Function at 0x416e2f
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x425124]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0x608], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x61c], eax
mov esi, edx
mov eax, dword [ebp + 0x14]
push edi
mov edi, ecx
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x628], eax
call fcn.0041e67a
test eax, eax
je 0x417093
mov ecx, dword [edi + 8]
call fcn.0041bf7c
test eax, eax
je 0x417093
mov ecx, dword [edi + 8]
call fcn.0040b53c
test eax, eax
jne 0x417093
push dword [esi + 8]
mov ecx, dword [edi + 0x14]
call fcn.0041c922
mov ecx, dword [edi + 0x10]
shr eax, 1
push eax
push dword [edi + 0x14]
call fcn.0041c922
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 4]
shr eax, 1
push eax
call fcn.0041edb8
mov esi, eax
call dword [0x42c08c]
mov dword [ebp - 0x60c], eax
test esi, esi
jne 0x416f6d
push dword [edi + 4]
mov ecx, 0x9dd
call fcn.0041b556
push eax
lea eax, [ebp - 0x20c]
push 0xfe
push eax
call fcn.0040719d
push 2
pop ebx
push ebx
call fcn.00420b3b
add esp, 0x14
lea edx, [ebp - 0x20c]
mov ecx, eax
call fcn.0041c015
push ebx
call fcn.00420b3b
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0041b387
mov eax, dword [ebp - 0x60c]
test eax, eax
jle 0x416f56
movzx eax, ax
or eax, 0x80070000
cmp dword [edi + 0x1c14], 0
jne 0x417856
mov eax, 0x80004005
jmp 0x417856
cmp eax, 0x4c3
je 0x417058
xor esi, esi
xor ebx, ebx
inc esi
cmp eax, 0x50010001
je 0x416f93
cmp eax, 0xa0010001
je 0x417058
mov ecx, esi
jmp 0x416f95
mov ecx, ebx
mov eax, dword [ebp - 0x61c]
mov dword [eax], ecx
mov ecx, dword [edi + 8]
call fcn.0041bf7c
test eax, eax
je 0x417854
mov ecx, dword [ebp - 0x610]
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x624]
mov dword [ecx], eax
mov eax, dword [ebp - 0x614]
mov dword [eax], esi
cmp dword [edx + 0xc], ebx
je 0x417048
cmp dword [edi + 0x1bf0], ebx
jne 0x417854
push dword [ecx]
mov ecx, 0x1ab
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
mov ebx, dword [ebp - 0x628]
add esp, 0x14
mov edx, 0xfe
mov ecx, ebx
call fcn.0041c481
test eax, eax
je 0x416f63
mov ecx, ebx
call fcn.0041bf7c
test eax, eax
jne 0x41703b
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x608]
mov dword [ecx], ebx
jmp 0x41784c
mov ecx, dword [ebp - 0x608]
mov eax, dword [edi + 0xc]
mov dword [ecx], eax
jmp 0x41784c
mov eax, dword [ebp - 0x61c]
xor ebx, ebx
push 2
mov dword [eax], ebx
call fcn.00420b3b
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0041b387
mov eax, dword [ebp - 0x60c]
test eax, eax
jle 0x417088
movzx eax, ax
or eax, 0x80070000
cmp dword [edi + 0x1c14], ebx
jmp 0x416f5d
mov ecx, dword [edi + 4]
call fcn.0041e67a
xor ecx, ecx
inc ecx
test eax, eax
jne 0x417373
cmp word [edi + 0x1be8], cx
jne 0x417373
push dword [esi + 8]
mov ecx, dword [edi + 0x14]
call fcn.0041c922
mov ecx, dword [edi + 0x10]
shr eax, 1
push eax
push dword [edi + 0x14]
call fcn.0041c922
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 4]
shr eax, 1
push eax
call fcn.0041edb8
mov esi, eax
call dword [0x42c08c]
mov dword [ebp - 0x60c], eax
test esi, esi
je 0x416ef9
mov esi, eax
cmp esi, 0x4c3
je 0x417334
xor ebx, ebx
cmp esi, 0x50010001
je 0x41711b
cmp esi, 0xa0010001
je 0x417334
xor esi, esi
inc esi
mov ecx, esi
jmp 0x417120
xor esi, esi
mov ecx, ebx
inc esi
mov eax, dword [ebp - 0x61c]
mov dword [eax], ecx
mov ecx, dword [edi + 0x10]
call fcn.0041bf7c
test eax, eax
jne 0x417247
lea eax, [ebp - 0x620]
mov dword [ebp - 0x620], 0xfe
push eax
push dword [edi + 0x10]
push 2
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
jne 0x417180
mov ecx, 0x90
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
call dword [0x42c08c]
jmp 0x41707c
mov eax, dword [ebp - 0x614]
mov ecx, dword [ebp - 0x610]
mov dword [eax], esi
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
mov ecx, 0x1ad
push eax
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
add esp, 0x14
cmp dword [edi + 0x1bf0], ebx
jne 0x417247
mov eax, dword [ebp - 0x610]
mov ecx, 0x1ab
push dword [eax]
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
mov ecx, dword [edi + 0xc]
add esp, 0x14
call fcn.0041c922
mov ecx, dword [edi + 0xc]
shr eax, 1
mov edx, eax
call fcn.0041c481
test eax, eax
je 0x416f63
cmp dword [edi + 0x1bf0], ebx
jne 0x417232
mov ecx, dword [edi + 0xc]
call fcn.0041bf7c
test eax, eax
jne 0x417232
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x608]
mov eax, dword [edi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x618]
mov dword [eax], esi
jmp 0x41724d
mov ecx, dword [ebp - 0x608]
mov eax, dword [ebp - 0x610]
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x620], edx
mov dword [eax], edx
test byte [edi + 0x1be8], 0x10
je 0x41731e
mov edx, dword [ebp - 0x624]
cmp dword [edx + 0xc], ebx
je 0x417327
push dword [ebp - 0x620]
mov ecx, 0x1ab
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
add esp, 0x14
lea ecx, [edi + 0xc]
mov edx, 0x1fc
call fcn.0041c83c
test eax, eax
jne 0x4172cc
call fcn.0041b266
push 2
call fcn.00420b3b
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0041b387
jmp 0x417175
lea ebx, [edi + 0xc]
mov ecx, dword [ebx]
call fcn.0041c922
mov ecx, dword [ebx]
shr eax, 1
mov edx, eax
call fcn.0041c481
test eax, eax
je 0x416f63
mov ecx, dword [ebx]
call fcn.0041bf7c
test eax, eax
jne 0x417314
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x608]
jmp 0x417325
cmp dword [ecx], ebx
jne 0x417327
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x614]
mov dword [eax], esi
jmp 0x41784c
mov eax, dword [ebp - 0x61c]
xor ebx, ebx
push 2
mov dword [eax], ebx
call fcn.00420b3b
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0041b387
test esi, esi
jle 0x41735f
movzx esi, si
or esi, 0x80070000
cmp dword [edi + 0x1c14], ebx
jne 0x41736c
mov esi, 0x80004005
mov eax, esi
jmp 0x417856
push 2
pop ebx
cmp word [edi + 0x1be8], bx
jne 0x4175c2
push dword [esi + 8]
mov ecx, dword [edi + 0x14]
call fcn.0041c922
mov ecx, dword [edi + 0x10]
shr eax, 1
push eax
push dword [edi + 0x14]
call fcn.0041c922
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 4]
shr eax, 1
push eax
call fcn.0041edb8
mov esi, eax
call dword [0x42c08c]
mov dword [ebp - 0x60c], eax
test esi, esi
jne 0x4173e0
push dword [edi + 4]
mov ecx, 0x9dd
call fcn.0041b556
push eax
lea eax, [ebp - 0x20c]
push 0xfe
push eax
call fcn.0040719d
jmp 0x416f1b
cmp eax, 0x4c3
je 0x41757e
xor ebx, ebx
cmp eax, 0x50010001
je 0x417406
cmp eax, 0xa0010001
je 0x41757e
xor esi, esi
inc esi
mov ecx, esi
jmp 0x41740b
xor esi, esi
mov ecx, ebx
inc esi
mov eax, dword [ebp - 0x61c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x610]
mov ecx, dword [edi + 0x10]
mov dword [eax], ecx
test byte [edi + 0x1be8], 0x10
je 0x4174cb
mov edx, dword [ebp - 0x624]
lea eax, [edi + 0xc]
mov dword [ebp - 0x60c], eax
cmp dword [edx + 0xc], ebx
je 0x4174c4
push ecx
mov ecx, 0x1ab
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
add esp, 0x14
lea ecx, [edi + 0xc]
mov edx, 0x1fc
call fcn.0041c83c
test eax, eax
je 0x4172ae
mov ecx, dword [edi + 0xc]
call fcn.0041c922
mov ecx, dword [edi + 0xc]
shr eax, 1
mov edx, eax
call fcn.0041c481
test eax, eax
je 0x416f63
mov ecx, dword [edi + 0xc]
call fcn.0041bf7c
test eax, eax
jne 0x4174be
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov eax, dword [ebp - 0x60c]
mov eax, dword [eax]
jmp 0x417563
cmp dword [edi + 0x1bf0], ebx
jne 0x417573
mov ecx, dword [edi + 0x14]
call fcn.0041bf7c
test eax, eax
je 0x4174f3
mov ecx, dword [ebp - 0x608]
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
jmp 0x417573
mov eax, dword [ebp - 0x610]
mov ecx, 0x1ab
push dword [eax]
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
mov ecx, dword [edi + 0xc]
add esp, 0x14
call fcn.0041c922
mov ecx, dword [edi + 0xc]
shr eax, 1
mov edx, eax
call fcn.0041c481
test eax, eax
je 0x416f63
mov ecx, dword [edi + 0xc]
call fcn.0041bf7c
test eax, eax
jne 0x417560
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x608]
mov dword [ecx], eax
mov eax, dword [ebp - 0x618]
mov dword [eax], esi
mov eax, dword [ebp - 0x614]
jmp 0x417852
mov eax, dword [ebp - 0x61c]
xor ebx, ebx
mov ecx, 0x1fc
mov dword [eax], ebx
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
call fcn.0041b15e
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
jmp 0x417076
mov ecx, dword [edi + 4]
call fcn.0041bf7c
test eax, eax
je 0x417854
test byte [edi + 0x1be8], 8
je 0x417854
push dword [esi + 8]
mov ecx, dword [edi + 0x14]
call fcn.0041c922
mov ecx, dword [edi + 0x10]
shr eax, 1
push eax
push dword [edi + 0x14]
call fcn.0041c922
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 4]
shr eax, 1
push eax
call fcn.0041edb8
mov esi, eax
call dword [0x42c08c]
mov dword [ebp - 0x620], eax
test esi, esi
jne 0x41766b
push dword [edi + 4]
mov ecx, 0x9dd
call fcn.0041b556
push eax
lea eax, [ebp - 0x20c]
push 0xfe
push eax
call fcn.0040719d
push ebx
call fcn.00420b3b
add esp, 0x14
lea edx, [ebp - 0x20c]
mov ecx, eax
call fcn.0041c015
push ebx
call fcn.00420b3b
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0041b387
mov eax, dword [ebp - 0x620]
jmp 0x416f4a
cmp eax, 0x4c3
je 0x417945
xor ebx, ebx
cmp eax, 0x50010001
je 0x417691
cmp eax, 0xa0010001
je 0x417945
xor esi, esi
inc esi
mov ecx, esi
jmp 0x417696
xor esi, esi
mov ecx, ebx
inc esi
mov eax, dword [ebp - 0x61c]
mov dword [eax], ecx
mov ecx, dword [edi + 8]
call fcn.0040b53c
mov ecx, dword [edi + 8]
test eax, eax
je 0x41773f
mov eax, dword [ebp - 0x610]
mov dword [eax], ecx
lea eax, [edi + 0x818]
push eax
mov ecx, 0xca
call fcn.0041b556
push eax
lea eax, [ebp - 0x604]
push 0x1fc
push eax
call fcn.0040719d
push esi
call fcn.00420b3b
add esp, 0x14
lea edx, [ebp - 0x604]
mov ecx, eax
call fcn.0041c015
test byte [edi + 0x1be8], 0x10
je 0x417727
mov ecx, dword [edi + 0xc]
call fcn.0041bf7c
test eax, eax
je 0x417727
mov ecx, 0xfc
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov eax, dword [ebp - 0x614]
mov dword [eax], esi
mov eax, dword [ebp - 0x618]
mov dword [eax], esi
mov eax, dword [ebp - 0x60c]
jmp 0x417759
call fcn.0041bf7c
test eax, eax
je 0x41775b
mov ecx, dword [ebp - 0x610]
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x614]
mov dword [eax], esi
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push ebx
push esi
call fcn.0041bf8b
mov cx, word [edi + 0x1be8]
and cx, 0x10
movzx ecx, cx
test eax, eax
je 0x417867
test cx, cx
je 0x4177ae
mov ecx, dword [edi + 8]
call fcn.0041bf7c
test eax, eax
je 0x4177a6
mov edx, dword [ebp - 0x624]
cmp dword [edx + 0xc], ebx
je 0x4177a6
mov ecx, dword [edi + 8]
call fcn.0040b53c
test eax, eax
je 0x4177d0
mov ebx, dword [edi + 0xc]
jmp 0x41783a
cmp dword [edi + 0x1bf0], ebx
jne 0x417842
mov eax, dword [ebp - 0x60c]
cmp dword [eax], ebx
jne 0x417842
mov ecx, dword [edi + 8]
call fcn.0041bf7c
test eax, eax
je 0x417842
mov eax, dword [ebp - 0x610]
mov ecx, 0x1ab
push dword [eax]
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
mov ebx, dword [ebp - 0x628]
add esp, 0x14
mov edx, 0xfe
mov ecx, ebx
call fcn.0041c481
test eax, eax
je 0x416f63
mov ecx, ebx
call fcn.0041bf7c
test eax, eax
jne 0x41783a
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x608]
mov dword [ecx], ebx
mov eax, dword [ebp - 0x614]
mov ecx, esi
mov dword [eax], ecx
mov eax, dword [ebp - 0x618]
mov dword [eax], esi
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420460
leave
ret 0x1c
test cx, cx
je 0x41788b
mov ecx, dword [edi + 8]
call fcn.0041bf7c
test eax, eax
je 0x417883
mov edx, dword [ebp - 0x624]
cmp dword [edx + 0xc], ebx
jne 0x4178ce
mov ebx, dword [edi + 0xc]
jmp 0x417938
mov ecx, dword [edi + 0x14]
call fcn.0041bf7c
test eax, eax
je 0x4178a2
mov ecx, dword [ebp - 0x608]
jmp 0x417322
cmp dword [edi + 0x1bf0], ebx
jne 0x417327
mov ecx, dword [edi + 8]
call fcn.0041bf7c
test eax, eax
je 0x417327
mov ecx, dword [edi + 8]
call fcn.0040b53c
test eax, eax
jne 0x417327
mov eax, dword [ebp - 0x610]
mov ecx, 0x1ab
push dword [eax]
call fcn.0041b556
push eax
push ebx
push esi
push esi
call fcn.00420b3b
pop ecx
push eax
call fcn.0041c26c
mov ebx, dword [ebp - 0x628]
add esp, 0x14
mov edx, 0xfe
mov ecx, ebx
call fcn.0041c481
test eax, eax
je 0x416f63
mov ecx, ebx
call fcn.0041bf7c
test eax, eax
jne 0x417938
mov ecx, 0x20a
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x608]
mov dword [ecx], ebx
jmp 0x417327
mov eax, dword [ebp - 0x61c]
xor ebx, ebx
mov ecx, 0x1fc
mov dword [eax], ebx
call fcn.0041b556
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
call fcn.0041b15e
push 2
mov esi, eax
call fcn.00420b3b
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0041c015
mov eax, dword [ebp - 0x620]
jmp 0x41707c