Function at 0x6800f710
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x68031884]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
call fcn.680224fb
test dword [ebp + 0xc], 0xfffff87
je 0x6800f754
mov esi, 0x80090009
jmp 0x6800fb31
mov eax, dword [ebp + 0xc]
push edi
mov edi, 0xf0000000
and eax, edi
cmp eax, edi
mov dword [ebp - 0x18], eax
jne 0x6800f779
test esi, esi
je 0x6800f779
cmp byte [esi], 0
je 0x6800f779
mov esi, 0x80090009
jmp 0x6800fb30
push 4
push dword [ebp - 0x24]
call dword [sym.imp._CKERNEL.DLL_IsBadWritePtr]
test eax, eax
je 0x6800f790
push 0x57
pop esi
jmp 0x6800fb30
test esi, esi
je 0x6800f7bf
cmp byte [esi], 0
je 0x6800f7c4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6800f79e
sub eax, edx
inc eax
test byte [ebp + 0xc], 8
je 0x6800f818
cmp eax, 0x105
jbe 0x6800f818
mov esi, 0x8009001f
jmp 0x6800fb30
cmp dword [ebp - 0x18], edi
je 0x6800f839
push 0x40
pop esi
push esi
call fcn.68021ec0
test eax, eax
mov dword [ebp - 0x14], eax
je 0x6800faa3
test byte [ebp + 0xc], 0x20
je 0x6800f7f1
mov esi, 0x68001500
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], 0xc
jmp 0x6800f839
lea ecx, [ebp - 0x20]
push ecx
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp._CADVAPI.DLL_GetUserNameA]
test eax, eax
jne 0x6800f839
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0xa
mov esi, 0x680014f4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x6800f839
push eax
call fcn.68021ec0
mov edx, eax
test edx, edx
mov dword [ebp - 0x14], edx
je 0x6800faa3
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x6800f82f
test byte [ebp + 0xc], 0x10
je 0x6800f852
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp - 0x14]
call fcn.6800e4d2
jmp 0x6800facb
call fcn.6800efa9
mov ebx, eax
test ebx, ebx
je 0x6800faa3
mov eax, dword [ebp + 0x18]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6800f86d
sub eax, esi
lea esi, [eax + 1]
push esi
call fcn.68021ec0
test eax, eax
je 0x6800faa3
mov ecx, esi
mov esi, dword [ebp - 0x1c]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 3
pop edx
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x188], eax
mov eax, dword [ebp + 0x18]
dec eax
je 0x6800f8e1
dec eax
je 0x6800f8d5
sub eax, 0xa
je 0x6800f8cd
sub eax, 0xc
je 0x6800f8c1
mov esi, 0x80090014
jmp 0x6800fb18
mov dword [ebx + 0x184], 5
jmp 0x6800f921
mov dword [ebx + 0x184], edx
jmp 0x6800f921
mov dword [ebx + 0x184], 4
jmp 0x6800f921
push dword [ebp - 0x1c]
mov esi, dword [sym.imp._CKERNEL.DLL_lstrcmpiA]
push 0x680014c8
call esi
test eax, eax
jne 0x6800f8fd
and dword [ebx + 0x184], eax
jmp 0x6800f921
push dword [ebp - 0x1c]
push 0x680014a0
call esi
test eax, eax
jne 0x6800f917
mov dword [ebx + 0x184], 1
jmp 0x6800f921
mov dword [ebx + 0x184], 2
test byte [ebp + 0xc], 0x40
jne 0x6800f92d
cmp dword [ebp - 0x18], 0
je 0x6800f934
mov dword [ebx + 0x3c], 1
mov edi, 0xf0000000
cmp dword [ebp - 0x18], edi
je 0x6800f963
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push ebx
call fcn.6800e2fe
test eax, eax
jne 0x6800facb
lea eax, [ebx + 0x1c]
push eax
call fcn.68021fa9
test eax, eax
jne 0x6800facb
test byte [ebp + 0xc], 0x20
je 0x6800f96c
or dword [ebx], 0x20
lea eax, [ebx + 0x10]
push eax
call fcn.68022c18
test eax, eax
jne 0x6800facb
mov esi, dword [ebp - 0x24]
push ebx
push eax
push esi
call fcn.68011355
test eax, eax
jne 0x6800facb
cmp dword [ebp - 0x18], edi
mov eax, dword [esi]
mov dword [ebx + 0xc], eax
je 0x6800fa55
lea esi, [ebx + 0x154]
cmp dword [esi], 2
je 0x6800fa55
test byte [ebp + 0xc], 8
jne 0x6800fa55
push esi
push dword [ebx + 0x140]
call fcn.6800e1fb
cmp dword [esi], 1
jne 0x6800f9f9
push 0x50
call fcn.68021ec0
test eax, eax
mov dword [ebx + 0x158], eax
je 0x6800faa3
push eax
call fcn.6801461e
test eax, eax
je 0x6800fa82
push ebx
call fcn.6801467f
test eax, eax
jne 0x6800facb
mov esi, dword [esi]
test esi, esi
je 0x6800fa0e
cmp esi, 1
je 0x6800fa0e
mov esi, 0x80090016
jmp 0x6800fb18
push 1
push dword [ebp + 0xc]
push dword [ebx + 0x5c]
push ebx
call fcn.6800ec32
test eax, eax
jne 0x6800facb
push ebx
push dword [ebx + 0x140]
call fcn.6800f28f
test eax, eax
je 0x6800fa55
cmp eax, 0x80090016
jne 0x6800facb
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push ebx
push dword [ebx + 0x140]
call fcn.6800f552
test eax, eax
jne 0x6800facb
cmp dword [ebx + 0x30], 0
je 0x6800fa8c
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x6800fa8c
push 0
push dword [eax + 8]
mov eax, dword [ebx + 0x184]
push 0xa400
push dword [eax*4 + 0x68031828]
call fcn.68026fa9
test eax, eax
jne 0x6800fa8c
mov esi, 0x8009001a
jmp 0x6800fb18
lea esi, [ebx + 0x58]
cmp dword [esi], 0
jne 0x6800fab0
push 0x14
pop edi
push edi
call fcn.68021ec0
test eax, eax
mov dword [esi], eax
jne 0x6800faa8
push 8
pop esi
jmp 0x6800fb18
mov dword [ebx + 0x38], edi
mov edi, 0xf0000000
push 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x38]
push eax
push esi
lea eax, [ebx + 0x164]
push eax
call fcn.6800d74b
test eax, eax
je 0x6800facf
mov esi, eax
jmp 0x6800fb18
cmp dword [ebx + 0x184], 1
je 0x6800fb07
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push 0x68001464
push 0x80000002
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExA]
test eax, eax
jne 0x6800fb07
or dword [ebx], 4
push dword [ebp - 0x28]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x18], 0
je 0x6800fb0f
or dword [ebx], edi
mov eax, dword [ebp - 0x2c]
mov dword [eax], ebx
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x14], 0
je 0x6800fb26
push dword [ebp - 0x14]
call fcn.68021f03
test ebx, ebx
je 0x6800fb30
push ebx
call fcn.680113a7
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.68014cb9
leave
ret 0x18