Function at 0x436172
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push esi
xor esi, esi
push 0x4bd614
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
call fcn.00403927
mov eax, dword [0x4c7b5c]
cmp eax, esi
je 0x4361b1
cmp dword [0x4c40d0], esi
je 0x4361b1
push eax
lea eax, [ebp - 0x18]
push 0x4b4f98
push eax
call fcn.00403d66
add esp, 0xc
mov eax, dword [0x4c3cc4]
cmp dword [eax - 8], esi
jne 0x436218
mov eax, dword [0x4bd5dc]
push edi
mov dword [ebp - 0x824], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x820]
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x824]
pop edi
test eax, eax
je 0x436206
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x824]
push ecx
push eax
mov ecx, 0x4c3cc4
call fcn.004039ec
cmp dword [0x4c6690], esi
push ebx
je 0x436233
push 1
lea eax, [ebp - 0x14]
pop ebx
push 0x27
push eax
call fcn.00461770
pop ecx
pop ecx
jmp 0x436243
push 2
lea ecx, [ebp - 8]
pop ebx
push 0x4bd5d8
call fcn.0040a4e8
mov ecx, dword [eax]
cmp dword [ecx - 0xc], esi
jl 0x436259
mov dword [ebp - 0xc], ecx
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43626c
mov ecx, dword [0x4b0550]
mov dword [ebp - 0xc], ecx
push dword [eax]
lea ecx, [ebp - 0xc]
call fcn.0040a70f
test bl, 2
je 0x43627c
lea ecx, [ebp - 8]
and ebx, 0xfffffffd
call fcn.004038fb
test bl, 1
pop ebx
je 0x43628a
lea ecx, [ebp - 0x14]
call fcn.004038fb
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], 3
jle 0x4362af
mov esi, 0x4b4f94
mov eax, esi
test eax, eax
je 0x4362a5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.00403bd8
mov esi, str.Unicode
mov eax, esi
test eax, eax
je 0x4362c1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0xc]
call fcn.00403bd8
mov eax, dword [ebp - 0xc]
cmp dword [eax - 8], 2
jle 0x436340
push 0x4b1e10
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4c6678
lea eax, [ebp - 0x10]
push 0x4b4f7c
push eax
call fcn.0040a961
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403b20
mov eax, dword [eax]
mov ecx, 0x4c3cc4
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push 0x4b0df8
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push 0x4c67d0
push eax
lea eax, [ebp - 0x14]
push 0x4c67d8
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403b20
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
mov esi, 0x4c3d20
push eax
mov ecx, esi
call fcn.00403a8c
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x20]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
push esi
lea ecx, [ebp - 0x24]
call fcn.004038b5
push 0x4bd614
lea ecx, [ebp - 0x1c]
call fcn.00403927
call fcn.00408173
test eax, eax
pop esi
je 0x4363ea
push str.___Admin
lea ecx, [ebp - 8]
call fcn.00403927
lea eax, [ebp - 8]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0040aa07
lea ecx, [ebp - 8]
call fcn.004038fb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403b20
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x10]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 0x24]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
leave
ret