Function at 0x4d09ba
Capabilities:
Get session user name

Disassembly:
mov eax, 0x5292b4
call fcn.0051f7c8
sub esp, 0x244
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
mov edi, 0x561720
call fcn.004d11c7
test al, al
jne 0x4d0fa3
call fcn.004cefff
mov edx, dword [eax]
mov esi, 0x100
push esi
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0a63
call fcn.004cf0d6
push 0x534dc0
push eax
call fcn.00405660
pop ecx
pop ecx
push str.TAppData::EnsureUniqUserIdExists
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x217
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.Cant_open_file_ui.
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
call fcn.004cf0e5
call fcn.004d08fe
test al, al
jne 0x4d0fa3
call fcn.004cefff
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0ae5
call fcn.004cf0d6
push 0x534dc0
push eax
call fcn.00405660
pop ecx
pop ecx
push str.TAppData::EnsureUniqUserIdExists
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x21d
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.Try_to_generate_new_guid...
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
call fcn.004cf0e5
and dword [ebp - 0x14], 0
lea ebx, [ebp - 0x14]
mov edi, 0x400
lea esi, [ebp - 0x2c]
call fcn.0040b3c0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x28]
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x24]
sub eax, esi
sar eax, 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.UICreated_
lea ecx, [ebp - 0x48]
call fcn.0040b580
lea eax, [ebp - 0x48]
push eax
mov edx, esi
mov byte [ebp - 4], 2
call fcn.00408f30
call fcn.004cefff
mov edx, dword [eax]
push 0x100
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0bd4
lea eax, [ebp - 0x48]
lea esi, [ebp - 0x68]
call fcn.0040bab0
mov esi, eax
mov byte [ebp - 4], 3
call fcn.004cf0d6
mov edi, 0x534dc0
push edi
push eax
call fcn.00405660
pop ecx
pop ecx
mov ebx, str.TAppData::EnsureUniqUserIdExists
push ebx
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x225
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
push eax
call fcn.00405890
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.00402b30
push 0x100
call fcn.004cf0e5
jmp 0x4d0bde
mov edi, 0x534dc0
mov ebx, str.TAppData::EnsureUniqUserIdExists
sub esp, 0x1c
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00402d50
sub esp, 0x1c
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov esi, str.SoftwareYandex
push esi
call fcn.00402ac0
mov byte [ebp - 4], 2
call fcn.004d0754
add esp, 0x38
test al, al
je 0x4d0c91
call fcn.004cefff
mov edx, dword [eax]
mov esi, 0x100
push esi
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0f93
call fcn.004cf0d6
push edi
push eax
call fcn.00405660
pop ecx
pop ecx
push ebx
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x229
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.The_key_in_SoftwareYandex_founded.
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
call fcn.004cf0e5
jmp 0x4d0f93
call fcn.004d58ae
test al, al
je 0x4d0daa
call fcn.004cefff
mov edx, dword [eax]
push 0x100
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0d13
call fcn.004cf0d6
push edi
push eax
call fcn.00405660
pop ecx
pop ecx
push ebx
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x22f
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.Try_to_check_key_under_Vista
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x100
call fcn.004cf0e5
sub esp, 0x1c
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00402d50
sub esp, 0x1c
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareAppDataLowYandex
call fcn.00402ac0
mov byte [ebp - 4], 2
call fcn.004d0754
add esp, 0x38
test al, al
je 0x4d0daa
call fcn.004cefff
mov edx, dword [eax]
mov esi, 0x100
push esi
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0f93
call fcn.004cf0d6
push edi
push eax
call fcn.00405660
pop ecx
pop ecx
push ebx
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x231
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.The_key_in_SoftwareAppDataLowYandex_founded.
jmp 0x4d0c71
call fcn.004d58ae
test al, al
je 0x4d0db8
mov esi, str.SoftwareAppDataLowYandex
call fcn.004cefff
mov edx, dword [eax]
push 0x100
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0e36
call fcn.004cf0d6
push edi
push eax
call fcn.00405660
pop ecx
pop ecx
push ebx
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x238
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.Try_to_write_to_registry._Path:
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x100
call fcn.004cf0e5
push esi
lea ecx, [ebp - 0x68]
call fcn.00402ac0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x250]
push eax
mov ebx, SysReAllocString
mov byte [ebp - 4], 6
call fcn.004675c0
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 8
call fcn.00402b30
lea eax, [ebp - 0x48]
lea esi, [ebp - 0xa8]
lea ecx, [ebp - 0x250]
call fcn.004457c0
mov byte [ebp - 4], 9
call fcn.004d0424
mov byte [ebp - 4], 8
call fcn.00445400
lea eax, [ebp - 0x84]
push eax
call fcn.004d066e
pop ecx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x18], 8
jb 0x4d0ea9
mov eax, dword [eax + 4]
jmp 0x4d0eac
add eax, 4
push 0x22
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.004098d0
mov byte [ebp - 4], 0xb
call fcn.004cefff
mov edx, dword [eax]
mov esi, 0x100
push esi
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d0f44
call fcn.004cf0d6
push edi
push eax
call fcn.00405660
pop ecx
pop ecx
push str.TAppData::EnsureUniqUserIdExists
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x23f
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.ui_val:
push eax
call fcn.00405660
pop ecx
pop ecx
lea ecx, [ebp - 0x84]
push ecx
push eax
call fcn.00405890
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
call fcn.004cf0e5
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.00405890
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x84]
push eax
mov ecx, 0x56182c
call fcn.00402e40
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0xa
call fcn.00407650
lea ecx, [ebp - 0x84]
call fcn.00402b30
lea edi, [ebp - 0x250]
call fcn.00445600
lea ecx, [ebp - 0x48]
call fcn.00402d80
lea esi, [ebp - 0x2c]
call fcn.00439530
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4