Function at 0x6eb228
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x25
push 0
push 0
dec ecx
jne 0x6eb230
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x44]
mov edx, dword [0x6e7bb8]
call fcn.00408a7c
lea eax, [ebp - 0x74]
mov edx, dword [0x6e7bb8]
call fcn.00408a7c
xor eax, eax
push ebp
push 0x6ebbf6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x710824]
cmp dword [eax], 6
jge 0x6eb2d5
lea eax, [ebp - 8]
call fcn.006ec5b4
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 8]
call fcn.00420338
mov edx, dword [ebp - 0xa0]
mov eax, 0x6ebc10
call fcn.00428858
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00408684
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 8]
call fcn.006ec240
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 8]
call fcn.00407888
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.006ec834
mov eax, dword [0x710824]
cmp dword [eax], 6
jl 0x6eb342
lea eax, [ebp - 8]
call fcn.006ec5fc
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 8]
call fcn.00420338
mov edx, dword [ebp - 0xa8]
mov eax, 0x6ebc10
call fcn.00428858
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00408684
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 8]
call fcn.006ec240
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 8]
call fcn.00407888
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.006ec834
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x6ebc28
call fcn.00421cfc
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.00408684
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 4]
call fcn.00420338
mov edx, dword [ebp - 0xb0]
mov eax, 0x6ebc10
call fcn.00428858
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408684
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 4]
call fcn.00420338
mov edx, dword [ebp - 0xb4]
lea eax, [ebp - 4]
call fcn.00407888
mov dl, 1
mov eax, dword [0x5c017c]
call fcn.005c2bf4
mov ebx, eax
lea edx, [ebp - 0xbc]
mov eax, dword [0x710824]
mov eax, dword [eax]
call fcn.00420f14
push dword [ebp - 0xbc]
push 0x6ebc38
lea edx, [ebp - 0xc0]
mov eax, dword [0x710f64]
mov eax, dword [eax]
call fcn.00420f14
push dword [ebp - 0xc0]
lea eax, [ebp - 0xb8]
mov edx, 3
call fcn.0040859c
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, 0x6ebc48
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
mov ecx, dword [0x710bec]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5bfcbc]
call fcn.005c2710
push eax
mov ecx, 0x6ebc64
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d10
mov edx, eax
mov eax, ebx
call fcn.005c2de0
lea eax, [ebp - 0xc4]
call fcn.006eaae4
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, 0x6ebc7c
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
lea eax, [ebp - 0xc8]
call fcn.006eac2c
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, 0x6ebc90
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
lea eax, [ebp - 0xcc]
call fcn.006eb0fc
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, 0x6ebca4
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
lea eax, [ebp - 0xd0]
call fcn.006ea67c
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, 0x6ebcbc
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
lea eax, [ebp - 0xd4]
call fcn.006ea6d8
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, 0x6ebcd0
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
lea eax, [ebp - 0xd8]
call fcn.006eaab0
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, 0x6ebce8
mov dl, 1
mov eax, dword [0x5bf48c]
call fcn.005c1d64
mov edx, eax
mov eax, ebx
call fcn.005c2de0
mov dl, 1
mov eax, dword [0x5c017c]
call fcn.005c2bf4
mov dword [ebp - 0x7c], eax
lea edx, [ebp - 0x10]
mov eax, 0x6ebd00
call fcn.00429c08
cmp dword [ebp - 0x10], 0
jne 0x6eb58b
lea edx, [ebp - 0x10]
mov eax, 0x6ebd24
call fcn.00429c08
mov ecx, dword [0x711178]
mov ecx, dword [ecx]
mov edx, 0x6ebd4c
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
mov eax, dword [0x7111d0]
cmp byte [eax], 0
jne 0x6eb5cc
mov ecx, 0x56
mov dl, 1
mov eax, dword [0x5bfcbc]
call fcn.005c2710
mov ecx, eax
mov edx, 0x6ebd60
mov eax, dword [ebp - 0x7c]
call fcn.005c2e24
jmp 0x6eb5ec
mov ecx, 0x40
mov dl, 1
mov eax, dword [0x5bfcbc]
call fcn.005c2710
mov ecx, eax
mov edx, 0x6ebd60
mov eax, dword [ebp - 0x7c]
call fcn.005c2e24
lea eax, [ebp - 0xdc]
call fcn.006ea60c
mov ecx, dword [ebp - 0xdc]
mov edx, 0x6ebd8c
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
lea edx, [ebp - 0xe4]
xor eax, eax
call fcn.00404a44
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00421f8c
mov ecx, dword [ebp - 0xe0]
mov edx, 0x6ebdb0
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
mov ecx, dword [0x710bec]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5bfcbc]
call fcn.005c2710
mov ecx, eax
mov edx, 0x6ebdd4
mov eax, dword [ebp - 0x7c]
call fcn.005c2e24
mov ecx, dword [0x7111f8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x5bfcbc]
call fcn.005c2710
mov ecx, eax
mov edx, 0x6ebdf0
mov eax, dword [ebp - 0x7c]
call fcn.005c2e24
movzx eax, byte [0x6ebe14]
push eax
lea eax, [ebp - 0xe8]
push eax
mov ecx, 0x6ebe24
mov edx, 0x6ebc28
mov eax, dword [ebp - 8]
call fcn.00428ba4
mov ecx, dword [ebp - 0xe8]
mov edx, 0x6ebe3c
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
cmp dword [ebp - 0x24], 0
je 0x6eb6cd
mov ecx, dword [ebp - 0x24]
mov edx, 0x6ebe68
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
jmp 0x6eb6df
mov ecx, 0x6ebe98
mov edx, 0x6ebe68
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
cmp dword [ebp - 0x40], 0
je 0x6eb743
lea ecx, [ebp - 0xf0]
mov edx, 0x6ebea8
mov eax, 0x6ebec0
call fcn.006ed054
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xf4]
mov edx, 0x6ebed4
mov eax, 0x6ebeec
call fcn.006ed054
push dword [ebp - 0xf4]
push 0x6ebf00
lea eax, [ebp - 0xec]
mov edx, 3
call fcn.0040859c
mov edx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
jmp 0x6eb793
lea ecx, [ebp - 0xf8]
mov edx, 0x6ebf18
mov eax, 0x6ebf30
call fcn.006ed054
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xfc]
mov edx, 0x6ebf48
mov eax, 0x6ebf64
call fcn.006ed054
mov edx, dword [ebp - 0xfc]
pop eax
call fcn.004084bc
mov edx, dword [ebp - 0xf8]
mov ecx, 0x6ebe98
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
lea edx, [ebp - 0x100]
mov eax, 0x6ebf6c
call fcn.006ec4a4
mov ecx, dword [ebp - 0x100]
mov edx, 0x6ebf80
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
mov dword [ebp - 0x88], 0x101
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x88]
call fcn.0040843c
xor eax, eax
xor edx, edx
push edx
push eax
call sub.user32.dll_GetWindowLongW
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xc]
call fcn.00407a14
push eax
call sub.advapi32.dll_GetUserNameW
mov edx, dword [ebp - 0x88]
dec edx
lea eax, [ebp - 0xc]
call fcn.0040843c
mov ecx, dword [ebp - 0xc]
mov edx, 0x6ebf9c
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
mov ecx, dword [ebp - 0x10]
mov edx, 0x6ebfbc
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
mov ecx, ebx
mov edx, 0x6ebd4c
mov eax, dword [ebp - 0x7c]
call fcn.005c2e24
call fcn.006eac84
mov ecx, eax
mov edx, 0x6ebfd8
mov eax, dword [ebp - 0x7c]
call fcn.005c2e24
lea eax, [ebp - 0x104]
call fcn.006ea76c
mov ecx, dword [ebp - 0x104]
mov edx, 0x6ebfec
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
lea eax, [ebp - 0x108]
call fcn.006eaaa4
mov ecx, dword [ebp - 0x108]
mov edx, 0x6ec000
mov eax, dword [ebp - 0x7c]
call fcn.005c2e54
mov dl, 1
mov eax, dword [0x5c0be0]
call fcn.005c3dc4
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x84], eax
mov dl, 1
mov eax, dword [0x6e6cd0]
call fcn.006e736c
mov dword [ebp - 0x8c], eax
mov dl, 1
mov eax, dword [0x4421bc]
call fcn.00451450
mov esi, eax
mov byte [esi + 0x39], 0
mov dl, 1
mov eax, dword [0x4421bc]
call fcn.00451450
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov byte [eax + 0x39], 0
xor edx, edx
push ebp
push 0x6ebb83
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x8c]
call fcn.006e7698
mov eax, dword [ebp - 0x8c]
call fcn.006e75a4
dec eax
test eax, eax
jl 0x6eb957
inc eax
mov dword [ebp - 0x9c], eax
xor ebx, ebx
movzx eax, byte [0x6ebe14]
push eax
lea eax, [ebp - 0x10c]
push eax
mov edx, ebx
mov eax, dword [ebp - 0x8c]
call fcn.006e75b0
lea edx, [ebp - 0x110]
call fcn.006e7064
mov eax, dword [ebp - 0x110]
mov ecx, 0x6ebe24
mov edx, 0x6ebc28
call fcn.00428ba4
mov edx, dword [ebp - 0x10c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x9c]
jne 0x6eb905
mov eax, esi
call fcn.006eb140
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6eb999
inc eax
mov dword [ebp - 0x9c], eax
xor ebx, ebx
lea ecx, [ebp - 0x114]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x80]
call fcn.005c405c
inc ebx
dec dword [ebp - 0x9c]
jne 0x6eb973
mov eax, dword [ebp - 0x8c]
call fcn.006e75a4
dec eax
test eax, eax
jl 0x6eb9e4
inc eax
mov dword [ebp - 0x9c], eax
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0x8c]
call fcn.006e75b0
lea edx, [ebp - 0x118]
call fcn.006e7064
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x9c]
jne 0x6eb9b2
mov eax, dword [ebp - 0x98]
call fcn.006eb140
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6ebb62
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0xd
mov ebx, 0x710548
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x14]
call fcn.00421f8c
mov eax, dword [ebx]
mov edx, dword [ebp - 0x14]
call fcn.0042019c
test eax, eax
jne 0x6ebb41
cmp dword [ebp - 0x84], 0
jne 0x6eba75
mov dl, 1
mov eax, dword [0x5c0be0]
call fcn.005c3dc4
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x70]
call fcn.00407460
lea eax, [ebp - 0x54]
call fcn.00407460
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.006ec240
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x74]
call fcn.006ec834
mov dl, 1
mov eax, dword [0x5c017c]
call fcn.005c2bf4
mov esi, eax
movzx eax, byte [0x6ebe14]
push eax
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x12c]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x12c]
mov ecx, 0x6ebe24
mov edx, 0x6ebc28
call fcn.00428ba4
mov ecx, dword [ebp - 0x128]
mov edx, 0x6ec014
mov eax, esi
call fcn.005c2e54
mov ecx, dword [ebp - 0x54]
mov edx, 0x6ec038
mov eax, esi
call fcn.005c2e54
mov ecx, dword [ebp - 0x70]
mov edx, 0x6ec05c
mov eax, esi
call fcn.005c2e54
mov edx, esi
mov eax, dword [ebp - 0x84]
call fcn.005c4104
add ebx, 4
dec dword [ebp - 0x90]
jne 0x6eba23
inc dword [ebp - 0x94]
dec dword [ebp - 0x9c]
jne 0x6eba14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ebb8a
mov eax, dword [ebp - 0x8c]
xor edx, edx
mov dword [ebp - 0x8c], edx
call fcn.00405738
ret