Function at 0x472b70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb432
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x53c], eax
mov eax, dword [edi + 0xcdc]
mov esi, ecx
mov dword [ebp - 0x534], esi
test eax, 0x4000000
je 0x47307c
not eax
test eax, 0x2000000
je 0x47307c
mov eax, dword [edi + 0xce4]
not eax
and eax, 0x800
xor ecx, ecx
or ecx, eax
je 0x47307c
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x472c00
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x51c], eax
mov dword [ebp - 4], 0
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x472c33
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x524], eax
mov byte [ebp - 4], 1
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x472c63
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x528], eax
mov byte [ebp - 4], 2
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x472c93
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x530], eax
push 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 3
call fcn.0047aa50
mov eax, dword [edi + 0xce8]
push 0
push eax
lea ecx, [ebp - 0x529]
call fcn.0042d0f0
call fcn.0046d5a0
call fcn.0046d4e0
test eax, eax
je 0x472cf0
mov eax, dword [edi + 0xce8]
push eax
call fcn.0046d4d0
mov ecx, eax
call fcn.0046d780
call fcn.0046d4e0
test eax, eax
je 0x472d0a
push str.__Update_Package_application_started___n
call fcn.0046d4d0
mov ecx, eax
call fcn.0046d9d0
mov ecx, dword [esi + 0xc]
add ecx, 0x68
push ecx
lea ecx, [ebp - 0x520]
call fcn.00403380
lea edx, [ebp - 0x528]
push edx
push str.OriginalPath
push eax
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 4
call fcn.004203a0
mov eax, dword [ebp - 0x520]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472d5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xc]
add ecx, 0x68
push ecx
lea ecx, [ebp - 0x520]
call fcn.00403380
lea edx, [ebp - 0x530]
push edx
push str.OriginalCmdLine
push eax
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 5
call fcn.004203a0
mov eax, dword [ebp - 0x520]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472db2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x530]
push ecx
lea ecx, [ebp - 0x524]
call fcn.00402af0
push 0
push 1
lea edx, [ebp - 0x51c]
push edx
push 0xfffffffffffffffd
push ecx
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.PRODCODE
call fcn.00403380
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x515]
call fcn.0041c7b0
push 0
push 1
lea ecx, [ebp - 0x51c]
push ecx
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x520], esp
push str.CBIS
call fcn.00403380
lea edx, [ebp - 0x524]
push edx
lea ecx, [ebp - 0x515]
call fcn.0041c7b0
push 0
push 1
lea eax, [ebp - 0x51c]
push eax
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x520], esp
push 0x5da1bc
call fcn.00403380
lea ecx, [ebp - 0x524]
push ecx
lea ecx, [ebp - 0x515]
call fcn.0041c7b0
mov esi, dword [ebp - 0x528]
push 0x5c
push esi
call fcn.0059aa24
add esp, 8
test eax, eax
je 0x472e8b
sub eax, esi
cmp eax, 0xffffffff
je 0x472e8b
inc eax
push eax
push 0
lea ecx, [ebp - 0x528]
call fcn.00407710
mov esi, dword [ebp - 0x528]
mov edx, dword [ebp - 0x524]
push edx
push esi
lea eax, [ebp - 0x51c]
push str.Command:__s__s
push eax
call fcn.00408cb0
add esp, 0x10
call fcn.0046d4e0
test eax, eax
je 0x472ede
mov ecx, dword [ebp - 0x51c]
push ecx
lea edx, [ebp - 0x110]
push 0x5d3710
push edx
call fcn.00599ee3
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
call fcn.0046d4d0
mov ecx, eax
call fcn.0046d9d0
lea ecx, [ebp - 0x544]
push ecx
call fcn.0059c808
lea edx, [ebp - 0x544]
push edx
call fcn.0059c79b
push eax
lea eax, [ebp - 0x51c]
push str.Date:__s
push eax
call fcn.00408cb0
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046d4e0
test eax, eax
je 0x472f4a
mov ecx, dword [ebp - 0x51c]
push ecx
lea edx, [ebp - 0x110]
push 0x5cf00c
push edx
call fcn.00599ee3
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
call fcn.0046d4d0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d4e0
test eax, eax
je 0x472f64
push str._n
call fcn.0046d4d0
mov ecx, eax
call fcn.0046d9d0
lea ecx, [ebp - 0x538]
push ecx
lea edx, [ebp - 0x318]
push edx
mov dword [ebp - 0x538], 0x208
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x51c]
push str.User:__s
push ecx
call fcn.00408cb0
add esp, 0xc
call fcn.0046d4e0
test eax, eax
je 0x472fd4
mov edx, dword [ebp - 0x51c]
push edx
lea eax, [ebp - 0x110]
push 0x5d3710
push eax
call fcn.00599ee3
lea ecx, [ebp - 0x110]
add esp, 0xc
push ecx
call fcn.0046d4d0
mov ecx, eax
call fcn.0046d9d0
mov edx, dword [ebp - 0x53c]
mov ecx, dword [ebp - 0x534]
push edi
push edx
call fcn.00470870
mov eax, dword [ebp - 0x530]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47300d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47302d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x524]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473053
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x51c]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47307c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8