Function at 0x6c1039f0
Capabilities:
Get session user name

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
call fcn.6c1037b0
mov dword [esp + 0x20], eax
test eax, eax
je 0x6c103c60
mov ebx, dword [eax + 0x1c]
lea edi, [eax + 0x1c]
mov ebp, dword [sym.imp.ucrtbase.dll__wcsnicmp]
cmp ebx, edi
jne 0x6c103a36
jmp 0x6c103a60
mov ebx, dword [ebx]
cmp ebx, edi
je 0x6c103a60
cmp dword [ebx + 0x10], esi
jb 0x6c103a60
jne 0x6c103a30
mov eax, dword [esp + 0x14]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call ebp
test eax, eax
jne 0x6c103a30
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x68]
test ebx, ebx
je 0x6c103c60
mov ebp, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x20
call ebp
mov ebx, eax
test eax, eax
je 0x6c103c60
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 8]
cmp word [eax], 0
mov dword [esp + 0x18], eax
je 0x6c103c96
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6c103aa0
mov edx, dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0x24], eax
sar eax, 1
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 4], eax
mov eax, dword [sym.imp.advapi32.dll_GetUserNameW]
mov dword [esp], 0
mov dword [esp + 0x28], eax
call eax
sub esp, 8
test eax, eax
jne 0x6c103c50
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x7a
jne 0x6c103c50
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x2c]
add eax, esi
lea eax, [ecx + eax + 8]
add eax, eax
mov dword [esp], eax
call ebp
mov ebp, eax
test eax, eax
je 0x6c103c50
mov eax, dword [0x6c147714]
lea edx, [ebp + 0xe]
mov dword [esp + 0x2c], edx
mov dword [ebp], eax
mov eax, dword [0x6c147718]
mov dword [ebp + 4], eax
mov eax, dword [0x6c14771c]
mov dword [ebp + 8], eax
movzx eax, word [0x6c147720]
mov word [ebp + 0xc], ax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], edx
call eax
sub esp, 8
test eax, eax
mov edx, dword [esp + 0x2c]
je 0x6c103cab
mov eax, dword [esp + 0x3c]
mov ecx, 0x40
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x24]
mov word [edx - 2], cx
mov ecx, dword [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 0x18], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call sub.ucrtbase.dll_memcpy
mov eax, dword [esp + 0x24]
movd xmm0, ebp
xor ebp, ebp
mov edx, dword [esp + 0x18]
add edx, eax
movd xmm4, edx
punpckldq xmm0, xmm4
test esi, esi
je 0x6c103be9
mov dword [esp + 0x28], ebx
mov ebx, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], edi
mov edi, edx
movq qword [esp + 0x18], xmm0
lea esi, [esi]
movzx eax, word [ebp + ebx*2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towlower]
mov word [edi + ebx*2], ax
add ebx, 1
cmp ebx, esi
jne 0x6c103bc0
mov edx, edi
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
movq xmm0, qword [esp + 0x18]
mov ecx, dword [esp + 0x20]
xor eax, eax
movq qword [ebx + 8], xmm0
mov word [edx + esi*2], ax
lea eax, [ebx + 0x18]
movd xmm1, eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x10], esi
movd xmm0, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x14], xmm0
mov eax, dword [ecx + 0x1c]
cmp eax, edi
jne 0x6c103c26
jmp 0x6c103c70
mov eax, dword [eax]
cmp eax, edi
je 0x6c103c70
cmp esi, dword [eax + 0x10]
jb 0x6c103c20
mov edx, dword [eax + 4]
movd xmm0, eax
movd xmm3, edx
punpckldq xmm0, xmm3
movq qword [ebx], xmm0
mov dword [edx], ebx
mov dword [eax + 4], ebx
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call esi
lea esi, [esi]
nop
xor ebx, ebx
jmp 0x6c103a55
mov edx, dword [esp + 0x20]
movd xmm0, edi
mov eax, dword [edx + 0x20]
movd xmm2, eax
punpckldq xmm0, xmm2
movq qword [ebx], xmm0
mov dword [eax], ebx
mov eax, ebx
mov dword [edx + 0x20], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
jmp 0x6c103ab9
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebp
call esi
jmp 0x6c103c56