Function at 0x408170
Capabilities:
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4824e6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x190
mov eax, dword [0x56100c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x19c], esi
mov dword [ebp - 0x1a0], esi
mov dword [esi + 8], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xd50], 0
mov dword [esi + 0xd54], 0
mov dword [esi + 0x3618], 0
mov dword [esi + 0x361c], 0
mov dword [esi + 0x3620], 0
mov dword [esi + 0x3624], 0
mov dword [esi + 0x3628], 0
mov dword [esi + 0x362c], 0
mov dword [esi + 0x3630], 0
mov dword [esi + 0x3634], 0
mov dword [esi + 0x3638], 0
mov dword [esi + 0x363c], 0
mov dword [esi + 0x3640], 0
mov dword [esi + 0x3644], 0
mov dword [esi + 0x36c8], 0
mov dword [esi + 0x36cc], 0
mov dword [esi + 0x36d0], 0
mov dword [esi + 0x36d4], 0
mov dword [esi + 0x36d8], 0
mov dword [esi + 0x36dc], 0
mov dword [esi + 0x36e0], 0
mov dword [esi + 0x36e4], 0
mov dword [esi + 0x36e8], 0
mov dword [esi + 0x36ec], 0
mov dword [esi + 0x37b4], 0
mov dword [esi + 0x37b0], 0
mov dword [esi + 0x37b8], 0
push 0x37c0
push 0
push esi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
mov eax, dword fs:[0x2c]
add esp, 0xc
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0xbf800000
mov edi, dword [eax]
mov dword [esi + 0xc], 0xbf800000
mov dword [esi + 0x10], 0x3c888889
mov dword [esi + 0x14], 0x40a00000
mov eax, dword [0x563a38]
cmp eax, dword [edi + 4]
jle 0x4083af
push 0x563a38
call fcn.00480e7c
add esp, 4
cmp dword [0x563a38], 0xffffffff
jne 0x4083af
mov byte [ebp - 4], 1
mov ecx, 0x563a08
push 0
push 0x487dd4
mov dword [0x563a08], 0
mov dword [0x563a18], 0
mov dword [0x563a1c], 0xf
call fcn.00428d30
push 0x486350
call fcn.004812ea
push 0x563a38
mov byte [ebp - 4], 0
call fcn.00480e32
add esp, 8
mov eax, dword [0x563a04]
cmp eax, dword [edi + 4]
jle 0x408420
push 0x563a04
call fcn.00480e7c
add esp, 4
cmp dword [0x563a04], 0xffffffff
jne 0x408420
mov byte [ebp - 4], 2
mov ecx, 0x563a20
push 0
push 0x487dd4
mov dword [0x563a20], 0
mov dword [0x563a30], 0
mov dword [0x563a34], 0xf
call fcn.00428d30
push 0x4862f0
call fcn.004812ea
push 0x563a04
mov byte [ebp - 4], 0
call fcn.00480e32
add esp, 8
mov eax, dword [0x563a00]
cmp eax, dword [edi + 4]
jle 0x408491
push 0x563a00
call fcn.00480e7c
add esp, 4
cmp dword [0x563a00], 0xffffffff
jne 0x408491
mov byte [ebp - 4], 3
mov ecx, 0x5639e8
push 0
push 0x487dd4
mov dword [0x5639e8], 0
mov dword [0x5639f8], 0
mov dword [0x5639fc], 0xf
call fcn.00428d30
push 0x486290
call fcn.004812ea
push 0x563a00
mov byte [ebp - 4], 0
call fcn.00480e32
add esp, 8
cmp dword [0x563a1c], 0x10
mov ecx, 0x563a08
mov edx, dword [0x563a18]
cmovae ecx, dword [0x563a08]
push 0
push 0x487dd4
call fcn.004299b0
add esp, 8
test al, al
je 0x40886b
push 9
mov dword [ebp - 0x150], 0
lea ecx, [ebp - 0x150]
push str.C:Users_
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
call fcn.00428d30
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x168]
push 0x10
mov dword [ebp - 0x168], 0
push str.AppDataRoaming
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
call fcn.00428d30
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x19c], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408560
mov edi, 0x7fffffff
sub ecx, edx
mov edx, dword [ebp - 0x140]
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x408a66
cmp dword [ebp - 0x13c], 0x10
lea eax, [ebp - 0x150]
push ecx
cmovae eax, dword [ebp - 0x150]
lea ecx, [ebp - 0x120]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x138]
call fcn.004298c0
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x180]
call fcn.00429140
add esp, 4
push str.SharpMacro_
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00429850
mov ecx, 0x563a08
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x198], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x198]
push eax
movq qword [ebp - 0x188], xmm0
call fcn.00428390
mov ecx, dword [ebp - 0x184]
cmp ecx, 0x10
jb 0x408652
mov edx, dword [ebp - 0x198]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x408648
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086d7
push ecx
push edx
call fcn.00480f52
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x16c]
cmp ecx, 0x10
jb 0x40868c
mov edx, dword [ebp - 0x180]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x408682
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086d7
push ecx
push edx
call fcn.00480f52
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
cmp ecx, 0x10
jb 0x4086e7
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4086dd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4086dd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00480f52
add esp, 8
mov edx, dword [0x563a18]
mov eax, edi
sub eax, edx
cmp eax, 0xa
jb 0x408a66
cmp dword [0x563a1c], 0x10
mov eax, 0x563a08
push 0xa
cmovae eax, dword [0x563a08]
push str.layout.ini
push edx
push eax
push ecx
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x138]
call fcn.004298c0
lea eax, [ebp - 0x138]
mov ecx, 0x563a20
push eax
call fcn.00428390
mov ecx, dword [ebp - 0x124]
cmp ecx, 0x10
jb 0x408773
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x408769
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40885b
push ecx
push edx
call fcn.00480f52
add esp, 8
mov edx, dword [0x563a18]
sub edi, edx
cmp edi, 0xe
jb 0x408a66
cmp dword [0x563a1c], 0x10
mov eax, 0x563a08
push 0xe
cmovae eax, dword [0x563a08]
push str.layout_log.txt
push edx
push eax
push ecx
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x138]
call fcn.004298c0
lea eax, [ebp - 0x138]
mov ecx, 0x5639e8
push eax
call fcn.00428390
mov ecx, dword [ebp - 0x124]
cmp ecx, 0x10
jb 0x4087f9
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4087ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40885b
push ecx
push edx
call fcn.00480f52
add esp, 8
mov ecx, dword [ebp - 0x154]
cmp ecx, 0x10
jb 0x40882f
mov edx, dword [ebp - 0x168]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x408825
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40885b
push ecx
push edx
call fcn.00480f52
add esp, 8
mov ecx, dword [ebp - 0x13c]
cmp ecx, 0x10
jb 0x40886b
mov edx, dword [ebp - 0x150]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x408861
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x408861
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00480f52
add esp, 8
cmp dword [0x563a34], 0x10
lea edi, [esi + 0xb4]
mov eax, 0x563a20
mov ecx, 0x285
cmovae eax, dword [0x563a20]
mov dword [esi + 0x18], eax
mov eax, 0x5639e8
cmp dword [0x5639fc], 0x10
cmovae eax, dword [0x5639e8]
mov dword [esi + 0x1c], eax
or eax, 0xffffffff
mov dword [esi + 0x20], 0x3e99999a
mov dword [esi + 0x24], 0x40c00000
rep stosd dword es:[edi], eax
mov dword [esi + 0x2c], 0x3e8ccccd
lea eax, [esi + 0xdc8]
mov dword [esi + 0x30], 0x3d4ccccd
mov ecx, 0x285
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0x3f800000
mov dword [esi + 0x44], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x48], 0x3f800000
mov dword [esi + 0x4c], 0x3f800000
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0x10000
mov dword [esi + 0x58], 0x1010000
mov word [esi + 0x5d], 1
mov dword [esi + 0x60], 0x42700000
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x78], 0x427e00
mov dword [esi + 0x7c], 0x427f00
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x427f90
mov dword [esi + 0xd50], 0xff7fffff
mov dword [esi + 0xd54], 0xff7fffff
mov dword [esi + 0x3618], 0xff7fffff
mov dword [esi + 0x361c], 0xff7fffff
mov dword [esi + 0x28], 0x40c00000
mov dword [esi + 0x36b4], 0xbf800000
mov dword [esi + 0x36a0], 0xbf800000
mov dword [esi + 0x36b8], 0xbf800000
mov dword [esi + 0x36a4], 0xbf800000
mov dword [esi + 0x36bc], 0xbf800000
mov dword [esi + 0x36a8], 0xbf800000
mov dword [esi + 0x36c0], 0xbf800000
mov dword [esi + 0x36ac], 0xbf800000
mov dword [esi + 0x36c4], 0xbf800000
mov dword [esi + 0x36b0], 0xbf800000
mov dword [eax + 4], 0xbf800000
lea eax, [eax + 0x10]
mov dword [eax - 0x10], 0xbf800000
sub ecx, 1
jne 0x4089f6
movaps xmm0, xmmword [0x558030]
mov eax, esi
movups xmmword [esi + 0x3704], xmm0
movups xmmword [esi + 0x3714], xmm0
movups xmmword [esi + 0x3724], xmm0
movups xmmword [esi + 0x3734], xmm0
movups xmmword [esi + 0x3744], xmm0
mov word [esi + 0x37a9], 0xff01
mov byte [esi + 0x37ab], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00480d36
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00407f80
int3