Function at 0x47efb0
Capabilities:
Get session user name
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x64
sub esp, 0xc6c
xor eax, eax
push ebx
xor ebx, ebx
push ebp
push esi
push edi
lea edi, [esp + 0x31c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x18c]
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea edi, [esp + 0x95c]
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10c]
push 0x40
push eax
mov byte [esp + 0x20], bl
mov byte [esp + 0x9c], bl
mov byte [esp + 0x154], bl
mov byte [esp + 0x114], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x7c], bl
mov byte [esp + 0x64], bl
call fcn.0047bb60
add esp, 8
test eax, eax
jne 0x47f043
lea ecx, [esp + 0x3c]
push ebx
lea edx, [esp + 0x110]
push ecx
push edx
call fcn.0047b040
add esp, 0xc
test eax, eax
je 0x47f043
mov byte [esp + 0x3c], bl
jmp 0x47f049
cmp byte [esp + 0x3c], bl
jne 0x47f07b
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.0047b4c0
sub esp, 0xfffffff8
or eax, eax
je 0x47f07b
mov dx, word [0x4eb214]
mov ecx, dword [str.NoName]
mov al, byte [0x4eb216]
mov dword [esp + 0x3c], ecx
mov word [esp + 0x40], dx
mov byte [esp + 0x42], al
mov ecx, dword [esp + 0xc88]
push str.RNBO_SPN_LOCAL
push ecx
call fcn.004b1f1c
add esp, 8
test eax, eax
jne 0x47f0d5
mov eax, dword [0x4ea2a4]
mov edx, dword [0x4ea2a8]
mov ecx, dword [str.RNBO_SPN_LOCAL]
mov dword [esp + 0x10c], ecx
mov cx, word [0x4ea2ac]
mov dword [esp + 0x110], eax
mov al, byte [0x4ea2ae]
mov dword [esp + 0x114], edx
mov word [esp + 0x118], cx
mov byte [esp + 0x11a], al
lea edx, [esp + 0x94]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x47f16b
lea eax, [esp + 0x14c]
push 0x40
lea ecx, [esp + 0x98]
push eax
push ecx
call fcn.00489f70
sub esp, 0xfffffff4
cmp eax, 0xffffffff
jne 0x47f13e
mov ax, word [0x4eb214]
mov cl, byte [0x4eb216]
mov edx, dword [str.NoName]
mov dword [esp + 0x94], edx
mov word [esp + 0x98], ax
mov byte [esp + 0x9a], cl
jmp 0x47f193
or ecx, 0xffffffff
lea ebp, [esp + 0x94]
not ecx
xor eax, eax
lea edi, [esp + 0x14c]
repne scasb al, byte es:[edi]
mov eax, ecx
sub edi, ecx
shr ecx, 2
mov esi, edi
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x47f193
mov ebp, dword [str.NoName]
mov dx, word [0x4eb214]
mov al, byte [0x4eb216]
mov dword [esp + 0x94], ebp
mov word [esp + 0x98], dx
mov byte [esp + 0x9a], al
xor ebp, ebp
xor edx, edx
mov eax, dword [esp + 0xc84]
mov dword [esp + 0x30], ebp
and eax, 0xffff
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x24], edx
push eax
mov dword [esp + 0x2c], edx
lea ecx, [esp + 0x34]
push 0x4eb20c
push ecx
mov dword [esp + 0x38], edx
call fcn.004a778b
lea eax, [esp + 0x30]
mov ebp, dword [esp + 0xc8c]
mov edx, dword [ebp + 0x6c]
push edx
push 0x4eb208
push eax
call fcn.004a778b
lea edx, [esp + 0xf8]
mov ecx, dword [esp + 0xca4]
and ecx, 0xffff
push ecx
push 0x4eb20c
push edx
call fcn.004a778b
lea ecx, [esp + 0x11c]
mov eax, dword [0x4fd0e8]
push eax
push 0x4eb208
push ecx
call fcn.004a778b
mov edx, dword [esp + 0xcc0]
lea eax, [esp + 0x11c]
and edx, 0xffff
push edx
push 0x4eb20c
push eax
call fcn.004a778b
lea edx, [esp + 0xbc]
mov ecx, dword [ebp + 0x1a8]
push ecx
push 0x4eb208
push edx
call fcn.004a778b
sub esp, 0xffffffb8
lea eax, [esp + 0xd4]
push 0x294
push 0x4eb20c
push eax
call fcn.004a778b
push ebx
lea ecx, [esp + 0x84]
push 0x4eb20c
push ecx
call fcn.004a778b
push ebx
lea edx, [esp + 0x78]
push 0x4eb20c
push edx
call fcn.004a778b
sub esp, 0xffffffdc
cmp word [ebp + 0x1ac], bx
jne 0x47f2c8
push ebx
lea eax, [esp + 0xfc]
push 0x4eb208
push eax
call fcn.004a778b
push ebx
lea ecx, [esp + 0x90]
push 0x4eb208
push ecx
call fcn.004a778b
add esp, 0x18
cmp word [ebp + 0x1ac], 1
jne 0x47f2f1
cmp word [ebp + 0x1ae], bx
jne 0x47f2f1
push ebx
lea edx, [esp + 0x84]
push 0x4eb208
push edx
call fcn.004a778b
sub esp, 0xfffffff4
lea eax, [esp + 0x5c]
lea esi, [esp + 0xd4]
push esi
lea ecx, [esp + 0x78]
push eax
lea eax, [esp + 0x88]
push ecx
lea esi, [esp + 0xf8]
push eax
lea edx, [esp + 0xf0]
push esi
lea edi, [esp + 0x10c]
push edx
lea eax, [esp + 0x48]
push edi
lea edx, [esp + 0x58]
push eax
lea eax, [esp + 0x12c]
push edx
lea ecx, [esp + 0xb8]
push eax
lea edx, [esp + 0x4c]
push ecx
push edx
push 0xc
push 0x4eb204
call fcn.0048ad40
sub esp, 0xffffffc8
mov edx, eax
cmp edx, ebx
jne 0x47f36d
push ebp
push 0x4a
call fcn.0047ecf0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
sub esp, 0xfffff394
ret
or ecx, 0xffffffff
lea esi, [esp + 0x95c]
mov edi, edx
not ecx
xor eax, eax
mov dword [esp + 0x10], esi
repne scasb al, byte es:[edi]
mov eax, ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004a7a46
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x960]
push ecx
push edx
push str.findFirstUnitEx
push 3
push 0x4eb0f4
call fcn.0048ad40
mov edx, eax
sub esp, 0xffffffe8
cmp edx, ebx
jne 0x47f3d5
mov ax, 0x4a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
not ecx
repne scasb al, byte es:[edi]
lea esi, [esp + 0x18c]
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
push edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004a7a46
lea ecx, [esp + 0x190]
push ecx
call fcn.0048ae20
sub esp, 0xfffffff8
mov edx, eax
cmp edx, ebx
jne 0x47f42c
mov ax, 0x4a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
lea esi, [esp + 0x18c]
or ecx, 0xffffffff
mov dword [esp + 0x10], esi
xor eax, eax
mov edi, edx
not ecx
repne scasb al, byte es:[edi]
mov eax, ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
push edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004a7a46
lea edx, [esp + 0x190]
lea ecx, [esp + 0x320]
push ecx
push ebp
push edx
call fcn.004884c0
add esp, 0x10
cmp ax, bx
je 0x47f491
push ebp
push eax
call fcn.0047ec10
sub esp, 0xfffffff8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
lea eax, [esp + 0x31c]
push eax
call fcn.0048ab10
mov esi, eax
sub esp, 0xfffffffc
cmp esi, ebx
jne 0x47f4b6
pop edi
mov ax, 0x42
pop esi
pop ebp
pop ebx
sub esp, 0xfffff394
ret
lea edi, [esp + 0x63c]
lea edx, [esp + 0x31c]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov ecx, 0x64
rep stosd dword es:[edi], eax
lea eax, [esp + 0x63c]
push edx
lea ecx, [esp + 0x4b0]
push eax
push ecx
push esi
push 3
push 0x4eb0f4
call fcn.0048a970
mov edi, eax
push esi
call fcn.004a7a46
add esp, 0x1c
cmp di, bx
je 0x47f518
mov ax, 0x42
pop edi
pop esi
pop ebp
pop ebx
sub esp, 0xfffff394
ret
xor edi, edi
lea eax, [esp + 0x4ac]
mov byte [esp + 0x63b], bl
mov esi, str.error
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x47f551
cmp cl, bl
je 0x47f54d
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
mov cl, dl
jne 0x47f551
sub eax, 0xfffffffe
add esi, 2
cmp cl, bl
jne 0x47f52d
xor eax, eax
jmp 0x47f556
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x47f57c
lea eax, [esp + 0x63c]
push eax
call fcn.004b0ee6
mov edi, eax
sub esp, 0xfffffffc
cmp di, 0x46
je 0x47f57c
cmp di, 0x50
jne 0x47f685
lea eax, [esp + 0x68]
lea edx, [esp + 0xaec]
push eax
lea eax, [esp + 0x7d0]
push edx
lea ecx, [esp + 0x324]
push eax
push ecx
push 3
push 0x4eb204
call fcn.0048a970
sub esp, 0xffffffe8
or eax, eax
je 0x47f5bb
mov ax, 0x42
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc6c
ret
lea edx, [esp + 0x7cc]
mov byte [esp + 0x95b], bl
push edx
mov byte [esp + 0xc7f], bl
mov byte [esp + 0x77], bl
call fcn.004b0ee6
lea ecx, [esp + 0x6c]
mov word [ebp + 0x44], ax
mov ax, word [esp + 0xc88]
mov word [ebp + 0x42], ax
push ecx
call fcn.004b0ee6
sub esp, 0xfffffff8
mov word [ebp + 0x1a4], ax
mov ax, word [ebp + 0x74]
cmp ax, 1
je 0x47f60e
cmp ax, 2
jne 0x47f61f
mov edx, dword [esp + 0xc88]
push edx
push ebp
call fcn.0047eb30
sub esp, 0xfffffff8
cmp di, bx
je 0x47f630
cmp di, 0x46
je 0x47f630
cmp di, 0x50
jne 0x47f685
lea eax, [esp + 0xaec]
movsx esi, word [ebp + 0x5a]
push eax
inc esi
mov word [ebp + 0x5a], si
call fcn.004b0ee6
sub esp, 0xfffffffc
cmp di, bx
mov word [ebp + esi*2 + 0x46], ax
jne 0x47f67b
lea ecx, [ebp + 0x64]
mov esi, dword [ebp + 0x5c]
push ecx
inc esi
mov dword [ebp + 0x5c], esi
call fcn.004beed4
mov ax, di
sub esp, 0xfffffffc
mov dword [ebp + 0x68], 0x78
pop edi
pop esi
pop ebp
pop ebx
sub esp, 0xfffff394
ret
cmp di, 0x50
mov ax, 0x46
je 0x47f688
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
sub esp, 0xfffff394
ret