Function at 0x52d83c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x49
push 0
push 0
dec ecx
jne 0x52d845
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
mov eax, dword [ebp - 8]
call fcn.0040514c
xor eax, eax
push ebp
push 0x52db47
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor edx, edx
push ebp
push 0x52db08
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x52dac0
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x41f004]
call fcn.00403d7c
mov dword [ebp - 0x28], eax
call fcn.0040e344
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x10]
mov eax, 0x52db60
call fcn.0040efc0
call fcn.0040e344
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x14]
mov eax, 0x52db74
call fcn.0040efc0
mov eax, 0x28
call fcn.0040285c
mov dword [ebp - 0x2c], 0x28
lea edx, [ebp - 0x2c]
push edx
push eax
call sub.advapi32.dll_GetUserNameA
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004e2ee4
lea edx, [ebp - 0x230]
mov eax, 0x52db88
call fcn.004dcb6c
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x18]
call fcn.0040b8d0
push 0x52db9c
push dword [ebp - 0x18]
push 0x52dbac
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040501c
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 4]
call fcn.0040b8d0
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 4]
call fcn.00404d18
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 8]
call fcn.0040b8d0
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 8]
call fcn.00404d18
push dword [ebp - 4]
push 0x52dbc0
push dword [ebp - 8]
push 0x52dbcc
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 0x28]
call fcn.004226f8
push dword [ebp - 0x23c]
push 0x52dc44
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.0040501c
lea eax, [ebp - 0x22c]
push eax
push 0x1ff
push 0x200
mov ecx, 0x52dc6c
mov edx, 0x52dc70
mov eax, 0x52dc84
call fcn.004b5ee0
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x22c]
call fcn.0040cc0c
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x24]
call fcn.00411014
push 0
push 0x52dc6c
push 0x52dc6c
mov eax, dword [ebp - 0x1c]
call fcn.0040515c
push eax
push 0x52dc8c
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040515c
push eax
push ebx
call sub.encdec.dll_SendLogLine
test al, al
je 0x52da81
lea edx, [ebp - 0x248]
mov eax, ebx
call fcn.0040bc54
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x244]
mov edx, 0x52dc9c
call fcn.00404fa8
mov edx, dword [ebp - 0x244]
xor ecx, ecx
mov eax, dword [0x55edbc]
call fcn.00529e30
call fcn.00526fbc
test al, al
je 0x52da6e
xor ecx, ecx
mov edx, 0x52dce8
mov eax, dword [0x55edbc]
call fcn.00529e30
mov byte [ebp - 9], 1
jmp 0x52dab6
xor ecx, ecx
mov edx, 0x52dd30
mov eax, dword [0x55edbc]
call fcn.00529e30
jmp 0x52dab6
lea edx, [ebp - 0x250]
mov eax, ebx
call fcn.0040bc54
mov ecx, dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
mov edx, 0x52dd78
call fcn.00404fa8
mov edx, dword [ebp - 0x24c]
xor ecx, ecx
mov eax, dword [0x55edbc]
call fcn.00529e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52daca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52db0f
xor eax, eax
push ebp
push 0x52dafd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x28], 0
je 0x52daf3
lea eax, [ebp - 0x28]
call fcn.00412400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52db07
ret