Function at 0x42df18
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push esi
xor esi, esi
push 0x488b98
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
call fcn.004013c8
mov eax, dword [0x4930b4]
cmp eax, esi
je 0x42df57
cmp dword [0x48f640], esi
je 0x42df57
push eax
lea eax, [ebp - 0x18]
push 0x481bcc
push eax
call fcn.004017cc
add esp, 0xc
mov eax, dword [0x48f234]
cmp dword [eax - 8], esi
jne 0x42dfbe
mov eax, dword [0x488b6c]
push edi
mov dword [ebp - 0x824], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x820]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x824]
pop edi
test eax, eax
je 0x42dfac
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x824]
push ecx
push eax
mov ecx, 0x48f234
call fcn.0040148d
cmp dword [0x491c20], esi
push ebx
je 0x42dfd9
push 1
lea eax, [ebp - 0x14]
pop ebx
push 0x27
push eax
call fcn.0044bfce
pop ecx
pop ecx
jmp 0x42dfe9
push 2
lea ecx, [ebp - 8]
pop ebx
push 0x488b68
call fcn.0040811c
mov ecx, dword [eax]
cmp dword [ecx - 0xc], esi
jl 0x42dfff
mov dword [ebp - 0xc], ecx
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42e012
mov ecx, dword [0x47e520]
mov dword [ebp - 0xc], ecx
push dword [eax]
lea ecx, [ebp - 0xc]
call fcn.0040833f
test bl, 2
je 0x42e022
lea ecx, [ebp - 8]
and ebx, 0xfffffffd
call fcn.0040139c
test bl, 1
pop ebx
je 0x42e030
lea ecx, [ebp - 0x14]
call fcn.0040139c
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], 3
jle 0x42e055
mov esi, 0x481bc8
mov eax, esi
test eax, eax
je 0x42e04b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.00401658
mov esi, str.Unicode
mov eax, esi
test eax, eax
je 0x42e067
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.00401658
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], 2
jle 0x42e0e6
push 0x47fafc
lea ecx, [ebp - 8]
call fcn.004013c8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x491c08
lea eax, [ebp - 0x10]
push 0x481bb0
push eax
call fcn.004085b5
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004015b6
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004015b6
mov eax, dword [eax]
mov ecx, 0x48f234
push eax
push dword [eax - 8]
call fcn.00401658
lea ecx, [ebp - 0x14]
call fcn.0040139c
lea ecx, [ebp - 0x20]
call fcn.0040139c
lea ecx, [ebp - 0x10]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
push 0x47eb68
lea ecx, [ebp - 8]
call fcn.004013c8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push 0x491d50
push eax
lea eax, [ebp - 0x14]
push 0x491d58
push eax
call fcn.004015b6
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004015b6
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004015b6
mov esi, 0x48f290
push eax
mov ecx, esi
call fcn.00401522
lea ecx, [ebp - 0x10]
call fcn.0040139c
lea ecx, [ebp - 0x20]
call fcn.0040139c
lea ecx, [ebp - 0x14]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
push esi
lea ecx, [ebp - 0x24]
call fcn.00401356
push 0x488b98
lea ecx, [ebp - 0x1c]
call fcn.004013c8
call fcn.00405d9b
test eax, eax
pop esi
je 0x42e190
push str.___Admin
lea ecx, [ebp - 8]
call fcn.004013c8
lea eax, [ebp - 8]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040865b
lea ecx, [ebp - 8]
call fcn.0040139c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004015b6
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x10]
call fcn.0040139c
lea ecx, [ebp - 0x1c]
call fcn.0040139c
lea ecx, [ebp - 0x24]
call fcn.0040139c
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 0x18]
call fcn.0040139c
leave
ret