Function at 0x401bf0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x42c
mov eax, dword [0x4e3180]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x400
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword fs:[0x2c]
mov dword [esp + 0x10], 0xa1f44e0e
mov word [esp + 0x14], 0xb7d3
mov byte [esp + 0x16], 0xa5
mov ebx, dword [eax]
mov eax, dword [0x4e5e94]
cmp eax, dword [ebx + 4]
jle 0x401cb3
push 0x4e5e94
call fcn.00434e40
add esp, 4
cmp dword [0x4e5e94], 0xffffffff
jne 0x401cb3
xorps xmm0, xmm0
mov byte [0x4e5fb7], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop dword [eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5fb0], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x401c99
cmp ecx, 7
jb 0x401c80
push 0x4bd920
call fcn.00435110
add esp, 4
push 0x4e5e94
call fcn.00434def
add esp, 4
cmp byte [0x4e5fb7], 0
je 0x401d03
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
nop dword [eax]
mov ecx, esi
mov eax, 0xd39b2b69
and ecx, 7
mov edx, 0x5aa5d2b4
shl ecx, 3
call fcn.004b6740
xor byte [esi + 0x4e5fb0], al
add esi, 1
adc edi, 0
test edi, edi
jne 0x401cfc
cmp esi, 7
jb 0x401cd0
mov byte [0x4e5fb7], 0
mov ecx, 0x4e5fb0
lea eax, [esp + 0x30]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d30
test dl, dl
je 0x401d2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d30
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d10
xor eax, eax
jmp 0x401d35
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5fec]
mov dword [esp + 0x10], 0x9dd36423
mov dword [esp + 0x14], 0x5ae68299
cmp eax, dword [ebx + 4]
jle 0x401dc3
push 0x4e5fec
call fcn.00434e40
add esp, 4
cmp dword [0x4e5fec], 0xffffffff
jne 0x401dc3
xorps xmm0, xmm0
mov byte [0x4e5cd4], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5ccc], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x401da9
cmp ecx, 8
jb 0x401d90
push 0x4bd8e0
call fcn.00435110
add esp, 4
push 0x4e5fec
call fcn.00434def
add esp, 4
mov ecx, 0x4e5ccc
call fcn.004050a0
mov ecx, 0x4e5ccc
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401df6
test dl, dl
je 0x401df2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401df6
add eax, 2
add ecx, 2
test dl, dl
jne 0x401dd6
xor eax, eax
jmp 0x401dfb
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5f00]
mov dword [esp + 0x10], 0xb7f54a3a
mov dword [esp + 0x14], 0x5addbdd6
cmp eax, dword [ebx + 4]
jle 0x401e83
push 0x4e5f00
call fcn.00434e40
add esp, 4
cmp dword [0x4e5f00], 0xffffffff
jne 0x401e83
xorps xmm0, xmm0
mov byte [0x4e5c90], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5c88], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x401e69
cmp ecx, 8
jb 0x401e50
push 0x4bd8a0
call fcn.00435110
add esp, 4
push 0x4e5f00
call fcn.00434def
add esp, 4
mov ecx, 0x4e5c88
call fcn.004050a0
mov ecx, 0x4e5c88
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401eb6
test dl, dl
je 0x401eb2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401eb6
add eax, 2
add ecx, 2
test dl, dl
jne 0x401e96
xor eax, eax
jmp 0x401ebb
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5d84]
mov dword [esp + 0x10], 0xb7f54a1a
mov dword [esp + 0x14], 0x22cab094
mov byte [esp + 0x18], 0x69
cmp eax, dword [ebx + 4]
jle 0x401f46
push 0x4e5d84
call fcn.00434e40
add esp, 4
cmp dword [0x4e5d84], 0xffffffff
jne 0x401f46
xorps xmm0, xmm0
mov byte [0x4e5ca1], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5c98], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x401f2c
cmp ecx, 9
jb 0x401f13
push 0x4bd860
call fcn.00435110
add esp, 4
push 0x4e5d84
call fcn.00434def
add esp, 4
mov ecx, 0x4e5c98
call fcn.00405040
mov ecx, 0x4e5c98
lea eax, [esp + 0x30]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401f80
test dl, dl
je 0x401f7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401f80
add eax, 2
add ecx, 2
test dl, dl
jne 0x401f60
xor eax, eax
jmp 0x401f85
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5c94]
mov dword [esp + 0x10], 0xbdf34423
mov dword [esp + 0x14], 0x3fca9694
mov byte [esp + 0x18], 0x69
cmp eax, dword [ebx + 4]
jle 0x402013
push 0x4e5c94
call fcn.00434e40
add esp, 4
cmp dword [0x4e5c94], 0xffffffff
jne 0x402013
xorps xmm0, xmm0
mov byte [0x4e5d81], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop dword [eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5d78], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x401ff9
cmp ecx, 9
jb 0x401fe0
push 0x4bd820
call fcn.00435110
add esp, 4
push 0x4e5c94
call fcn.00434def
add esp, 4
mov ecx, 0x4e5d78
call fcn.00405040
mov ecx, 0x4e5d78
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402046
test dl, dl
je 0x402042
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402046
add eax, 2
add ecx, 2
test dl, dl
jne 0x402026
xor eax, eax
jmp 0x40204b
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5d38]
mov dword [esp + 0x10], 0xa4f74a04
mov dword [esp + 0x14], 0x5ac0a0d5
cmp eax, dword [ebx + 4]
jle 0x4020d3
push 0x4e5d38
call fcn.00434e40
add esp, 4
cmp dword [0x4e5d38], 0xffffffff
jne 0x4020d3
xorps xmm0, xmm0
mov byte [0x4e5cc8], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5cc0], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4020b9
cmp ecx, 8
jb 0x4020a0
push 0x4bd7e0
call fcn.00435110
add esp, 4
push 0x4e5d38
call fcn.00434def
add esp, 4
mov ecx, 0x4e5cc0
call fcn.004050a0
mov ecx, 0x4e5cc0
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402106
test dl, dl
je 0x402102
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402106
add eax, 2
add ecx, 2
test dl, dl
jne 0x4020e6
xor eax, eax
jmp 0x40210b
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5f1c]
mov dword [esp + 0x10], 0xb6ef4e39
mov dword [esp + 0x14], 0x33f2f2c6
mov dword [esp + 0x18], 0xbdf45805
mov byte [esp + 0x1c], 0xb4
cmp eax, dword [ebx + 4]
jle 0x4021a3
push 0x4e5f1c
call fcn.00434e40
add esp, 4
cmp dword [0x4e5f1c], 0xffffffff
jne 0x4021a3
xorps xmm0, xmm0
mov byte [0x4e5e7d], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5e70], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x402189
cmp ecx, 0xd
jb 0x402170
push 0x4bd7a0
call fcn.00435110
add esp, 4
push 0x4e5f1c
call fcn.00434def
add esp, 4
mov ecx, 0x4e5e70
call fcn.00404fe0
mov ecx, 0x4e5e70
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4021d6
test dl, dl
je 0x4021d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4021d6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4021b6
xor eax, eax
jmp 0x4021db
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5d1c]
mov dword [esp + 0x10], 0xa6e9421f
mov word [esp + 0x14], 0xd2c7
cmp eax, dword [ebx + 4]
jle 0x402263
push 0x4e5d1c
call fcn.00434e40
add esp, 4
cmp dword [0x4e5d1c], 0xffffffff
jne 0x402263
xorps xmm0, xmm0
mov byte [0x4e5e4a], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop dword [eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5e44], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x402249
cmp ecx, 6
jb 0x402230
push 0x4bd760
call fcn.00435110
add esp, 4
push 0x4e5d1c
call fcn.00434def
add esp, 4
cmp byte [0x4e5e4a], 0
je 0x4022b3
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
nop dword [eax]
mov ecx, esi
mov eax, 0xd39b2b69
and ecx, 7
mov edx, 0x5aa5d2b4
shl ecx, 3
call fcn.004b6740
xor byte [esi + 0x4e5e44], al
add esi, 1
adc edi, 0
test edi, edi
jne 0x4022ac
cmp esi, 6
jb 0x402280
mov byte [0x4e5e4a], 0
mov ecx, 0x4e5e44
lea eax, [esp + 0x30]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4022e0
test dl, dl
je 0x4022dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4022e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4022c0
xor eax, eax
jmp 0x4022e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5eb4]
mov dword [esp + 0x10], 0xa7f74a04
mov dword [esp + 0x14], 0x5ad1a1d1
cmp eax, dword [ebx + 4]
jle 0x402373
push 0x4e5eb4
call fcn.00434e40
add esp, 4
cmp dword [0x4e5eb4], 0xffffffff
jne 0x402373
xorps xmm0, xmm0
mov byte [0x4e5c40], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5c38], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x402359
cmp ecx, 8
jb 0x402340
push 0x4bd720
call fcn.00435110
add esp, 4
push 0x4e5eb4
call fcn.00434def
add esp, 4
mov ecx, 0x4e5c38
call fcn.004050a0
mov ecx, 0x4e5c38
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4023a6
test dl, dl
je 0x4023a2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4023a6
add eax, 2
add ecx, 2
test dl, dl
jne 0x402386
xor eax, eax
jmp 0x4023ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov eax, dword [0x4e5e8c]
mov dword [esp + 0x10], 0xa1e95e2a
mov dword [esp + 0x14], 0xfd1bcd1
mov dword [esp + 0x18], 0xd3e94e1a
cmp eax, dword [ebx + 4]
jle 0x402443
push 0x4e5e8c
call fcn.00434e40
add esp, 4
cmp dword [0x4e5e8c], 0xffffffff
jne 0x402443
xorps xmm0, xmm0
mov byte [0x4e5ed4], 1
movlpd qword [esp + 0x20], xmm0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
nop word [eax + eax]
mov al, byte [esp + ecx + 0x10]
mov byte [ecx + 0x4e5ec8], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x402429
cmp ecx, 0xc
jb 0x402410
push 0x4bd6e0
call fcn.00435110
add esp, 4
push 0x4e5e8c
call fcn.00434def
add esp, 4
mov ecx, 0x4e5ec8
call fcn.00404f80
mov ecx, 0x4e5ec8
lea eax, [esp + 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402476
test dl, dl
je 0x402472
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402476
add eax, 2
add ecx, 2
test dl, dl
jne 0x402456
xor eax, eax
jmp 0x40247b
sbb eax, eax
or eax, 1
test eax, eax
je 0x402494
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434db6
mov esp, ebp
pop ebp
ret
push 1
call fcn.0043a1ee
int3