mov dword [ebp - 0x12ac], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp eax, ebx
je 0x443849
mov edx, dword [ebp - 0x12ac]
push 9
xor eax, eax
pop ecx
mov word [ebp - 0x3c], ax
lea edi, [ebp - 0x3a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa
lea eax, [ebp - 0x3c]
push eax
push edx
mov dword [ebp - 0xe84], edx
call fcn.00459c97
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x1298]
call fcn.004020a6
push str.SM_session_id:
lea ecx, [ebp - 0x129c]
mov byte [ebp - 4], 9
call fcn.004020a6
push ebx
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x129c]
push eax
push 2
mov byte [ebp - 4], 0xa
call fcn.00414e01
mov ecx, dword [ebp - 0x129c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1298]
jmp 0x44387f
push str.SM_failed_to_get_session_id:
lea ecx, [ebp - 0x129c]
call fcn.004020a6
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x129c]
push eax
push 1
call fcn.004152d1
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x129c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
lea ecx, [ebp - 0x454]
lea ebx, [ebp - 0x1294]
call fcn.004383b3
mov dword [ebp - 0x1298], eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x12a0]
call fcn.004020a6
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x129c]
mov byte [ebp - 4], 0xc
call fcn.004020a6
mov byte [ebp - 4], 0xd
push dword [ebp - 0x44]
lea eax, [ebp - 0x12a0]
push eax
lea eax, [ebp - 0x129c]
push eax
push 1
call fcn.00414e01
mov ecx, dword [ebp - 0x129c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
jmp 0x44393b
push str.Unable_to_create_SM
lea ecx, [ebp - 0x12a0]
call fcn.004020a6
push ebx
lea eax, [ebp - 0x12a0]
push eax
mov byte [ebp - 4], 0xe
push 2
jmp 0x443933
push str.Empty_Command_Line_or_User_Name
lea ecx, [ebp - 0x12a0]
call fcn.004020a6
push ebx
lea eax, [ebp - 0x12a0]
push eax
mov byte [ebp - 4], 0xf
push 1
call fcn.004152d1
add esp, 0xc
mov ecx, dword [ebp - 0x12a0]
add ecx, 0xfffffff0
call fcn.004025d2
mov ebx, dword [ebp - 0x1298]
jmp 0x44361f