Function at 0x4c4e40
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df443
mov eax, dword fs:[0]
push eax
mov eax, 0x1410
call fcn.005b6f10
mov eax, dword [0x65d4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13d4], ecx
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.005b5540
add esp, 0xc
mov byte [ebp - 0x514], 0
push 0xff
push 0
lea ecx, [ebp - 0x513]
push ecx
call fcn.005b5540
add esp, 0xc
mov dword [ebp - 0x518], 0x400
mov dword [ebp - 0x51c], 0x100
call fcn.004ff4e0
test eax, eax
je 0x4c5350
call fcn.0041aef0
mov edx, dword [eax + 0x178]
mov dword [ebp - 0x52c], edx
call fcn.0041aef0
mov eax, dword [eax + 0x17c]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
cmp dword [ebp - 0x52c], 0
je 0x4c4f8c
lea ecx, [ebp - 0x524]
push ecx
lea edx, [ebp - 0x528]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
push 0
call dword [ebp - 0x52c]
test eax, eax
je 0x4c4f8c
cmp dword [ebp - 0x528], 0
je 0x4c4f65
mov ecx, dword [ebp - 0x524]
cmp ecx, dword [ebp - 0x518]
jae 0x4c4f65
mov edx, dword [ebp - 0x524]
push edx
mov eax, dword [ebp - 0x528]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.005b74f0
add esp, 0xc
jmp 0x4c4f71
mov dl, byte [0x60a632]
mov byte [ebp - 0x414], dl
cmp dword [ebp - 0x520], 0
je 0x4c4f87
mov eax, dword [ebp - 0x528]
push eax
call dword [ebp - 0x520]
jmp 0x4c534b
call sub.WS2_32.dll_WSAGetLastError
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0x6a6
jne 0x4c528d
call fcn.004ff520
test eax, eax
jne 0x4c528d
push 1
push 2
lea ecx, [ebp - 0x5bc]
call fcn.0040b040
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x530]
push ecx
push 0x610fd8
lea edx, [ebp - 0x5bc]
push edx
call fcn.00409b60
add esp, 8
mov ecx, eax
call fcn.004024e0
lea eax, [ebp - 0x12f0]
push eax
lea ecx, [ebp - 0x5bc]
call fcn.004094f0
mov dword [ebp - 0x13d8], eax
mov ecx, dword [ebp - 0x13d8]
mov dword [ebp - 0x13dc], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x13dc]
call fcn.0040be10
push eax
push 0x610ff4
push 0x4e
push 0x611014
push 0x18
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x12f0]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.00409dd0
lea ecx, [ebp - 0x531]
call fcn.0052e5c0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x538]
push edx
push 0x611028
lea ecx, [ebp - 0x531]
call fcn.00529570
movzx eax, al
test eax, eax
je 0x4c51e0
lea ecx, [ebp - 0x68c]
call fcn.00518350
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x654]
call fcn.004157b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x654]
push ecx
mov edx, dword [ebp - 0x538]
push edx
lea ecx, [ebp - 0x68c]
call fcn.0051a1e0
lea ecx, [ebp - 0x674]
call fcn.0040bee0
mov byte [ebp - 4], 5
push 0
push 0x611038
lea ecx, [ebp - 0x63c]
call fcn.00425e70
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0xffffffff
je 0x4c517a
lea ecx, [ebp - 0x63c]
call fcn.0041ec70
sub eax, dword [ebp - 0x658]
sub eax, 1
je 0x4c517a
lea ecx, [ebp - 0x63c]
call fcn.0041ec70
sub eax, dword [ebp - 0x658]
sub eax, 1
push eax
mov eax, dword [ebp - 0x658]
add eax, 1
push eax
lea ecx, [ebp - 0x130c]
push ecx
lea ecx, [ebp - 0x63c]
call fcn.00425ed0
mov dword [ebp - 0x13e0], eax
mov edx, dword [ebp - 0x13e0]
mov dword [ebp - 0x13e4], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x13e4]
push eax
lea ecx, [ebp - 0x674]
call fcn.0040bf10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x130c]
call fcn.0040bf30
jmp 0x4c518c
lea ecx, [ebp - 0x63c]
push ecx
lea ecx, [ebp - 0x674]
call fcn.0040bf10
lea ecx, [ebp - 0x674]
call fcn.0040be10
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.005b2535
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x674]
call fcn.0040bf30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x654]
call fcn.00415730
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68c]
call fcn.0040ef60
jmp 0x4c5276
push 1
push 2
lea ecx, [ebp - 0x70c]
call fcn.0040b040
mov byte [ebp - 4], 7
push 0x61103c
lea ecx, [ebp - 0x70c]
push ecx
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x1328]
push edx
lea ecx, [ebp - 0x70c]
call fcn.004094f0
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x13e8]
mov dword [ebp - 0x13ec], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x13ec]
call fcn.0040be10
push eax
push 0x611060
push 0x65
push 0x611080
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1328]
call fcn.0040bf30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70c]
call fcn.00409dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x531]
call fcn.0051d130
jmp 0x4c534b
push 1
push 2
lea ecx, [ebp - 0x78c]
call fcn.0040b040
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x530]
push ecx
push str.WTSQuerySessionInformation:
lea edx, [ebp - 0x78c]
push edx
call fcn.00409b60
add esp, 8
mov ecx, eax
call fcn.004024e0
lea eax, [ebp - 0x1344]
push eax
lea ecx, [ebp - 0x78c]
call fcn.004094f0
mov dword [ebp - 0x13f0], eax
mov ecx, dword [ebp - 0x13f0]
mov dword [ebp - 0x13f4], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x13f4]
call fcn.0040be10
push eax
push 0x6110b0
push 0x6b
push 0x6110d0
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1344]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78c]
call fcn.00409dd0
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x4c54c7
call fcn.004ff4a0
test eax, eax
je 0x4c54b3
lea ecx, [ebp - 0x78d]
call fcn.0052e5c0
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x794]
push ecx
push 0x6110e4
lea ecx, [ebp - 0x78d]
call fcn.00529570
movzx edx, al
test edx, edx
je 0x4c5409
lea ecx, [ebp - 0x844]
call fcn.00518350
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x82c]
call fcn.004157b0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0x794]
push ecx
lea ecx, [ebp - 0x844]
call fcn.0051a1e0
lea ecx, [ebp - 0x814]
call fcn.0040be10
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.005b2535
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x82c]
call fcn.00415730
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x844]
call fcn.0040ef60
jmp 0x4c549f
push 1
push 2
lea ecx, [ebp - 0x8c4]
call fcn.0040b040
mov byte [ebp - 4], 0xe
push 0x6110f4
lea ecx, [ebp - 0x8c4]
push ecx
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x1360]
push edx
lea ecx, [ebp - 0x8c4]
call fcn.004094f0
mov dword [ebp - 0x13f8], eax
mov eax, dword [ebp - 0x13f8]
mov dword [ebp - 0x13fc], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x13fc]
call fcn.0040be10
push eax
push 0x611118
push 0x7f
push 0x611138
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1360]
call fcn.0040bf30
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x8c4]
call fcn.00409dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78d]
call fcn.0051d130
jmp 0x4c54c7
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040bdc0
push 1
push 2
lea ecx, [ebp - 0x944]
call fcn.0040b040
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0x61114c
lea edx, [ebp - 0x944]
push edx
call fcn.00409b60
add esp, 8
push eax
call fcn.00409240
add esp, 8
lea eax, [ebp - 0x137c]
push eax
lea ecx, [ebp - 0x944]
call fcn.004094f0
mov dword [ebp - 0x1400], eax
mov ecx, dword [ebp - 0x1400]
mov dword [ebp - 0x1404], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1404]
call fcn.0040be10
push eax
push 0x61115c
push 0x87
push 0x61117c
push 0x18
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x137c]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.00409dd0
mov ecx, dword [ebp + 0xc]
call fcn.0040be10
push eax
push str.system
call fcn.0046b260
add esp, 8
test eax, eax
jne 0x4c55a1
mov ecx, dword [ebp + 0xc]
call fcn.00421640
call fcn.004ff220
test eax, eax
je 0x4c58c8
mov ecx, dword [ebp + 0xc]
call fcn.0040bec0
movzx edx, al
test edx, edx
jne 0x4c58c8
mov byte [ebp - 0xd44], 0
push 0x3ff
push 0
lea eax, [ebp - 0xd43]
push eax
call fcn.005b5540
add esp, 0xc
mov dword [ebp - 0xd4c], 0x400
mov dword [ebp - 0xd48], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xd48]
push edx
call fcn.00505e50
add esp, 8
test eax, eax
je 0x4c5706
mov eax, dword [ebp - 0xd48]
push eax
lea ecx, [ebp - 0x1150]
call fcn.0041bd90
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0xd4c]
push ecx
lea edx, [ebp - 0xd44]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x1150]
call fcn.0043ead0
push eax
call fcn.004ff840
add esp, 0x14
test eax, eax
jne 0x4c56f4
push 1
push 2
lea ecx, [ebp - 0x11d4]
call fcn.0040b040
mov byte [ebp - 4], 0x13
push 0x611198
lea edx, [ebp - 0x11d4]
push edx
call fcn.00409b60
add esp, 8
lea eax, [ebp - 0x1398]
push eax
lea ecx, [ebp - 0x11d4]
call fcn.004094f0
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1408]
mov dword [ebp - 0x140c], ecx
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x140c]
call fcn.0040be10
push eax
push 0x6111ac
push 0x9a
push 0x6111cc
push 0x18
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1398]
call fcn.0040bf30
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x11d4]
call fcn.00409dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1150]
call fcn.004c75f0
mov byte [ebp - 0x114c], 0
push 0x3ff
push 0
lea edx, [ebp - 0x114b]
push edx
call fcn.005b5540
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0xd44]
push ecx
push str._s_s
lea edx, [ebp - 0x114c]
push edx
call fcn.004c7620
add esp, 0x10
push 1
push 2
lea ecx, [ebp - 0x1254]
call fcn.0040b040
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x114c]
push eax
push 0x6111e8
lea ecx, [ebp - 0x1254]
push ecx
call fcn.00409b60
add esp, 8
push eax
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x13b4]
push edx
lea ecx, [ebp - 0x1254]
call fcn.004094f0
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp - 0x1410]
mov dword [ebp - 0x1414], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1414]
call fcn.0040be10
push eax
push 0x6111f8
push 0xa0
push 0x611218
push 0x18
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x13b4]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1254]
call fcn.00409dd0
lea ecx, [ebp - 0x51c]
push ecx
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x114c]
push eax
call fcn.004ffa60
add esp, 0xc
test eax, eax
jne 0x4c58b9
push 1
push 2
lea ecx, [ebp - 0x12d4]
call fcn.0040b040
mov dword [ebp - 4], 0x17
push 0x61122c
lea ecx, [ebp - 0x12d4]
push ecx
call fcn.00409b60
add esp, 8
lea edx, [ebp - 0x13d0]
push edx
lea ecx, [ebp - 0x12d4]
call fcn.004094f0
mov dword [ebp - 0x1418], eax
mov eax, dword [ebp - 0x1418]
mov dword [ebp - 0x141c], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x141c]
call fcn.0040be10
push eax
push str.CSLogonUser::GetLogonUserName
push 0xa4
push 0x611260
push 0x18
call fcn.00409860
mov ecx, eax
call fcn.004fb930
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x13d0]
call fcn.0040bf30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12d4]
call fcn.00409dd0
mov eax, 1
jmp 0x4c58cd
lea ecx, [ebp - 0x514]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0040bdc0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b1988
mov esp, ebp
pop ebp
ret 0xc