Function at 0x1104ed80
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11181727
mov eax, dword fs:[0]
push eax
mov eax, 0x1574
call fcn.11164040
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
test edi, edi
jne 0x1104edd1
push 0x46a6
push 0x1119d450
push 0x1119fbd8
call fcn.11029a70
add esp, 0xc
test esi, esi
jne 0x1104edec
push 0x46a7
push 0x1119d450
push 0x1119fbcc
call fcn.11029a70
add esp, 0xc
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0xc]
push 0
push 0
push 0x1119fbbc
push 0x111a0f40
call fcn.1105e820
test eax, eax
jne 0x1104f3f0
lea ecx, [ebp - 0x1580]
add esi, 2
mov dword [ebp - 0x1524], 0x101
call fcn.110360a0
movzx eax, word [edi + 0x54]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 4], 0
call fcn.11087f50
push 0
push 0x200
lea edx, [ebp - 0xb3c]
push edx
push esi
call fcn.11145b10
push 8
lea eax, [ebp - 0x18]
push eax
push 0x100
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0xb3c]
push edx
call fcn.110881d0
mov eax, esi
add esp, 0x2c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1104ee74
sub eax, ecx
push 0
lea esi, [esi + eax + 1]
push 0x200
lea eax, [ebp - 0x93c]
push eax
push esi
call fcn.11145b10
push 8
lea ecx, [ebp - 0x18]
push ecx
push 0x100
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x93c]
push eax
call fcn.110881d0
mov eax, esi
add esp, 0x24
lea ecx, [eax + 1]
jmp 0x1104eec0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1104eec0
push 0
sub eax, ecx
push 0x20
lea ecx, [ebp - 0x38]
lea eax, [esi + eax + 1]
push ecx
push eax
call fcn.11145b10
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
add esp, 0x10
push 0
call eax
cmp dword [0x111ee0e0], 0x50002
jge 0x1104ef19
lea ecx, [ebp - 0x1524]
push ecx
lea edx, [ebp - 0x53c]
push edx
call dword [sym.imp.aDvapi32.DLL_GetUserNameA]
cmp byte [ebp - 0x53c], 0
setne bl
jmp 0x1104ef2e
mov ecx, dword [0x111ee308]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe0]
call edx
test eax, eax
sete bl
mov ecx, dword [0x111ee308]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe0]
call edx
test eax, eax
je 0x1104ef52
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
dec eax
or eax, 1
mov dword [edi + 0x250], eax
test bl, bl
je 0x1104ef68
push 0x1119fb8c
call fcn.11147060
add esp, 4
jmp 0x1104f3de
xor edi, edi
push edi
push edi
push 6
call fcn.11145c70
add esp, 0xc
test eax, eax
je 0x1104f3af
lea eax, [ebp - 0x151c]
push eax
push edi
mov ebx, 2
push ebx
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.11106e40
mov esi, eax
add esp, 0x18
cmp esi, edi
jne 0x1104f093
lea ecx, [ebp - 0x138]
push ecx
push 0x1119fb70
call fcn.11147060
push 0x200
lea edx, [ebp - 0x73c]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.111434a0
xor ecx, ecx
add esp, 0x14
mov dword [ebp - 0x1344], 7
mov dword [ebp - 0x1348], edi
mov word [ebp - 0x1358], cx
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov edx, dword [edx + 0x68]
lea eax, [ebp - 0x1358]
push eax
lea eax, [ebp - 0x73c]
push eax
mov byte [ebp - 4], 1
call edx
test eax, eax
je 0x1104f07c
cmp dword [ebp - 0x1344], 8
mov eax, dword [ebp - 0x1358]
jae 0x1104f02d
lea eax, [ebp - 0x1358]
push 0x100
lea ecx, [ebp - 0x138]
push ecx
push eax
call fcn.11143480
lea edx, [ebp - 0x151c]
push edx
push edi
push ebx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x138]
push edx
call fcn.11106e40
mov esi, eax
add esp, 0x24
cmp esi, edi
jne 0x1104f07c
lea eax, [ebp - 0x138]
push eax
push 0x1119fb70
call fcn.11147060
add esp, 8
lea ecx, [ebp - 0x1358]
mov byte [ebp - 4], 0
call fcn.1104dda0
cmp esi, edi
je 0x1104f3a0
mov ecx, dword [ebp - 0x151c]
push ecx
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
mov byte [ebp - 0x150d], 0
mov byte [ebp - 0x150e], 0
mov edi, edi
mov esi, 0x1119fb34
test edi, edi
je 0x1104f0be
mov esi, 0x1119fafc
lea ecx, [ebp - 0x1514]
call fcn.110ed130
push 0x20019
push esi
push reloc.wsOcK32.dll_bind
lea ecx, [ebp - 0x1514]
mov byte [ebp - 4], bl
call fcn.110ed520
test eax, eax
jne 0x1104f145
lea edx, [ebp - 0x1520]
push edx
lea eax, [ebp - 0x438]
push eax
mov esi, 0x100
push 0x1119fae8
lea ecx, [ebp - 0x1514]
mov dword [ebp - 0x1520], esi
call fcn.110ed720
lea ecx, [ebp - 0x1528]
push ecx
lea edx, [ebp - 0x338]
push edx
push 0x1119fad8
lea ecx, [ebp - 0x1514]
mov dword [ebp - 0x1528], esi
call fcn.110ed720
cmp byte [ebp - 0x338], 0
jne 0x1104f15f
cmp byte [ebp - 0x438], 0
jne 0x1104f15f
lea ecx, [ebp - 0x1514]
mov byte [ebp - 4], 0
call fcn.110edb10
inc edi
cmp edi, ebx
jl 0x1104f0b0
jmp 0x1104f1a6
lea ecx, [ebp - 0x1514]
mov byte [ebp - 0x150d], 1
mov byte [ebp - 4], 0
call fcn.110edb10
xor esi, esi
jmp 0x1104f180
lea ecx, [ebp - 0x1580]
call fcn.11034c90
test eax, eax
jne 0x1104f19f
push 0x32
call dword [sym.imp.KeRneL32.DLl_Sleep]
inc esi
cmp esi, 0xa
jl 0x1104f180
jmp 0x1104f1a6
mov byte [ebp - 0x150e], 1
xor bl, bl
xor edi, edi
lea ebx, [ebx]
lea ecx, [ebp - 0x150c]
call fcn.1109dd30
push 0x1119fac0
lea ecx, [ebp - 0x150c]
mov byte [ebp - 4], 3
call fcn.1109df10
test eax, eax
jne 0x1104f213
lea ecx, [ebp - 0x150c]
call fcn.1109dd20
push eax
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push edi
push 0x1119fa90
call fcn.11147060
add esp, 0x10
test bl, bl
jne 0x1104f33b
mov ecx, dword [0x111ee308]
mov eax, dword [ecx]
mov edx, dword [eax + 0xa0]
call edx
mov bl, 1
jmp 0x1104f33b
push 0x100
lea eax, [ebp - 0x133c]
push eax
lea ecx, [ebp - 0x138]
push ecx
call fcn.111434a0
lea esi, [ebp + eax*2 - 0x133a]
push 0x100
lea edx, [ebp - 0x238]
push esi
push edx
call fcn.111434a0
lea esi, [esi + eax*2 + 2]
push 0x100
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.111434a0
lea eax, [esi + eax*2 + 2]
lea ecx, [ebp - 0x133c]
sub eax, ecx
sar eax, 1
add eax, eax
add esp, 0x24
mov dword [ebp - 0x1530], eax
lea eax, [ebp - 0x1534]
push eax
mov edx, ecx
push 0
push 0x4a
lea ecx, [ebp - 0x150c]
mov dword [ebp - 0x1534], 0x400
mov dword [ebp - 0x152c], edx
call fcn.1109ecc0
mov esi, eax
mov ecx, 0x800
lea eax, [ebp - 0x133c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1104f2a5
lea ecx, [ebp - 0x150c]
call fcn.1109dd20
push eax
push esi
push 0x1119fa5c
call fcn.11147060
add esp, 0xc
test esi, esi
je 0x1104f35e
push edi
push 0x1119fa18
call fcn.11147060
add esp, 8
test bl, bl
jne 0x1104f33b
push 0x1119fa08
call fcn.11147060
add esp, 4
lea ecx, [ebp - 0x1518]
call fcn.110aa150
lea ecx, [ebp - 0x1518]
mov byte [ebp - 4], 4
call fcn.110aa170
test al, al
je 0x1104f31a
lea ecx, [ebp - 0x1518]
call fcn.110aa480
test al, al
jne 0x1104f32a
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0xa0]
call eax
lea ecx, [ebp - 0x1518]
mov bl, 1
mov byte [ebp - 4], 3
call fcn.110aa160
push 0x32
call dword [sym.imp.KeRneL32.DLl_Sleep]
lea ecx, [ebp - 0x150c]
mov byte [ebp - 4], 0
call fcn.1109dd40
inc edi
cmp edi, 0x14
jl 0x1104f1b0
jmp 0x1104f3cc
cmp byte [ebp - 0x150d], 0
je 0x1104f38f
cmp byte [ebp - 0x150e], 0
jne 0x1104f38f
xor esi, esi
lea ecx, [ebp - 0x1580]
call fcn.11034c90
test eax, eax
jne 0x1104f38f
push 0x32
call dword [sym.imp.KeRneL32.DLl_Sleep]
inc esi
cmp esi, 0xa
jl 0x1104f372
lea ecx, [ebp - 0x150c]
mov byte [ebp - 4], 0
call fcn.1109dd40
jmp 0x1104f3cc
push 0x1119f9f0
call fcn.11147060
add esp, 4
jmp 0x1104f3cc
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x1580]
call fcn.110365c0
mov ecx, 0x100
lea eax, [ebp - 0x238]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1104f3d7
lea ecx, [ebp - 0x1580]
mov dword [ebp - 4], 0xffffffff
call fcn.110361c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret