Function at 0x1000096f0
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x4c8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rax, qword [0x100017110]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov r12, r9
mov r15, r8
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x60], rcx
mov r14, qword [rsp + 0x520]
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x68], rax
mov r13, qword [rsp + 0x540]
mov qword [rsp + 0x88], r13
and dword [rsp + 0x50], 0
and dword [rsp + 0x7c], 0
lea rdx, [0x1000015e4]
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_public:_void___cdecl_CHString::constructor_unsigned_short_int_const____ptr64____ptr64
nop
and dword [rsp + 0xb0], 0
xor edx, edx
mov r8d, 0x1fa
lea rcx, [rsp + 0xb4]
call sub.msvcrt.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [rsp + 0x530]
mov ebx, 1
cmp esi, ebx
jne 0x1000097cd
lea rdx, [0x1000018c0]
mov rcx, r14
call sub.framedynos.dll_public:_int___cdecl_CHString::Compare_unsigned_short_int_const____ptr64_const___ptr64
test eax, eax
jne 0x1000097cd
lea r13, [0x100001600]
jmp 0x100009921
mov rcx, r12
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
cmp dword [rax + 4], 0
jne 0x100009822
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea r13, [0x100001600]
mov qword [rsp + 0x38], r13
and dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [r15]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1000090c8
jmp 0x100009870
xor eax, eax
test esi, esi
jne 0x10000982b
mov rax, qword [r14]
mov qword [rsp + 0x48], r13
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea r13, [0x100001600]
mov qword [rsp + 0x38], r13
and dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, qword [r12]
mov r8, qword [r15]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1000090c8
cmp eax, ebx
jne 0x100009879
jmp 0x100009b8c
mov ecx, dword [rsp + 0x50]
cmp ecx, 0x80040154
je 0x100009b9a
cmp ecx, 0x80041064
je 0x1000098db
cmp ecx, 0x80070005
je 0x1000098db
call fcn.10000a284
mov ecx, 0xca
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
call fcn.10000a980
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
nop
xor ebx, ebx
jmp 0x100009b8c
test esi, esi
jne 0x100009921
call fcn.10000a284
mov ecx, 0xca
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
call fcn.10000a980
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
nop
xor ebx, ebx
jmp 0x100009b8c
mov rcx, r12
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
cmp dword [rax + 4], 0
jne 0x100009a1c
mov esi, 0xfe
mov edx, esi
mov rcx, r12
call sub.framedynos.dll_public:_unsigned_short_int____ptr64___cdecl_CHString::GetBufferSetLength_int____ptr64
mov rbx, rax
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x78], esi
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x2b0]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1000099a6
call fcn.10000ab94
mov ecx, 0xca
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000ad00
nop
xor ebx, ebx
jmp 0x100009b8c
mov r8d, esi
lea rdx, [rsp + 0x2b0]
mov rcx, rbx
call fcn.10000c184
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x100009a08
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9, qword [r15]
lea r8, [0x100001b10]
mov edx, 0xff
lea rcx, [rsp + 0xb0]
call fcn.100008f30
mov r8d, esi
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call fcn.10000c184
or edx, 0xffffffff
mov rcx, r12
call sub.framedynos.dll_public:_void___cdecl_CHString::ReleaseBuffer_int____ptr64
jmp 0x100009a21
mov esi, 0xfe
mov edx, esi
mov rcx, r14
call sub.framedynos.dll_public:_unsigned_short_int____ptr64___cdecl_CHString::GetBufferSetLength_int____ptr64
mov r15, rax
mov qword [rsp + 0x98], rax
mov ecx, 0xcc
call fcn.10000afb8
mov rdx, rax
mov r8, qword [r12]
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_public:_void___cdecl_CHString::Format_unsigned_short_int_const____ptr64____ptr64
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
mov ebx, dword [rax + 4]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
mov r8d, ebx
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, esi
mov rcx, r15
call fcn.10000ca3c
or edx, 0xffffffff
mov rcx, r14
call sub.framedynos.dll_public:_void___cdecl_CHString::ReleaseBuffer_int____ptr64
mov r11, qword [r14]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
and dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
mov r9, qword [r12]
mov r8, qword [rsp + 0x80]
mov r8, qword [r8]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1000090c8
mov ebx, eax
test eax, eax
jne 0x100009b7c
mov ecx, dword [rsp + 0x50]
cmp ecx, 0x80040154
jne 0x100009b3d
mov ecx, 0xca
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
mov ecx, 0x1580
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
jmp 0x100009b78
call fcn.10000a284
mov ecx, 0xca
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
call fcn.10000a980
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
nop
xor ebx, ebx
jmp 0x100009b8c
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_public:_void___cdecl_CHString::destructor_void____ptr64
mov eax, ebx
jmp 0x100009be1
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_public:_void___cdecl_CHString::destructor_void____ptr64
mov eax, ebx
jmp 0x100009be1
mov ecx, 0xca
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
mov ecx, 0x1580
call fcn.10000afb8
mov rdx, rax
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call fcn.10000c3d8
nop
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_public:_void___cdecl_CHString::destructor_void____ptr64
xor eax, eax
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.100011d00
add rsp, 0x4c8
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret