Function at 0x436125
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push esi
xor esi, esi
push 0x4bc550
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
call fcn.00403927
mov eax, dword [0x4c6a74]
cmp eax, esi
je 0x436164
cmp dword [0x4c3008], esi
je 0x436164
push eax
lea eax, [ebp - 0x18]
push 0x4b3f78
push eax
call fcn.00403d66
add esp, 0xc
mov eax, dword [0x4c2bfc]
cmp dword [eax - 8], esi
jne 0x4361cb
mov eax, dword [0x4bc51c]
push edi
mov dword [ebp - 0x824], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x820]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x824]
pop edi
test eax, eax
je 0x4361b9
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x824]
push ecx
push eax
mov ecx, 0x4c2bfc
call fcn.004039ec
cmp dword [0x4c55c8], esi
push ebx
je 0x4361e6
push 1
lea eax, [ebp - 0x14]
pop ebx
push 0x27
push eax
call fcn.00461337
pop ecx
pop ecx
jmp 0x4361f6
push 2
lea ecx, [ebp - 8]
pop ebx
push 0x4bc518
call fcn.0040a529
mov ecx, dword [eax]
cmp dword [ecx - 0xc], esi
jl 0x43620c
mov dword [ebp - 0xc], ecx
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43621f
mov ecx, dword [0x4af550]
mov dword [ebp - 0xc], ecx
push dword [eax]
lea ecx, [ebp - 0xc]
call fcn.0040a750
test bl, 2
je 0x43622f
lea ecx, [ebp - 8]
and ebx, 0xfffffffd
call fcn.004038fb
test bl, 1
pop ebx
je 0x43623d
lea ecx, [ebp - 0x14]
call fcn.004038fb
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], 3
jle 0x436262
mov esi, 0x4b3f74
mov eax, esi
test eax, eax
je 0x436258
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.00403bd8
mov esi, str.Unicode
mov eax, esi
test eax, eax
je 0x436274
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.00403bd8
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], 2
jle 0x4362f3
push 0x4b0e10
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4c55b0
lea eax, [ebp - 0x10]
push 0x4b3f5c
push eax
call fcn.0040a9a2
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
mov eax, dword [eax]
mov ecx, 0x4c2bfc
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push 0x4afdf8
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push 0x4c5708
push eax
lea eax, [ebp - 0x14]
push 0x4c5710
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
mov esi, 0x4c2c58
push eax
mov ecx, esi
call fcn.00403a8c
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push esi
lea ecx, [ebp - 0x24]
call fcn.004038b5
push 0x4bc550
lea ecx, [ebp - 0x1c]
call fcn.00403927
call fcn.004081b4
test eax, eax
pop esi
je 0x43639d
push str.___Admin
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040aa48
lea ecx, [ebp - 8]
call fcn.004038fb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
leave
ret