Function at 0x4db9d4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff24
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc05a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x4dba76
mov dl, 1
mov eax, dword [0x470dd8]
call fcn.00470f08
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.00470fa0
mov edx, 0x4dc074
mov eax, esi
call fcn.0047112c
test al, al
je 0x4dba6f
mov edx, 0x4dc0a0
mov eax, esi
call fcn.004715ac
test al, al
je 0x4dba6f
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc0a0
mov eax, esi
call fcn.004713ac
mov eax, dword [ebp - 0xcc]
mov edx, 0x4dc0c4
call fcn.00403f78
setne byte [ebp + 8]
mov eax, esi
call fcn.00403090
cmp edi, 0xffffffff
je 0x4dba93
mov edx, edi
mov eax, dword [ebx + 4]
call fcn.004dab34
test al, al
jne 0x4dba93
mov ebx, 0xb
jmp 0x4dc029
mov ecx, 0x4dc0d0
xor edx, edx
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov esi, eax
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0xd0]
mov edx, 0x4dc0e4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x114]
test al, al
jne 0x4dbad9
mov ebx, 1
mov eax, esi
call fcn.00403090
jmp 0x4dc029
mov edx, 0x4dc0f4
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x58]
fstp qword [ebx + 0x20]
wait
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc104
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xcc]
call fcn.0040810c
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x40
call fcn.00402d2c
lea eax, [ebp - 0x9c]
xor ecx, ecx
mov edx, 0x40
call fcn.00402d2c
push 0x40
lea ecx, [ebp - 0x5c]
mov edx, 0x4dc110
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x1b4]
push 0x40
lea ecx, [ebp - 0x9c]
mov edx, 0x4dc120
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x1b4]
lea edx, [ebp - 0x9c]
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp + 0xc]
call fcn.00449258
test al, al
jne 0x4dbb8d
cmp dword [ebx + 0x10], 0
jne 0x4dbb7c
mov eax, dword [ebp + 0xc]
call fcn.00449380
test al, al
jne 0x4dbb8d
mov ebx, 2
mov eax, esi
call fcn.00403090
jmp 0x4dc029
lea ecx, [ebp - 0x14]
mov edx, 0x4dc0f4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
cmp dword [ebp - 0x14], 0
je 0x4dbbdf
call fcn.004098d4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xcc]
mov eax, 0x4dc134
call fcn.0040a508
mov eax, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x14]
call fcn.00403f78
jbe 0x4dbbdf
mov ebx, 3
mov eax, esi
call fcn.00403090
jmp 0x4dc029
lea ecx, [ebp - 0x18]
mov edx, 0x4dc148
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov dword [ebp - 0x1c], 0x29
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc5]
push eax
call sub.advapi32.dll_GetUserNameA
cmp dword [ebp - 0x18], 0
je 0x4dbc3f
lea edx, [ebp - 0xcc]
lea eax, [ebp - 0xc5]
call fcn.00408bc0
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x18]
call fcn.00407e1c
test eax, eax
je 0x4dbc3f
mov ebx, 4
mov eax, esi
call fcn.00403090
jmp 0x4dc029
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc15c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0xcc]
lea eax, [ebx + 0x18]
call fcn.00403c40
mov edx, 0x4dc170
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov dword [ebx + 0x1c], eax
mov eax, esi
call fcn.00403090
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4dbc94
dec eax
je 0x4dbc94
mov eax, ebx
call fcn.004db6f4
test eax, eax
je 0x4dbc94
mov ebx, 0xd
jmp 0x4dc029
cmp byte [ebp + 8], 0
je 0x4dbcbb
cmp dword [ebx + 0x10], 0
je 0x4dbcbb
cmp dword [ebx + 0x10], 1
je 0x4dbcbb
mov eax, ebx
call fcn.004db858
test al, al
je 0x4dbcbb
mov ebx, 5
jmp 0x4dc029
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4dc027
dec eax
je 0x4dc027
mov ecx, 0x4dc184
xor edx, edx
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov esi, eax
push 1
lea edx, [ebp - 0xcc]
mov eax, dword [ebx + 0xc]
call fcn.004080dc
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd8], eax
lea edx, [ebp - 0xdc]
mov eax, dword [ebx + 0x10]
call fcn.004080dc
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xd4], eax
lea ecx, [ebp - 0xd8]
mov edx, 0x4dc198
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x114]
test al, al
jne 0x4dbe6c
mov dword [ebx + 0x14], 0xffffffff
mov ecx, 0x4dc1a4
xor edx, edx
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 0x14]
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 0xcc]
mov eax, dword [ebx + 0x10]
call fcn.004080dc
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0xd0]
mov edx, 0x4dc104
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x114]
jmp 0x4dbe3d
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc104
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xcc]
push eax
lea edx, [ebp - 0xdc]
mov eax, dword [ebx + 0x10]
call fcn.004080dc
mov edx, dword [ebp - 0xdc]
pop eax
call fcn.00403f78
jne 0x4dbe4d
push 1
lea edx, [ebp - 0xcc]
mov eax, dword [ebx + 0xc]
call fcn.004080dc
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0xdc]
mov edx, 0x4dc1bc
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xd4], eax
lea ecx, [ebp - 0xd8]
mov edx, 0x4dc198
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x114]
test al, al
je 0x4dbe32
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc1bc
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xcc]
call fcn.0040810c
mov dword [ebx + 0x14], eax
jmp 0x4dbe4d
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x12c]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 8]
test al, al
je 0x4dbd81
mov eax, dword [ebp - 8]
call fcn.00403090
cmp dword [ebx + 0x14], 0xffffffff
jne 0x4dbe72
mov ebx, 6
mov eax, esi
call fcn.00403090
jmp 0x4dc029
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x14], eax
mov ecx, 0x4dc1c8
xor edx, edx
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, 0x4dc1dc
xor edx, edx
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 0x14]
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0xcc]
mov eax, dword [ebx + 0xc]
call fcn.004080dc
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0xd0]
mov edx, 0x4dc198
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0x114]
jmp 0x4dc000
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc198
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xcc]
push eax
lea edx, [ebp - 0xdc]
mov eax, dword [ebx + 0xc]
call fcn.004080dc
mov edx, dword [ebp - 0xdc]
pop eax
call fcn.00403f78
jne 0x4dc010
push 0
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc1f0
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0xd0]
mov edx, 0x4dc1f0
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x114]
test al, al
je 0x4dbff5
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc1fc
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [ebp - 0xcc]
call fcn.0040810c
test eax, 0x10000000
je 0x4dbfaa
lea ecx, [ebp - 0xcc]
mov edx, 0x4dc20c
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x30]
mov edx, dword [ebp - 0xcc]
lea eax, [ebx + 0x28]
call fcn.00403c40
mov ebx, 7
mov eax, esi
call fcn.00403090
mov eax, dword [ebp - 0xc]
call fcn.00403090
mov eax, dword [ebp - 0x10]
call fcn.00403090
jmp 0x4dc029
mov edx, 0x4dc1fc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
test ah, 0xf
jne 0x4dbff5
mov edx, 0x4dc1f0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, eax
mov eax, dword [ebx + 4]
call fcn.004da740
test eax, eax
jle 0x4dbff5
mov ebx, 0xc
mov eax, esi
call fcn.00403090
mov eax, dword [ebp - 0xc]
call fcn.00403090
mov eax, dword [ebp - 0x10]
call fcn.00403090
jmp 0x4dc029
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x12c]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 8]
test al, al
je 0x4dbecd
mov eax, dword [ebp - 0x10]
call fcn.00403090
mov eax, dword [ebp - 0xc]
call fcn.00403090
mov eax, esi
call fcn.00403090
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc061
lea eax, [ebp - 0xdc]
call fcn.00403bec
lea eax, [ebp - 0xcc]
call fcn.00403bec
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403c10
ret