Function at 0x483130
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5503d8]
push ebx
push esi
push edi
cmp dword [ebp + 0x10], eax
jne 0x4833fb
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x214], eax
lea esi, [eax - 1]
cmp esi, 0xffffffff
je 0x483184
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
nop
push 0x400
push esi
push dword [0x5503d8]
call edi
dec esi
cmp esi, 0xffffffff
jne 0x483170
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x4833fb
xor eax, eax
xor esi, esi
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x224], esi
cmp dword [ebp - 0x214], eax
jbe 0x4833f0
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
xor ebx, ebx
nop dword [eax]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push 5
push dword [ebx + eax]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4833d4
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x210]
push 7
push dword [ebx + eax]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4833c9
mov eax, dword [ebp - 0x220]
cmp word [eax], 0
je 0x4833be
push eax
mov eax, dword [ebp - 0x210]
push dword [ebp - 0x21c]
push dword [ebx + eax]
lea eax, [ebp - 0x20c]
push str._d:__s_s
push eax
call fcn.0042fa30
add esp, 0x14
push str.USERS
push dword [0x54a9b8]
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ecx, dword [ebp - 0x210]
mov esi, eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x1c
push eax
mov dword [ebp - 0x244], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [ebp - 0x240], 0x8000000
mov ecx, dword [ebx + ecx]
push esi
mov dword [ebp - 0x230], ecx
call dword [sym.imp.USER32.dll_SetMenuInfo]
mov eax, dword [ebp - 0x210]
mov eax, dword [ebx + eax + 8]
cmp eax, 4
ja case.0x4832b7.2
jmp dword [eax*4 + 0x483410]
push 1
push 0x9f27
push esi
call edi
push 1
push 0x9eae
push esi
call edi
push 1
push 0x9eaf
jmp 0x48331d
push 1
push 0x9ead
push esi
call edi
push 1
push 0x9eaf
jmp 0x48331d
push 1
push 0x9f27
push esi
call edi
push 1
push 0x9eaf
push esi
call edi
push 1
push 0x9eae
push esi
call edi
push 1
push 0x9ead
push esi
call edi
push 1
push 0x9f28
push esi
call edi
mov ecx, dword [ebp - 0x218]
mov eax, ecx
push 0
push esi
push 0x510
push eax
push dword [0x5503d8]
inc ecx
mov dword [ebp - 0x218], ecx
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x2c
lea eax, [ebp - 0x274]
mov dword [ebp - 0x278], 0x30
push 0
push eax
call fcn.004c53a0
add esp, 0xc
mov dword [ebp - 0x274], 2
lea eax, [ebp - 0x278]
push eax
push 1
push dword [ebp - 0x228]
push dword [0x5503d8]
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x4833a5
mov ecx, dword [0x54af08]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x268]
lea ecx, [ecx + 0x6c]
call fcn.00488220
mov ecx, dword [0x54af08]
add ecx, 0x6c
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.00466720
mov esi, dword [ebp - 0x224]
push dword [ebp - 0x21c]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x220]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x218]
inc esi
add ebx, 0xc
mov dword [ebp - 0x224], esi
cmp esi, dword [ebp - 0x214]
jb 0x4831d0
push dword [ebp - 0x210]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret