Function at 0x4f35a0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x930
push ebx
push esi
mov esi, dword [esp + 0x93c]
push edi
push ebp
test esi, esi
jne 0x4f35be
mov ax, 0x10
jmp 0x4f3a7f
mov eax, dword [0x4ebd38]
mov ecx, dword [esi + 0x54]
push eax
push ecx
call fcn.004f2b60
add esp, 8
mov ebp, eax
test ebp, ebp
jne 0x4f35df
mov ax, 2
jmp 0x4f3a7f
cmp word [ebp + 0x44], 0
jne 0x4f35ef
mov ax, 0x47
jmp 0x4f3a7f
xor ebx, ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x64], bl
mov byte [esp + 0xf0], bl
lea edi, [esp + 0x300]
mov byte [esp + 0x70], bl
xor eax, eax
mov ecx, 0x64
mov byte [esp + 0x130], bl
mov byte [esp + 0xb0], bl
mov byte [esp + 0x44], bl
rep stosd dword es:[edi], eax
lea edi, [esp + 0x490]
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea edi, [esp + 0x170]
mov ecx, 0x64
rep stosd dword es:[edi], eax
xor ecx, ecx
movsx eax, word [ebp + 0x5a]
mov cx, word [ebp + eax*2 + 0x46]
lea eax, [esp + 0x20]
push ecx
push 0x4e9240
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x44]
add esp, 0xc
xor eax, eax
mov ax, word [ebp + 0x42]
push eax
push 0x4e9240
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x20]
add esp, 0xc
xor eax, eax
mov ax, word [ebp + 0x44]
push eax
push 0x4e9240
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0xfc]
add esp, 0xc
mov dword [ebp + 0x5c], ebx
push 0x40
mov word [ebp + 0x44], bx
push ecx
push esi
call fcn.004f1b60
test ax, ax
jne 0x4f3a7f
lea eax, [esp + 0xb0]
push 0x40
push eax
call fcn.004f5c10
add esp, 8
test eax, eax
jne 0x4f36f7
lea eax, [esp + 0x44]
push 0
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.004f89c0
add esp, 0xc
test eax, eax
je 0x4f36f7
mov byte [esp + 0x44], 0
cmp byte [esp + 0x44], 0
jne 0x4f3732
lea eax, [esp + 0x44]
push 0x40
push eax
call fcn.004f8e80
add esp, 8
test eax, eax
je 0x4f3732
mov bx, word [0x4e9248]
mov eax, dword [0x4e9244]
mov ecx, 0x4e9244
lea edx, [esp + 0x44]
mov cl, byte [ecx + 6]
mov dword [edx], eax
mov word [edx + 4], bx
mov byte [edx + 6], cl
lea eax, [esp + 0xf0]
push 0x4e920c
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4f377f
mov eax, dword [0x4e920c]
mov ebx, dword [0x4e9210]
lea ecx, [esp + 0xb0]
mov esi, dword [0x4e9214]
mov edx, 0x4e920c
mov dword [ecx], eax
mov ax, word [edx + 0xc]
mov dword [ecx + 4], ebx
mov dl, byte [edx + 0xe]
mov dword [ecx + 8], esi
mov word [ecx + 0xc], ax
mov byte [ecx + 0xe], dl
lea eax, [esp + 0x10]
lea ecx, [esp + 0x70]
mov dword [esp + 0x10], 0x40
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x4f37e2
lea eax, [esp + 0x130]
push 0x40
lea ecx, [esp + 0x74]
push eax
push ecx
call fcn.004f9c90
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f37e2
lea edi, [esp + 0x130]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f3803
mov bx, word [0x4e9248]
mov eax, dword [0x4e9244]
mov ecx, 0x4e9244
lea edx, [esp + 0x70]
mov cl, byte [ecx + 6]
mov dword [edx], eax
mov word [edx + 4], bx
mov byte [edx + 6], cl
mov eax, dword [ebp + 0x6c]
lea ecx, [esp + 0x2c]
push eax
push 0x4e9240
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x50]
lea edx, [esp + 0xbc]
lea eax, [esp + 0x7c]
add esp, 0xc
push ecx
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
push 7
push 0x4e923c
call fcn.004f97e0
add esp, 0x24
mov edx, eax
test edx, edx
jne 0x4f385d
push ebp
push 0x4a
jmp 0x4f3a77
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x490]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_free]
lea ecx, [esp + 0x68]
lea eax, [esp + 0x494]
add esp, 4
push ecx
push eax
push 0x4e92bc
push 3
push 0x4e91fc
call fcn.004f97e0
add esp, 0x14
mov edx, eax
test edx, edx
jne 0x4f38bc
push ebp
push 0x4a
jmp 0x4f3a77
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x170]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_free]
lea ecx, [esp + 0x174]
add esp, 4
push ecx
call fcn.004f98e0
add esp, 4
mov edx, eax
test edx, edx
jne 0x4f390a
push ebp
push 0x4a
jmp 0x4f3a77
mov edi, edx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x170]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_free]
lea ecx, [esp + 0x304]
lea eax, [esp + 0x174]
add esp, 4
push ecx
push ebp
push eax
call fcn.004f6b50
add esp, 0xc
test ax, ax
je 0x4f3964
push ebp
push eax
call fcn.004f2940
jmp 0x4f3a7c
lea eax, [esp + 0x300]
push eax
call fcn.004f95b0
add esp, 4
mov esi, eax
test esi, esi
jne 0x4f3982
push ebp
push 0x42
jmp 0x4f3a77
lea eax, [esp + 0x300]
lea ecx, [esp + 0x7b0]
lea edx, [esp + 0x620]
push eax
push ecx
push edx
push esi
push 3
push 0x4e91fc
call fcn.004f93d0
mov bx, ax
add esp, 0x18
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
test bx, bx
je 0x4f39c4
push ebp
push 0x42
jmp 0x4f3a77
lea esi, [esp + 0x620]
mov edi, 0x4e9224
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
jne 0x4f39f7
lea eax, [esp + 0x7b0]
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
push eax
call esi
mov bx, ax
add esp, 4
cmp bx, 0x46
je 0x4f39fd
jmp 0x4f3a75
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x300]
push eax
push ecx
push edx
push 2
push 0x4e923c
call fcn.004f93d0
add esp, 0x14
test eax, eax
je 0x4f3a27
push ebp
push 0x42
jmp 0x4f3a77
movsx edi, word [ebp + 0x5a]
cmp edi, 9
jge 0x4f3a37
inc edi
mov word [ebp + 0x5a], di
jmp 0x4f3a3f
mov word [ebp + 0x5a], 0
xor edi, edi
lea eax, [esp + 0x14]
push eax
call esi
mov word [ebp + 0x44], ax
lea eax, [esp + 0x24]
add esp, 4
push eax
call esi
mov word [ebp + edi*2 + 0x46], ax
add esp, 4
test bx, bx
jne 0x4f3a75
lea eax, [ebp + 0x64]
push eax
call dword [sym.imp.MSVCRT.dll_time]
mov dword [ebp + 0x68], 0x78
add esp, 4
push ebp
push ebx
call fcn.004f2a00
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x930
ret 4