Function at 0x1401742f0
Capabilities:
Get session user name

Disassembly:
mov byte [rsp + 0x10], dl
mov word [rsp + 8], cx
sub rsp, 0x108
movzx eax, byte [rsp + 0x118]
mov byte [rsp + 0x44], al
cmp byte [rsp + 0x44], 0x2f
je 0x14017431c
cmp byte [rsp + 0x44], 0x7d
je 0x140174354
jmp 0x140174390
mov eax, 0x113
mov word [rsp + 0x110], ax
mov dword [rsp + 0x20], 0xd8
lea r9, [rsp + 0x40]
mov r8d, 0xe3
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x40], eax
jmp 0x140174390
mov byte [rsp + 0x118], 0x36
movzx eax, byte [rsp + 0x118]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x118]
movzx r8d, byte [rsp + 0x118]
movzx edx, byte [rsp + 0x118]
movzx ecx, byte [rsp + 0x118]
call fcn.140175db0
nop
movzx eax, byte [rsp + 0x118]
mov byte [rsp + 0x48], al
cmp byte [rsp + 0x48], 0
je 0x1401743af
cmp byte [rsp + 0x48], 0xd
je 0x1401743d1
jmp 0x140174471
movzx eax, byte [rsp + 0x118]
mov byte [rsp + 0x31], al
movzx eax, word [section..data]
mov word [rsp + 0x38], ax
mov byte [rsp + 0x30], 0x6a
jmp 0x140174471
movsx eax, byte [rsp + 0x30]
cmp eax, 0x45
jl 0x14017440c
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x118], al
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x31]
movzx r8d, byte [rsp + 0x31]
movzx edx, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x31]
call fcn.140175db0
nop
lea r8, [rsp + 0x31]
lea rdx, [fcn.140175570]
mov rcx, qword [rsp + 0xd8]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0xa0], eax
movsx eax, byte [rsp + 0x30]
sub eax, 0x74
mov byte [rsp + 0x30], al
movzx edx, byte [rsp + 0x30]
movzx ecx, word [rsp + 0x110]
call fcn.140174720
mov eax, 0x319
mov word [rsp + 0x110], ax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0xa4], eax
movzx eax, word [rsp + 0x38]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x1052
je 0x140174489
jmp 0x14017450f
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x4c], al
cmp byte [rsp + 0x4c], 0x21
je 0x1401744f6
cmp byte [rsp + 0x4c], 0x6a
je 0x1401744a2
jmp 0x14017450d
movzx eax, word [rsp + 0x110]
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x38]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x1052
je 0x1401744c4
jmp 0x1401744e8
movabs rax, 0x7826278687e126
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x50], 0x5932
mov dword [rsp + 0x3c], 0xd9de
jmp 0x1401744f4
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x118], al
jmp 0x14017450d
mov edx, 0x6b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x74], eax
jmp 0x14017458b
movzx eax, word [section..data]
add eax, 0x631
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x38]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x82d
je 0x140174535
jmp 0x14017457e
mov edx, 0xfd
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_SHMultiFileProperties]
mov dword [rsp + 0xa8], eax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x110], ax
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0xe0], rax
jmp 0x14017458b
mov eax, dword [rsp + 0x3c]
and eax, 0xa484
mov dword [rsp + 0x3c], eax
movsx eax, word [rsp + 0x110]
or eax, 0xb4
movsx ecx, word [rsp + 0x34]
cmp eax, ecx
jg 0x14017461b
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x356d
je 0x1401745b5
jmp 0x1401745fa
movzx edx, byte [rsp + 0x30]
movzx ecx, word [rsp + 0x34]
call fcn.140174720
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x90], eax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x110], ax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x110], ax
jmp 0x14017461b
mov r8d, 0x6b
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov qword [rsp + 0xd0], rax
movsx eax, byte [rsp + 0x30]
cmp eax, 0x15
jge 0x14017467f
mov rax, qword [rsp + 0x80]
shl rax, 0x2e
mov qword [rsp + 0x80], rax
call fcn.140175570
movzx eax, word [section..data]
sar eax, 9
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
mov r9d, 0xc9
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x3c], 0xedd
jb 0x1401746ee
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
je 0x14017469b
jmp 0x1401746da
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0xc0], rax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x60], ax
jmp 0x1401746ec
movsx eax, byte [rsp + 0x30]
xor eax, 0x61
mov rcx, qword [rsp + 0xc0]
mov byte [rcx], al
jmp 0x14017470c
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0xf8], rax
mov eax, 0xa0
add rsp, 0x108
ret