Function at 0x1001c57f
Capabilities:
Get session user name

Disassembly:
mov eax, 0x10061498
call fcn.10060588
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
je 0x1001c631
cmp byte [ebp + 0x38], 0
je 0x1001c5c8
mov ecx, dword [ebp + 0x24]
xor eax, eax
mov dword [ecx], eax
jmp 0x1001c5bf
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], eax
jne 0x1001c826
inc dword [ecx]
cmp dword [ecx], eax
jg 0x1001c5b1
jmp 0x1001c826
mov esi, dword [ebp + 0x34]
mov dword [esi], 0
cmp dword [esi], 0xfffffff9
jg 0x1001c826
mov ebx, dword [ebp + 0x30]
mov edi, dword [ebp + 0x20]
mov dword [ebp + 0x10], 0xfcf09cc2
xor edx, edx
mov dword [ebp - 0x18], 0x60e77906
dec dword [ebp + 0x10]
mov eax, dword [ebx]
mov eax, dword [esi]
mov eax, dword [ebp + 0x10]
mov eax, dword [edi]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebx]
mov eax, dword [edi]
mov dword [edi], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp ecx, eax
mov eax, dword [ebp + 0x10]
setge dl
xor ecx, ecx
sub edx, 0x7dd9
cmp edx, eax
mov eax, dword [ebp + 0x1c]
setne cl
mov dword [eax], ecx
dec dword [esi]
cmp dword [esi], 0xfffffff9
jle 0x1001c5e0
jmp 0x1001c826
cmp byte [ebp + 0x3c], 0
je 0x1001c655
xor eax, eax
mov byte [ebp + 0x13], al
cmp byte [ebp + 0x13], al
je 0x1001c826
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
jmp 0x1001c826
mov dword [ebp - 0x18], 0x5c12
cmp dword [ebp - 0x18], 0x5fb9
jle 0x1001c6c4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor esi, esi
xor ebx, ebx
mov dword [ebp + 0x10], 0x3460
xor edi, edi
mov eax, ebx
lea ecx, [ebp - 0x44]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c698
mov eax, dword [eax]
push eax
call fcn.10048d40
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10001516
inc edi
cmp edi, 0x23e1
jl 0x1001c67c
add ebx, esi
dec dword [ebp + 0x10]
jne 0x1001c67a
inc esi
cmp esi, 0x15c4
jl 0x1001c671
cmp dword [ebp - 0x18], 0x5bc3
jge 0x1001c6d8
push str.ujfi_qcdvn_drgv_vuzzjuxs_mngcihox
call fcn.10048d40
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], 0x669f
cmp dword [ebp + 0x10], 0x67ca
jle 0x1001c725
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
sar eax, cl
mov ecx, 0x1007cb18
cdq
push edx
push eax
call fcn.10010bb7
inc ebx
cmp ebx, 0x63a3
jl 0x1001c6f2
inc edi
cmp edi, 0x3a0e
jl 0x1001c6f0
inc esi
cmp esi, 0x6f49
jl 0x1001c6ee
mov dword [ebp - 4], 2
cmp dword [ebp + 0x10], 0x65bd
jge 0x1001c744
mov edx, str.vyp_wkw_hmh_rbebim_aarwhfv_emnvj_pbobsi_siyh_dajuuau_mry_mctcuwiw
mov ecx, 0x1007cb18
call fcn.100134d2
mov esi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
cmp dword [esi], 0x34
jne 0x1001c826
mov edi, dword [ebp - 0x1c]
push 2
lea ecx, [ebp - 0x2c]
call fcn.100013b5
mov dword [ebp + 0x10], 0x10e3a113
mov dword [ebp + 0x10], 0
jmp 0x1001c7a1
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2c]
mov dword [eax + ecx*4], 9
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 2
jl 0x1001c791
mov ecx, dword [ebp + 0x40]
xor edx, edx
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
mov eax, dword [ebp + 0x44]
mov ecx, dword [eax]
mov eax, dword [edi]
mov eax, dword [eax + 8]
cmp eax, 0xa5fc
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x20]
setne bl
xor ecx, ecx
mov eax, dword [eax]
cmp ebx, eax
mov eax, dword [ebp + 8]
setne cl
mov eax, dword [eax]
imul eax, ecx
test eax, eax
je 0x1001c801
mov eax, dword [edi]
cmp dword [eax], 0
je 0x1001c801
xor eax, eax
inc eax
jmp 0x1001c803
xor eax, eax
push dword [ebp - 0x2c]
mov dword [ebp + 0x10], eax
call fcn.10048e11
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
inc dword [esi]
cmp dword [esi], 0x34
pop ecx
je 0x1001c75d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret