Function at 0x457dd1
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push edi
call fcn.0044a6a8
mov edi, eax
mov ecx, edi
call fcn.0045cb20
test eax, eax
je 0x457e0a
lea eax, [ebp - 8]
push eax
call fcn.00416ca3
push dword [ebp - 8]
call fcn.0043ce41
pop ecx
pop ecx
lea ecx, [ebp - 8]
call fcn.00401085
push dword [ebp + 0x10]
lea ecx, [ebp - 0x48]
call fcn.0045cab5
lea ecx, [ebp - 0x48]
call fcn.0045ce93
mov eax, dword [0x4a9450]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
call fcn.0043ddf1
xor ebx, ebx
lea ecx, [ebp - 0xc8]
push ebx
call fcn.00483a0d
lea ecx, [ebp - 0xc8]
call fcn.00483a77
lea eax, [ebp - 8]
lea ecx, [ebp - 0xc8]
push eax
call fcn.00483d85
lea eax, [ebp - 0x10]
push eax
call fcn.00482e51
pop ecx
push dword [eax]
lea eax, [ebp - 4]
push dword [ebp - 8]
push str.Start_TwinkiePaste__s__on__s
push eax
call fcn.004069e4
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00401085
push dword [ebp - 4]
call fcn.0043d98d
mov esi, 0x4bf5f0
pop ecx
mov eax, esi
test eax, eax
je 0x457e98
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.00406586
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x10]
push str.Command_Line:
push eax
call fcn.0040673f
push eax
lea ecx, [ebp - 4]
call fcn.004065e8
lea ecx, [ebp - 0x10]
call fcn.00401085
lea ecx, [ebp - 0xc]
call fcn.00401085
push dword [ebp - 4]
call fcn.0043d98d
pop ecx
lea ecx, [ebp - 8]
call fcn.00401085
lea ecx, [ebp - 0xc8]
call fcn.0048396d
lea ecx, [ebp - 4]
call fcn.00401085
mov eax, dword [0x4a9450]
mov esi, 0x105
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x104
call fcn.00406846
test eax, eax
je 0x457f30
mov eax, dword [ebp - 4]
mov dword [eax - 8], esi
mov eax, dword [ebp - 4]
mov word [eax + 0x20a], bx
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.004068ae
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp - 8]
push str.Windows_Session_Username
push eax
call fcn.0040673f
lea ecx, [ebp - 0x10]
call fcn.00401085
push dword [ebp - 8]
call fcn.0043d98d
pop ecx
lea ecx, [ebp - 8]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
call fcn.0040d9d8
test eax, eax
mov eax, 0x4b54b4
jne 0x457f96
mov eax, 0x4ae7c8
push eax
lea ecx, [ebp - 4]
call fcn.004064a9
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp - 8]
push str.Has_Admin_priveliegies:
push eax
call fcn.0040673f
lea ecx, [ebp - 0xc]
call fcn.00401085
push dword [ebp - 8]
call fcn.0043d98d
pop ecx
lea ecx, [ebp - 8]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
lea ecx, [ebp - 0x48]
call fcn.0045cb18
test eax, eax
je 0x457ff0
push ebx
call fcn.0040dcd4
pop ecx
call fcn.004100a6
lea ecx, [ebp - 0x48]
call fcn.0045cb1c
test eax, eax
je 0x4580a8
cmp dword [edi + 0x84], ebx
lea esi, [edi + 0x84]
je 0x4580cf
call fcn.0040a488
mov edi, eax
cmp edi, ebx
je 0x4580cf
push str.Starting_waiting_for_automode...
call fcn.0043d98d
mov eax, dword [esi]
pop ecx
imul eax, eax, 0x3e8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4a9450]
cmp esi, ebx
mov dword [ebp - 4], eax
je 0x458079
cmp esi, 0x102
je 0x458072
push esi
lea eax, [ebp - 4]
push str.INFO:_automode_default__d
push eax
call fcn.004069e4
add esp, 0xc
jmp 0x458095
mov esi, str.INFO:_automode_expired_WAIT_TIMEOUT
jmp 0x45807e
mov esi, str.INFO:_automode_disabled_WAIT_OBJECT_0
mov eax, esi
test eax, eax
je 0x45808b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.00406586
push dword [ebp - 4]
call fcn.0043d98d
pop ecx
lea ecx, [ebp - 4]
call fcn.00401085
jmp 0x4580cf
call fcn.0040a4c4
test eax, eax
je 0x4580c4
push str.Signal_for_automode._Exit
call fcn.0043d98d
pop ecx
push 0xc
pop ebx
jmp 0x45844e
push str.Automode_not_found._Continue
call fcn.0043d98d
pop ecx
xor esi, esi
call fcn.0040a0d4
lea ecx, [ebp - 0x48]
call fcn.0045ce8b
push 1
test eax, eax
pop edi
je 0x4580f0
call fcn.0040cab2
test eax, eax
je 0x4580f0
mov esi, edi
lea ecx, [ebp - 0x48]
call fcn.0045ce8f
test eax, eax
je 0x458107
call fcn.0040cded
test eax, eax
je 0x458107
mov esi, edi
lea ecx, [ebp - 0x48]
call fcn.0045cd8c
test eax, eax
je 0x458122
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0040fc75
pop ecx
mov esi, edi
cmp esi, ebx
jne 0x45844e
lea ecx, [ebp - 0x48]
call fcn.0045d0a0
test eax, eax
je 0x45820f
call fcn.0040f87b
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x2710
call fcn.0045002b
pop ecx
test eax, eax
pop ecx
jne 0x45820f
push str.Cannot_wait_event_from_first_instance
lea ecx, [ebp - 4]
call fcn.004064a9
mov esi, 0x4aa048
mov eax, esi
test eax, eax
je 0x458179
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040678b
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0040ca9e
pop ecx
pop ecx
push eax
lea eax, [ebp - 0xc]
push str.Error_Code:
push eax
call fcn.0040673f
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.0040678b
lea ecx, [ebp - 0xc]
call fcn.00401085
lea ecx, [ebp - 0x10]
call fcn.00401085
mov esi, 0x4aa044
mov eax, esi
test eax, eax
je 0x4581d0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040678b
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0044f957
mov eax, dword [eax]
pop ecx
pop ecx
push eax
lea ecx, [ebp - 4]
push dword [eax - 8]
call fcn.0040678b
lea ecx, [ebp - 0xc]
call fcn.00401085
push dword [ebp - 4]
call fcn.0043d497
pop ecx
lea ecx, [ebp - 4]
call fcn.00401085
lea ecx, [ebp - 0x48]
call fcn.0045cb18
test eax, eax
je 0x458222
push ebx
call fcn.0040dcd4
pop ecx
call fcn.00409ffc
test eax, eax
lea ecx, [ebp - 0x48]
je 0x458270
call fcn.004562aa
test eax, eax
je 0x45823e
call fcn.0040d554
jmp 0x458269
lea ecx, [ebp - 0x48]
call fcn.0045cb14
test eax, eax
je 0x458251
call fcn.0040f87b
jmp 0x458269
lea ecx, [ebp - 0x48]
call fcn.0047d582
test eax, eax
je 0x458264
call fcn.0041b51c
jmp 0x458269
call fcn.0040dc7d
mov ebx, edi
jmp 0x45844e
call fcn.0045cb14
test eax, eax
jne 0x458269
call fcn.0040a039
mov esi, eax
cmp esi, ebx
jne 0x458296
push str.Cannot_create_event:_CAppObjects::CreateInstanceEvent_TwinkiePaste_EXE
call fcn.0043d497
pop ecx
push 2
jmp 0x4580be
push edi
push esi
call fcn.0042ef1e
push esi
call fcn.00410f3c
push esi
call fcn.0040daa8
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
call fcn.0044fc49
push dword [ebp + 0x10]
call fcn.0044fd98
add esp, 0x1c
lea ecx, [ebp + 0x10]
call fcn.00401085
push str.TEMP_PREFIX_TEXT
call fcn.0043d96d
mov eax, dword [0x4a9450]
pop ecx
push ebx
lea ecx, [ebp - 0xc8]
mov dword [ebp + 0x10], eax
call fcn.00483a0d
lea ecx, [ebp - 0xc8]
call fcn.00483a77
lea eax, [ebp - 8]
lea ecx, [ebp - 0xc8]
push eax
call fcn.00483d85
lea ecx, [ebp - 0x14]
call fcn.0043ddf1
lea eax, [ebp - 0xc]
push eax
call fcn.00482e51
pop ecx
push dword [eax]
lea eax, [ebp + 0x10]
push dword [ebp - 8]
push str._n_n_nStart_TwinkiePaste__s_on__s
push eax
call fcn.004069e4
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.00401085
push dword [ebp + 0x10]
call fcn.0040a29c
pop ecx
lea ecx, [ebp - 8]
call fcn.00401085
lea ecx, [ebp - 0xc8]
call fcn.0048396d
lea ecx, [ebp + 0x10]
call fcn.00401085
call fcn.0043d984
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 5
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00415cfc
push ebx
mov edi, 0x4c0e48
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp + 0x10], eax
push ebx
call fcn.0045863f
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.0040baea
test eax, eax
jne 0x4583b8
push str.CANNOT_start_TwpWaitingFor
call fcn.0043d497
jmp 0x4583c2
push str.TwpWaitingFor_is_stated_succesfully
call fcn.0043d98d
pop ecx
lea eax, [ebp + 8]
push eax
call fcn.0044fdc0
mov eax, dword [eax]
pop ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.0045cb20
push eax
push esi
call fcn.0045845f
add esp, 0x10
lea ecx, [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00401085
cmp dword [ebp + 0x10], ebx
je 0x4583ff
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push esi
call fcn.0042ef1e
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0045011b
call fcn.0040ea1f
push str.End_Twinkie_Paste
lea ecx, [ebp + 0x10]
call fcn.004064a9
push dword [ebp + 0x10]
call fcn.0040a29c
pop ecx
lea ecx, [ebp + 0x10]
call fcn.00401085
mov ecx, edi
call fcn.00458751
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x48]
call fcn.0045cb09
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10