Function at 0x41038790
Capabilities:
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
add eax, 0xfffffffc
xor esi, esi
push edi
mov dword [ebp - 4], ebx
cmp eax, 0xa
ja case.0x410387b4.6
movzx eax, byte [eax + 0x41038990]
jmp dword [eax*4 + 0x41038978]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [ebp + 0x14]
push eax
mov dword [esi], eax
call fcn.41038670
add esp, 4
test eax, eax
jne 0x410387e5
mov ecx, dword [esi]
mov dword [ecx], 0xffffffff
mov edx, dword [ebp + 0x18]
mov esi, 1
pop edi
mov eax, esi
pop esi
mov dword [edx], 4
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 4]
push eax
push ebx
call esi
mov ecx, dword [ebp - 4]
lea edx, [ecx + ecx]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 4]
push edx
push eax
mov dword [ecx], eax
call esi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x18]
mov esi, 1
lea ecx, [eax + eax]
pop edi
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
cmp eax, ebx
jbe case.0x410387b4.6
lea eax, [eax + eax + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [ebp + 0x14]
mov dword [edi], eax
cmp eax, ebx
je case.0x410387b4.6
mov ecx, dword [ebp - 4]
push ecx
push ebx
push eax
call fcn.4112eb40
mov edx, dword [ebp - 4]
mov eax, dword [edi]
add esp, 0xc
push edx
push eax
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je case.0x410387b4.6
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x18]
lea edx, [ecx + ecx]
mov esi, 1
pop edi
mov dword [eax], edx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
mov ecx, str.localhost
mov edx, eax
jmp 0x410388e0
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x410388e0
mov eax, dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x410388f6
sub eax, edx
mov edx, dword [ebp + 0x18]
sar eax, 1
mov esi, 1
lea ecx, [eax + eax + 2]
pop edi
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov eax, dword [edx]
mov dword [eax], 2
mov ecx, dword [edx]
mov byte [ecx + 6], 0x7f
mov eax, dword [edx]
mov byte [eax + 7], bl
mov ecx, dword [edx]
mov eax, dword [ebp + 0x18]
mov byte [ecx + 8], bl
mov edx, dword [edx]
mov byte [edx + 9], bl
mov dword [eax], 0x18
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret