Function at 0x482f20
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x556408]
push ebx
push esi
push edi
cmp dword [ebp + 0x10], eax
jne 0x4831eb
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x214], eax
lea esi, [eax - 1]
cmp esi, 0xffffffff
je 0x482f74
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
nop
push 0x400
push esi
push dword [0x556408]
call edi
dec esi
cmp esi, 0xffffffff
jne 0x482f60
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x4831eb
xor eax, eax
xor esi, esi
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x224], esi
cmp dword [ebp - 0x214], eax
jbe 0x4831e0
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
xor ebx, ebx
nop dword [eax]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push 5
push dword [ebx + eax]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4831c4
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x210]
push 7
push dword [ebx + eax]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4831b9
mov eax, dword [ebp - 0x220]
cmp word [eax], 0
je 0x4831ae
push eax
mov eax, dword [ebp - 0x210]
push dword [ebp - 0x21c]
push dword [ebx + eax]
lea eax, [ebp - 0x20c]
push 0x51120c
push eax
call fcn.0042fa90
add esp, 0x14
push 0x511220
push dword [0x5509e8]
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ecx, dword [ebp - 0x210]
mov esi, eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x1c
push eax
mov dword [ebp - 0x244], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [ebp - 0x240], 0x8000000
mov ecx, dword [ebx + ecx]
push esi
mov dword [ebp - 0x230], ecx
call dword [sym.imp.USER32.dll_SetMenuInfo]
mov eax, dword [ebp - 0x210]
mov eax, dword [ebx + eax + 8]
cmp eax, 4
ja case.0x4830a7.2
jmp dword [eax*4 + 0x483200]
push 1
push 0x9f27
push esi
call edi
push 1
push 0x9eae
push esi
call edi
push 1
push 0x9eaf
jmp 0x48310d
push 1
push 0x9ead
push esi
call edi
push 1
push 0x9eaf
jmp 0x48310d
push 1
push 0x9f27
push esi
call edi
push 1
push 0x9eaf
push esi
call edi
push 1
push 0x9eae
push esi
call edi
push 1
push 0x9ead
push esi
call edi
push 1
push 0x9f28
push esi
call edi
mov ecx, dword [ebp - 0x218]
mov eax, ecx
push 0
push esi
push 0x510
push eax
push dword [0x556408]
inc ecx
mov dword [ebp - 0x218], ecx
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x2c
lea eax, [ebp - 0x274]
mov dword [ebp - 0x278], 0x30
push 0
push eax
call fcn.004c52c0
add esp, 0xc
mov dword [ebp - 0x274], 2
lea eax, [ebp - 0x278]
push eax
push 1
push dword [ebp - 0x228]
push dword [0x556408]
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x483195
mov ecx, dword [0x550f38]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x268]
lea ecx, [ecx + 0x6c]
call fcn.00488020
mov ecx, dword [0x550f38]
add ecx, 0x6c
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.00466cb0
mov esi, dword [ebp - 0x224]
push dword [ebp - 0x21c]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x220]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x218]
inc esi
add ebx, 0xc
mov dword [ebp - 0x224], esi
cmp esi, dword [ebp - 0x214]
jb 0x482fc0
push dword [ebp - 0x210]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret