Function at 0x4a33c3
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0xc], 0
mov eax, edx
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 8], ecx
cmp word [0x501a10], bx
jne 0x4a367a
lea eax, [ebp - 0xc]
mov edi, 0x200
push eax
push 0x501610
push 8
mov dword [ebp - 0xc], edi
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x4a345a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
je 0x4a345a
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a345a
test byte [eax + 0x1c], 1
je 0x4a345a
cmp byte [eax + 0x19], 2
jb 0x4a345a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x417630
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x69
pop ecx
call fcn.00421fda
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push 0x501a10
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
movzx edi, al
test al, al
jne 0x4a34c5
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a36dd
test byte [eax + 0x1c], 1
je 0x4a36dd
cmp byte [eax + 0x19], 2
jb 0x4a36dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x417630
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6a
pop ecx
call fcn.00421fda
jmp 0x4a36dd
lea eax, [ebp - 0x14]
push eax
call fcn.004a3706
mov esi, eax
test esi, esi
jns 0x4a351b
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x4a350d
test byte [ecx + 0x1c], 1
je 0x4a350d
cmp byte [ecx + 0x19], 2
jb 0x4a350d
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6b
mov edx, 0x417630
pop ecx
call fcn.00421fda
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x4a36dd
cmp dword [0x50160c], ebx
je 0x4a3674
call fcn.00490f02
test eax, eax
je 0x4a3674
push 0
push 0
push 0x417570
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x4a358c
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x4a3514
test byte [ecx + 0x1c], 1
je 0x4a3514
cmp byte [ecx + 0x19], 2
jb 0x4a3514
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6c
mov edx, 0x417630
pop ecx
call fcn.00421fda
jmp 0x4a3514
push 0x417588
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x4a35e0
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a3514
test byte [eax + 0x1c], 1
je 0x4a3514
cmp byte [eax + 0x19], 2
jb 0x4a3514
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6d
jmp 0x4a357f
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push 0x18
push dword [ebp - 0x14]
push 0
call dword [0x5035f0]
call esi
test eax, eax
jne 0x4a3674
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x4a3674
and dword [0x50160c], 0
push dword [eax + 0xc]
mov dword [0x501608], 1
push dword [eax + 8]
push 0x409520
push 0x200
push 0x501a10
call fcn.0041f7a9
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x4a3674
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x4a350d
test byte [ecx + 0x1c], 1
je 0x4a350d
cmp byte [ecx + 0x19], 2
jb 0x4a350d
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6e
jmp 0x4a3502
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp word [0x501610], 0
mov edx, eax
je 0x4a368d
push 0x501610
jmp 0x4a3692
push 0x501a10
call fcn.0041f6cc
mov esi, eax
test esi, esi
jns 0x4a36da
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a350d
test byte [eax + 0x1c], 1
je 0x4a350d
cmp byte [eax + 0x19], 2
jb 0x4a350d
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6f
jmp 0x4a3502
xor edi, edi
inc edi
cmp dword [ebp - 0x10], 0
je 0x4a36ec
push dword [ebp - 0x10]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test ebx, ebx
je 0x4a36f7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc