Function at 0x40dbd0
Capabilities:
Get session user name
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4108
call fcn.004305d0
mov eax, dword [0x49b138]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20dc], esi
mov dword [ebp - 0x20e0], edi
mov dword [ebp - 0x20e4], eax
mov dword [ebp - 0x20cc], ebx
nop dword [eax]
lea eax, [ebp - 0x4108]
push eax
push edi
push esi
call fcn.0040d1e0
add esp, 0xc
test al, al
je 0x40e19e
push 0x202e
lea eax, [ebp - 0x20c4]
mov byte [ebp - 0x20d4], 0
push 0
push eax
call fcn.00432e30
mov eax, dword [ebp - 0x4108]
add esp, 0xc
cmp eax, 7
jne 0x40dca0
push dword [ebp - 0x30f6]
push str.Getting_authentication__step
push 0x4a0d68
call fcn.00402c50
add esp, 8
mov ecx, eax
call fcn.00404670
push eax
call fcn.00403580
push dword [ebp - 0x20e4]
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.00405fe0
movzx eax, al
add esp, 0x10
mov dword [ebp - 0x20c4], eax
jmp 0x40dfac
cmp eax, 6
jne 0x40df14
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ecx + str.1.0.8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x7e], ax
test ax, ax
jne 0x40dcb0
cmp dword [0x4a0b94], 4
jne 0x40dcf8
lea ecx, [ebp - 0x7c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40dcd3
mov eax, dword [str._SVC]
mov dword [ecx], eax
mov eax, dword [0x4843b0]
mov dword [ecx + 4], eax
mov ax, word [0x4843b4]
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c8]
mov dword [ebp - 0x20c8], 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40dee7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40dee7
mov eax, dword [ebp - 0x20c8]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043039d
add esp, 4
mov dword [ebp - 0x20d0], eax
lea ecx, [ebp - 0x20c8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40ded9
lea ecx, [ebp - 0x7c]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40dd70
mov eax, dword [str.__User]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x20c8]
mov dword [ecx], eax
mov eax, dword [0x4843bc]
mov dword [ecx + 4], eax
mov eax, dword [0x4843c0]
mov dword [ecx + 8], eax
mov eax, dword [0x4843c4]
mov dword [ecx + 0xc], eax
movups xmmword [ebp - 0x94], xmm0
cmp esi, 0x7ffffffe
ja 0x40e1bb
cmp esi, 8
jae 0x40ddf3
lea eax, [esi + esi]
mov dword [ebp - 0x84], esi
push eax
push dword [ebp - 0x20d0]
lea eax, [ebp - 0x94]
mov dword [ebp - 0x80], 7
push eax
call fcn.00432330
mov edi, dword [ebp - 0x94]
add esp, 0xc
mov ebx, dword [ebp - 0x80]
mov dword [ebp - 0x20d8], edi
jmp 0x40de50
mov ebx, esi
or ebx, 7
cmp ebx, 0x7ffffffe
jbe 0x40de07
mov ebx, SysReAllocString
jmp 0x40de12
cmp ebx, 0xa
mov eax, 0xa
cmovb ebx, eax
lea eax, [ebx + 1]
push eax
lea ecx, [ebp - 0x94]
call fcn.0040253e
mov dword [ebp - 0x84], esi
mov edi, eax
add esi, esi
mov dword [ebp - 0x20d8], edi
push esi
push dword [ebp - 0x20d0]
mov dword [ebp - 0x94], edi
push edi
mov dword [ebp - 0x80], ebx
call fcn.00432330
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
cmp ebx, 8
lea edx, [ebp - 0x94]
cmovae edx, edi
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40de60
lea edi, [ebp - 0x7c]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40de73
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 8
jb 0x40dec7
mov ecx, dword [ebp - 0x20d8]
lea ebx, [ebx*2 + 2]
mov eax, ecx
cmp ebx, 0x1000
jb 0x40debd
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e1b6
push ebx
push ecx
call fcn.0042ffce
add esp, 8
mov edi, dword [ebp - 0x20e0]
mov esi, dword [ebp - 0x20dc]
mov ebx, dword [ebp - 0x20cc]
push dword [ebp - 0x20d0]
call fcn.004303a6
add esp, 4
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x7c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x20ae], ax
test ax, ax
jne 0x40def0
mov dword [ebp - 0x20c4], 1
jmp 0x40dfac
cmp eax, 0xa
jne 0x40df77
push str.Terminate_Query
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
movzx ebx, bl
cmp edi, 0xffffffff
mov eax, 1
cmove ebx, eax
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x20cc], ebx
je 0x40df6b
push str.Not_Terminating__because_Debugging
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
xor bl, bl
mov dword [ebp - 0x20cc], ebx
mov dword [ebp - 0x20c4], 1
jmp 0x40dfac
lea eax, [ebp - 0x4108]
push eax
call fcn.00407230
add esp, 4
test al, al
jne 0x40dfcf
push str.not_authenticated
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
mov dword [ebp - 0x20c4], 0
push dword [ebp - 0x20d4]
lea eax, [ebp - 0x20c4]
push eax
push esi
call fcn.0040d2c0
add esp, 0xc
test bl, bl
jne 0x40e1af
jmp 0x40dc10
mov eax, dword [ebp - 0x4108]
cmp eax, 0xc
ja case.0x40dfda.6
jmp dword [eax*4 + 0x40e1c0]
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.00408510
add esp, 8
jmp 0x40dfac
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.004086c0
add esp, 8
jmp 0x40dfac
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.00408480
add esp, 8
jmp 0x40dfac
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.004093d0
add esp, 8
jmp 0x40dfac
cmp dword [ebp + 0x18], 1
jne 0x40e081
push str.create_VSS_via_the_proper_pipe
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.0040ad60
add esp, 0x14
mov byte [ebp - 0x20d4], 1
jmp 0x40dfac
push str.Must_not_call_createVSS_via_the_normal_pipe
jmp 0x40df8f
cmp dword [ebp + 0x18], 1
jne 0x40e0c8
push str.close_VSS_via_the_proper_pipe
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.0040acb0
add esp, 0x14
mov byte [ebp - 0x20d4], 1
jmp 0x40dfac
push str.Must_not_call_closeVSS_via_the_normal_pipe
jmp 0x40df8f
cmp dword [ebp + 0x18], 2
jne 0x40e10a
push str.DriverInstall_via_the_proper_pipe
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
lea eax, [ebp - 0x4108]
push eax
call fcn.00407bb0
movzx eax, al
add esp, 0x10
mov dword [ebp - 0x20c4], eax
jmp 0x40dfac
push str.Must_not_call_DriverInstall_via_the_normal_pipe
jmp 0x40df8f
cmp dword [ebp + 0x18], 2
jne 0x40e14c
push str.DriverUnInstall_via_the_proper_pipe
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
lea eax, [ebp - 0x4108]
push eax
call fcn.00407ff0
movzx eax, al
add esp, 0x10
mov dword [ebp - 0x20c4], eax
jmp 0x40dfac
push str.Must_not_call_DriverUninstall_via_the_normal_pipe
jmp 0x40df8f
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.00408ed0
movzx eax, al
add esp, 8
mov dword [ebp - 0x20c4], eax
jmp 0x40dfac
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x4108]
push eax
call fcn.00408380
movzx eax, al
add esp, 8
mov dword [ebp - 0x20c4], eax
jmp 0x40dfac
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430365
mov esp, ebp
pop ebp
ret
push 0
call fcn.00452cad
call fcn.0043eeb1
call fcn.004015ae
loope 0x40e1a1
inc eax
add cl, bh
fild word [eax]
adc eax, esp
inc eax
add byte [ecx], ch
loopne 0x40e20f
add byte [eax + 0x40], al
add byte [ebx - 0x5dffbf20], cl
fild word [eax]
mov byte [0xd20040df], al
loopne 4252195
add byte [ecx], dl
inc eax
add byte [edx + 0x560040df], ah
loope 0x40e22f
add byte [edx - 0x1f], bh
inc eax
add ah, cl
int3
inc ebp
or al, 0x57
mov dword [ebp - 0xc], eax
mov al, byte [ebp + 0x10]
push str.creating_thread_1
push 0x4a0d68
mov byte [ebp - 8], al
inc ebp
clc
mov dword [ebp - 4], 0xffffffff
call fcn.00402c50
push eax
call fcn.00403580
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10]
add esp, 0xc
push 0
push 4
push eax
push 0x40e350
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, eax
push ebx
call esi
push str.creating_thread_2
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
lea eax, [ebp - 0x10]
push 0
push 4
push eax
push 0x40e3a0
push 0
push 0
call edi
push eax
call esi
push str.creating_thread_3
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
lea eax, [ebp - 0x10]
push 0
push 4
push eax
push 0x40e300
push 0
push 0
call edi
push eax
call esi
push str.waiting_for_thread_1
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.finished
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
invalid