Function at 0x100bbac
Capabilities:
Get session user name

Disassembly:
push 0x18
mov eax, 0x101a68f
call fcn.0101458a
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 0xfe
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0x44]
lea ebx, [esi + 0x14]
lea edx, [esi + 0x18]
lea edi, [esi + 4]
push ecx
push 0x1001f54
push dword [esi + 0x40]
push ebx
lea ecx, [esi + 0x1c]
push ecx
push edx
push eax
push edi
push dword [esi]
call fcn.01005728
test eax, eax
jne 0x100bc27
push 0x34
call fcn.01017157
push eax
mov esi, dword [sym.imp.msvcrt.dll___iob_func]
call esi
add eax, 0x40
push eax
call fcn.01016d99
call fcn.01014c31
push eax
call esi
add eax, 0x40
push eax
call fcn.01016d99
xor eax, eax
jmp 0x100bf28
cmp dword [esi + 0x44], 0
jne 0x100bc62
push dword [ebx]
push dword [edi]
call fcn.010064f9
cmp eax, 0x1388
ja 0x100bc62
push 0x34
call fcn.01017157
push eax
mov esi, dword [sym.imp.msvcrt.dll___iob_func]
call esi
add eax, 0x40
push eax
call fcn.01016d99
push 0x157f
call fcn.01017157
jmp 0x100bc14
mov ebx, dword [ebx]
test ebx, ebx
je 0x100bc6e
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x30], eax
cmp dword [esi + 0x44], 1
jne 0x100bce4
lea edi, [esi + 0x18]
mov ecx, edi
call sub.framedynos.dll_protected:_struct_CHStringData____thiscall_CHString::GetData_void_const
cmp dword [eax + 4], 0
je 0x100bce4
push 0x35
call fcn.01017157
push eax
mov ebx, dword [sym.imp.msvcrt.dll___iob_func]
call ebx
add eax, 0x40
push eax
call fcn.01016d99
push 0x41
call fcn.01017157
push eax
call ebx
add eax, 0x40
push eax
call fcn.01016d99
push 0x10014c8
call ebx
add eax, 0x40
push eax
call fcn.01016d99
push 0x1001374
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString_const____thiscall_CHString::operator_unsigned_short_int_const__
and dword [esi + 0x30], 0
mov eax, dword [esi + 0x74]
test eax, eax
je 0x100bcea
lea ecx, [esi + 0x78]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
jmp 0x100bcea
mov ebx, dword [sym.imp.msvcrt.dll___iob_func]
lea edi, [esi + 0x20]
mov ecx, edi
call sub.framedynos.dll_protected:_struct_CHStringData____thiscall_CHString::GetData_void_const
xor ecx, ecx
cmp dword [eax + 4], ecx
jne 0x100bda5
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
mov ecx, edi
call sub.framedynos.dll_public:_unsigned_short_int____thiscall_CHString::GetBufferSetLength_int_
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
jmp 0x100bd65
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x100bd99
push 0x34
call fcn.01017157
push eax
call ebx
add eax, 0x40
push eax
call fcn.01016d99
push 0x5c
call fcn.01017157
push eax
call ebx
jmp 0x100bc17
lea edi, [esi + 0x20]
push 0xffffffffffffffff
mov ecx, edi
call sub.framedynos.dll_public:_void___thiscall_CHString::ReleaseBuffer_int_
push 0x1001440
mov ecx, edi
call sub.framedynos.dll_public:_int___thiscall_CHString::Compare_unsigned_short_int_const__const
test eax, eax
je 0x100bf01
and dword [ebp - 0x20], 0
push 0x5c
mov ecx, edi
call sub.framedynos.dll_public:_int___thiscall_CHString::Find_unsigned_short_int_const
mov ebx, eax
mov dword [ebp - 4], 2
mov ecx, edi
cmp ebx, 0xffffffff
je 0x100be1a
push ebx
lea eax, [ebp - 0x24]
push eax
call sub.framedynos.dll_public:_class_CHString___thiscall_CHString::Left_int_
mov byte [ebp - 4], 3
push eax
lea ecx, [esi + 0x28]
call sub.framedynos.dll_public:_class_CHString_const____thiscall_CHString::operator_class_CHString_const__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call sub.framedynos.dll_public:_void___thiscall_CHString::destructor_void_
mov ecx, edi
call sub.framedynos.dll_protected:_struct_CHStringData____thiscall_CHString::GetData_void_const
mov eax, dword [eax + 4]
push eax
inc ebx
push ebx
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString___thiscall_CHString::Mid_int__int_
mov byte [ebp - 4], 4
jmp 0x100bea0
push 0x40
call sub.framedynos.dll_public:_int___thiscall_CHString::Find_unsigned_short_int_const
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100be7f
mov ecx, edi
call sub.framedynos.dll_protected:_struct_CHStringData____thiscall_CHString::GetData_void_const
mov eax, dword [eax + 4]
push eax
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString___thiscall_CHString::Mid_int__int_
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x28]
call sub.framedynos.dll_public:_class_CHString_const____thiscall_CHString::operator_class_CHString_const__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call sub.framedynos.dll_public:_void___thiscall_CHString::destructor_void_
push ebx
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString___thiscall_CHString::Left_int_
mov byte [ebp - 4], 6
push eax
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString_const____thiscall_CHString::operator_class_CHString_const__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call sub.framedynos.dll_public:_void___thiscall_CHString::destructor_void_
lea edi, [esi + 0x28]
push 0x2e
mov ecx, edi
call sub.framedynos.dll_public:_int___thiscall_CHString::Find_unsigned_short_int_const
cmp eax, 0xffffffff
je 0x100beb4
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString___thiscall_CHString::Left_int_
mov byte [ebp - 4], 7
push eax
mov ecx, edi
call sub.framedynos.dll_public:_class_CHString_const____thiscall_CHString::operator_class_CHString_const__
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call sub.framedynos.dll_public:_void___thiscall_CHString::destructor_void_
or dword [ebp - 4], 0xffffffff
jmp 0x100bf01
lea eax, [esi + 0x78]
push eax
push 0x161
call fcn.01017157
push eax
push dword [esi + 0x74]
call fcn.010037d1
push dword [ebp - 0x20]
mov ecx, esi
call fcn.0100a65f
neg eax
sbb eax, eax
neg eax
call fcn.0101463e
ret