Function at 0x41eb3c
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov ebx, edx
mov edi, ecx
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x41ec5a
mov ecx, edi
call fcn.0041bcfd
test eax, eax
je 0x41ec5a
cmp dword [ebp + 0x14], 1
jne 0x41eba0
test ebx, ebx
je 0x41eb84
cmp dword [ebp + 8], 2
jb 0x41eb84
cmp dword [ebp + 0xc], 0
je 0x41eb84
cmp dword [ebp + 0x10], 2
jae 0x41eba0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x41eb96
push 0x57
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
call fcn.0041afe7
jmp 0x41eca0
mov ecx, edi
mov esi, edi
call fcn.0041e3bc
cmp eax, 1
jne 0x41ebb1
lea esi, [edi + 4]
cmp dword [ebp + 0x14], 1
jne 0x41ebe3
cmp dword [ebp + 0xc], 0
je 0x41ebe3
mov ecx, dword [ebp + 0xc]
mov edx, 0x40229c
push 0
push 1
call fcn.0041bd0c
test eax, eax
jne 0x41ebe3
mov ecx, esi
call fcn.0041e55b
test eax, eax
jne 0x41ecca
jmp 0x41eb96
xor eax, eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0041e55b
test eax, eax
je 0x41eb96
test ebx, ebx
je 0x41ec26
push ebx
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
test eax, eax
je 0x41ec26
mov eax, dword [ebp + 0x14]
mov edx, ebx
neg eax
push ecx
sbb eax, eax
mov ecx, edi
not eax
and eax, dword [ebp + 0xc]
push eax
call fcn.0041e8fb
cmp dword [ebp + 0x14], 1
mov esi, eax
jne 0x41ec3a
xor eax, eax
inc eax
jmp 0x41ec3d
xor eax, eax
xor edx, edx
push ecx
inc eax
mov ecx, edi
push 0
mov dword [ebp - 4], eax
call fcn.0041e8fb
mov esi, eax
mov eax, dword [ebp - 4]
cmp esi, 0x55
je 0x41ec4b
test esi, esi
jne 0x41ec64
cmp eax, 1
jne 0x41ec52
push 0x50010001
jmp 0x41ec54
push 0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, 0x4c3
cmp esi, eax
ja 0x41eca4
je 0x41ed87
cmp esi, 0x34
je 0x41ec89
cmp esi, 0x56
je 0x41ecc4
cmp esi, 0x4be
jne 0x41eb96
push 0x4c6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
call fcn.0041afe7
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x41ec5d
cmp esi, 0x4cf
jb 0x41eb96
cmp esi, 0x4d1
jbe 0x41ec89
cmp esi, 0x52e
jne 0x41ed63
cmp dword [ebp + 0x14], 0
je 0x41eca0
push ebx
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
test eax, eax
jne 0x41ecea
lea eax, [ebp + 8]
push eax
push ebx
push 2
call dword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
je 0x41eb96
push ebx
mov ecx, 0x157d
call fcn.0041b2d7
push eax
push 1
push 1
push 1
call fcn.004208bb
pop ecx
push eax
call fcn.0041bfde
mov edx, dword [ebp + 0x10]
add esp, 0x14
mov ecx, dword [ebp + 0xc]
call fcn.0041c1f3
push ecx
push dword [ebp + 0xc]
mov edx, ebx
mov ecx, edi
call fcn.0041e8fb
mov esi, eax
test esi, esi
je 0x41ec5a
cmp esi, 0x34
je 0x41ec89
cmp esi, 0x4be
je 0x41ec89
mov eax, 0x4c3
cmp esi, eax
je 0x41ed87
cmp esi, 0x4ce
jbe 0x41eb96
cmp esi, 0x4d1
jbe 0x41ec89
mov edi, 0xa0010001
cmp esi, edi
jne 0x41eb96
mov ecx, 0x157e
call fcn.0041b2d7
mov ecx, eax
call fcn.0041aeff
push edi
jmp 0x41ec54
push eax
jmp 0x41ec54