Function at 0x6eb510
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x24
push 0
push 0
dec ecx
jne 0x6eb518
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], edx
lea eax, [ebp - 0x44]
mov edx, dword [0x6e808c]
call fcn.00408a7c
lea eax, [ebp - 0x74]
mov edx, dword [0x6e808c]
call fcn.00408a7c
xor eax, eax
push ebp
push 0x6ebe67
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.006ec828
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 8]
call fcn.00420328
mov edx, dword [ebp - 0xa0]
mov eax, 0x6ebe84
call fcn.00428860
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00408684
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 8]
call fcn.006ec4b4
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 8]
call fcn.00407888
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.006ec870
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x6ebe9c
call fcn.00421cec
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.00408684
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 4]
call fcn.00420328
mov edx, dword [ebp - 0xa8]
mov eax, 0x6ebe84
call fcn.00428860
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408684
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 4]
call fcn.00420328
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 4]
call fcn.00407888
mov dl, 1
mov eax, dword [0x5c0b24]
call fcn.005c359c
mov ebx, eax
lea edx, [ebp - 0xb4]
mov eax, dword [0x71380c]
mov eax, dword [eax]
call fcn.00420f04
push dword [ebp - 0xb4]
push 0x6ebeac
lea edx, [ebp - 0xb8]
mov eax, dword [0x713f54]
mov eax, dword [eax]
call fcn.00420f04
push dword [ebp - 0xb8]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.0040859c
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, 0x6ebebc
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
mov ecx, dword [0x713bd4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5c0664]
call fcn.005c30b8
push eax
mov ecx, 0x6ebed8
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c26b8
mov edx, eax
mov eax, ebx
call fcn.005c3788
lea eax, [ebp - 0xbc]
call fcn.006eadcc
mov eax, dword [ebp - 0xbc]
push eax
mov ecx, 0x6ebef0
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
lea eax, [ebp - 0xc0]
call fcn.006eaf14
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, 0x6ebf04
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
lea eax, [ebp - 0xc4]
call fcn.006eb3e4
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, 0x6ebf18
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
lea eax, [ebp - 0xc8]
call fcn.006ea964
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, 0x6ebf30
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
lea eax, [ebp - 0xcc]
call fcn.006ea9c0
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, 0x6ebf44
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
lea eax, [ebp - 0xd0]
call fcn.006ead98
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, 0x6ebf5c
mov dl, 1
mov eax, dword [0x5bfe34]
call fcn.005c270c
mov edx, eax
mov eax, ebx
call fcn.005c3788
mov dl, 1
mov eax, dword [0x5c0b24]
call fcn.005c359c
mov dword [ebp - 0x7c], eax
lea edx, [ebp - 0x10]
mov eax, 0x6ebf74
call fcn.00429c10
cmp dword [ebp - 0x10], 0
jne 0x6eb7fc
lea edx, [ebp - 0x10]
mov eax, 0x6ebf98
call fcn.00429c10
mov ecx, dword [0x714164]
mov ecx, dword [ecx]
mov edx, 0x6ebfc0
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
mov eax, dword [0x7141bc]
cmp byte [eax], 0
jne 0x6eb83d
mov ecx, 0x56
mov dl, 1
mov eax, dword [0x5c0664]
call fcn.005c30b8
mov ecx, eax
mov edx, 0x6ebfd4
mov eax, dword [ebp - 0x7c]
call fcn.005c37cc
jmp 0x6eb85d
mov ecx, 0x40
mov dl, 1
mov eax, dword [0x5c0664]
call fcn.005c30b8
mov ecx, eax
mov edx, 0x6ebfd4
mov eax, dword [ebp - 0x7c]
call fcn.005c37cc
lea eax, [ebp - 0xd4]
call fcn.006ea8f4
mov ecx, dword [ebp - 0xd4]
mov edx, 0x6ec000
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
lea edx, [ebp - 0xdc]
xor eax, eax
call fcn.00404a44
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0xd8]
call fcn.00421f7c
mov ecx, dword [ebp - 0xd8]
mov edx, 0x6ec024
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
mov ecx, dword [0x713bd4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5c0664]
call fcn.005c30b8
mov ecx, eax
mov edx, 0x6ec048
mov eax, dword [ebp - 0x7c]
call fcn.005c37cc
mov ecx, dword [0x7141e4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5c0664]
call fcn.005c30b8
mov ecx, eax
mov edx, 0x6ec064
mov eax, dword [ebp - 0x7c]
call fcn.005c37cc
movzx eax, byte [0x6ec088]
push eax
lea eax, [ebp - 0xe0]
push eax
mov ecx, 0x6ec098
mov edx, 0x6ebe9c
mov eax, dword [ebp - 8]
call fcn.00428bac
mov ecx, dword [ebp - 0xe0]
mov edx, 0x6ec0b0
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
cmp dword [ebp - 0x24], 0
je 0x6eb93e
mov ecx, dword [ebp - 0x24]
mov edx, 0x6ec0dc
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
jmp 0x6eb950
mov ecx, 0x6ec10c
mov edx, 0x6ec0dc
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
cmp dword [ebp - 0x40], 0
je 0x6eb9b4
lea ecx, [ebp - 0xe8]
mov edx, 0x6ec11c
mov eax, 0x6ec134
call fcn.006ed090
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xec]
mov edx, 0x6ec148
mov eax, 0x6ec160
call fcn.006ed090
push dword [ebp - 0xec]
push 0x6ec174
lea eax, [ebp - 0xe4]
mov edx, 3
call fcn.0040859c
mov edx, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
jmp 0x6eba04
lea ecx, [ebp - 0xf0]
mov edx, 0x6ec18c
mov eax, 0x6ec1a4
call fcn.006ed090
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xf4]
mov edx, 0x6ec1bc
mov eax, 0x6ec1d8
call fcn.006ed090
mov edx, dword [ebp - 0xf4]
pop eax
call fcn.004084bc
mov edx, dword [ebp - 0xf0]
mov ecx, 0x6ec10c
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
lea edx, [ebp - 0xf8]
mov eax, 0x6ec1e0
call fcn.006ec718
mov ecx, dword [ebp - 0xf8]
mov edx, 0x6ec1f4
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
mov dword [ebp - 0x88], 0x101
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x88]
call fcn.0040843c
xor eax, eax
xor edx, edx
push edx
push eax
call sub.user32.dll_GetWindowLongW
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xc]
call reloc.user32.dll_GetMonitorInfoW
push eax
call sub.advapi32.dll_GetUserNameW
mov edx, dword [ebp - 0x88]
dec edx
lea eax, [ebp - 0xc]
call fcn.0040843c
mov ecx, dword [ebp - 0xc]
mov edx, 0x6ec210
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
mov ecx, dword [ebp - 0x10]
mov edx, 0x6ec230
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
mov ecx, ebx
mov edx, 0x6ebfc0
mov eax, dword [ebp - 0x7c]
call fcn.005c37cc
call fcn.006eaf6c
mov ecx, eax
mov edx, 0x6ec24c
mov eax, dword [ebp - 0x7c]
call fcn.005c37cc
lea eax, [ebp - 0xfc]
call fcn.006eaa54
mov ecx, dword [ebp - 0xfc]
mov edx, 0x6ec260
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
lea eax, [ebp - 0x100]
call fcn.006ead8c
mov ecx, dword [ebp - 0x100]
mov edx, 0x6ec274
mov eax, dword [ebp - 0x7c]
call fcn.005c37fc
mov dl, 1
mov eax, dword [0x5c1588]
call fcn.005c476c
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x84], eax
mov dl, 1
mov eax, dword [0x6e71a4]
call fcn.006e7840
mov dword [ebp - 0x8c], eax
mov dl, 1
mov eax, dword [0x4421c4]
call fcn.00451458
mov esi, eax
mov byte [esi + 0x39], 0
mov dl, 1
mov eax, dword [0x4421c4]
call fcn.00451458
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov byte [eax + 0x39], 0
xor edx, edx
push ebp
push 0x6ebdf4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x8c]
call fcn.006e7b6c
mov eax, dword [ebp - 0x8c]
call fcn.006e7a78
dec eax
test eax, eax
jl 0x6ebbc8
inc eax
mov dword [ebp - 0x9c], eax
xor ebx, ebx
movzx eax, byte [0x6ec088]
push eax
lea eax, [ebp - 0x104]
push eax
mov edx, ebx
mov eax, dword [ebp - 0x8c]
call fcn.006e7a84
lea edx, [ebp - 0x108]
call fcn.006e7538
mov eax, dword [ebp - 0x108]
mov ecx, 0x6ec098
mov edx, 0x6ebe9c
call fcn.00428bac
mov edx, dword [ebp - 0x104]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x9c]
jne 0x6ebb76
mov eax, esi
call fcn.006eb428
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6ebc0a
inc eax
mov dword [ebp - 0x9c], eax
xor ebx, ebx
lea ecx, [ebp - 0x10c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x80]
call fcn.005c4a04
inc ebx
dec dword [ebp - 0x9c]
jne 0x6ebbe4
mov eax, dword [ebp - 0x8c]
call fcn.006e7a78
dec eax
test eax, eax
jl 0x6ebc55
inc eax
mov dword [ebp - 0x9c], eax
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0x8c]
call fcn.006e7a84
lea edx, [ebp - 0x110]
call fcn.006e7538
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x9c]
jne 0x6ebc23
mov eax, dword [ebp - 0x98]
call fcn.006eb428
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6ebdd3
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0xd
mov ebx, 0x71353c
lea ecx, [ebp - 0x114]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x14]
call fcn.00421f7c
mov eax, dword [ebx]
mov edx, dword [ebp - 0x14]
call fcn.0042018c
test eax, eax
jne 0x6ebdb2
cmp dword [ebp - 0x84], 0
jne 0x6ebce6
mov dl, 1
mov eax, dword [0x5c1588]
call fcn.005c476c
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x70]
call fcn.00407460
lea eax, [ebp - 0x54]
call fcn.00407460
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.006ec4b4
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x74]
call fcn.006ec870
mov dl, 1
mov eax, dword [0x5c0b24]
call fcn.005c359c
mov esi, eax
movzx eax, byte [0x6ec088]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
mov ecx, 0x6ec098
mov edx, 0x6ebe9c
call fcn.00428bac
mov ecx, dword [ebp - 0x120]
mov edx, 0x6ec288
mov eax, esi
call fcn.005c37fc
mov ecx, dword [ebp - 0x54]
mov edx, 0x6ec2ac
mov eax, esi
call fcn.005c37fc
mov ecx, dword [ebp - 0x70]
mov edx, 0x6ec2d0
mov eax, esi
call fcn.005c37fc
mov edx, esi
mov eax, dword [ebp - 0x84]
call fcn.005c4aac
add ebx, 4
dec dword [ebp - 0x90]
jne 0x6ebc94
inc dword [ebp - 0x94]
dec dword [ebp - 0x9c]
jne 0x6ebc85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ebdfb
mov eax, dword [ebp - 0x8c]
xor edx, edx
mov dword [ebp - 0x8c], edx
call reloc.user32.dll_CreateWindowExW
ret