Function at 0x4b80f0
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x5f058b
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x6656b0]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
push ebp
push esi
mov eax, dword [0x6656b0]
xor eax, esp
push eax
lea eax, [esp + 0x838]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
mov dword [esp + 0x840], ebx
lea ebp, [ebx + 8]
cmp dword [edi + 0x2d0], ebx
je 0x4b822b
push ebx
mov eax, 0x622024
lea esi, [esp + 0x1c]
call fcn.0040f730
mov ecx, dword [esp + 0x14]
lea edx, [ecx + ecx]
push edx
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.005bfee0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, 1
jne 0x4b81bd
lea eax, [esp + 0x34]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b81a0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x38]
lea esi, [esp + 0x1c]
call fcn.0040f730
cmp dword [edi + 0x2d4], ebp
jb 0x4b81cd
mov ecx, dword [edi + 0x2c0]
jmp 0x4b81d3
lea ecx, [edi + 0x2c0]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4b81e1
lea eax, [esp + 0x1c]
push eax
call fcn.004bc6f0
add esp, 4
test eax, eax
je 0x4b8559
cmp dword [edi + 0x2d4], ebp
jb 0x4b8202
mov eax, dword [edi + 0x2c0]
jmp 0x4b8208
lea eax, [edi + 0x2c0]
mov ecx, eax
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x4b8210
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x1c]
call fcn.0040f730
jmp 0x4b8267
mov eax, dword [edi + 0x240]
cmp eax, 0x2100
jb 0x4b824a
push 7
mov eax, str.Default
lea esi, [esp + 0x1c]
call fcn.0040f730
jmp 0x4b8267
cmp eax, 0x1008
jb 0x4b8267
cmp eax, 0x2100
jae 0x4b8267
lea edx, [esp + 0x18]
push edx
mov eax, str.LocalService
call fcn.0040f7e0
mov eax, dword [edi + 0x240]
cmp eax, 0x2100
jb 0x4b839a
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4b8286
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8296
mov eax, dword [edi + 0x2f8]
jmp 0x4b829c
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sUsers_s
lea ecx, [edi + 0x364]
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b82bf
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b82cf
mov eax, dword [edi + 0x2f8]
jmp 0x4b82d5
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sUsers_sDesktop
lea ecx, [edi + 0x380]
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b82f8
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8308
mov eax, dword [edi + 0x2f8]
jmp 0x4b830e
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sUsers_sAppDataRoamingMicrosoftWindowsStart_MenuPrograms
lea ecx, [edi + 0x39c]
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b8331
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8341
mov eax, dword [edi + 0x2f8]
jmp 0x4b8347
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sUsers_sAppDataLocalTemp
lea ecx, [edi + 0x3b8]
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b836a
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b837a
mov eax, dword [edi + 0x2f8]
jmp 0x4b8380
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sUsers_sAppDataLocalMicrosoftWindowsTemporary_Internet_Files
lea ecx, [edi + 0x3d4]
call fcn.004bc870
add esp, 0xc
jmp 0x4b8559
cmp eax, 0x1008
jb 0x4b8559
cmp eax, 0x2100
jae 0x4b8559
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4b83be
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b83ce
mov eax, dword [edi + 0x2f8]
jmp 0x4b83d4
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sDocuments_and_Settings_s
lea ecx, [edi + 0x364]
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b83f7
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8407
mov eax, dword [edi + 0x2f8]
jmp 0x4b840d
lea eax, [edi + 0x2f8]
push ecx
push eax
lea esi, [edi + 0x380]
push 0x635230
mov ecx, esi
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b8432
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8442
mov eax, dword [edi + 0x2f8]
jmp 0x4b8448
lea eax, [edi + 0x2f8]
push ecx
push eax
lea ebx, [edi + 0x39c]
push str._sDocuments_and_Settings_s_
mov ecx, ebx
call fcn.004bc870
add esp, 0xc
cmp dword [esi + 0x18], ebp
jb 0x4b8469
mov eax, dword [esi + 4]
jmp 0x4b846c
lea eax, [esi + 4]
push 0
push eax
call fcn.005b9cfa
add esp, 8
test eax, eax
je 0x4b84e5
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4b8489
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8499
mov eax, dword [edi + 0x2f8]
jmp 0x4b849f
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sDocuments_and_Settings_sDesktop
mov ecx, esi
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b84be
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b84ce
mov eax, dword [edi + 0x2f8]
jmp 0x4b84d4
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sDocuments_and_Settings_sStart_MenuPrograms
mov ecx, ebx
call fcn.004bc870
add esp, 0xc
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4b84f3
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b8503
mov eax, dword [edi + 0x2f8]
jmp 0x4b8509
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sDocuments_and_Settings_sLocal_SettingsTemp
lea ecx, [edi + 0x3b8]
call fcn.004bc870
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], ebp
jae 0x4b852c
lea ecx, [esp + 0x1c]
cmp dword [edi + 0x30c], ebp
jb 0x4b853c
mov eax, dword [edi + 0x2f8]
jmp 0x4b8542
lea eax, [edi + 0x2f8]
push ecx
push eax
push str._sDocuments_and_Settings_sLocal_SettingsTemporary_Internet_Files
lea ecx, [edi + 0x3d4]
call fcn.004bc870
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0x840], 0xffffffff
cmp dword [esp + 0x30], ebp
jb 0x4b8577
mov eax, dword [esp + 0x1c]
push eax
call fcn.004c4802
add esp, 4
xor ecx, ecx
mov word [esp + 0x1c], cx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 7
mov ecx, dword [esp + 0x838]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.005b7e8e
add esp, 0x834
ret