Function at 0x1000084c4
Capabilities:
Get session user name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x68
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rsp + 0xb0], 1
mov dword [r11 + 0x10], 0xfe
lea rbx, [rcx + 0x78]
lea r12, [rcx + 0x28]
lea rdx, [rcx + 0x38]
mov qword [r11 - 0x58], rbx
lea rax, [0x1000019a8]
mov qword [r11 - 0x60], rax
mov eax, dword [rcx + 0x74]
mov dword [rsp + 0x30], eax
mov qword [r11 - 0x70], r12
mov qword [r11 - 0x78], rdx
lea r9, [rcx + 0x30]
mov r8, qword [rcx + 0x48]
lea rdx, [rcx + 8]
mov rcx, qword [rcx]
call fcn.100005eb0
xor esi, esi
cmp eax, esi
jne 0x100008579
lea ecx, [rsi + 0x34]
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
call fcn.100018648
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
xor eax, eax
jmp 0x1000088d9
cmp dword [rbx], esi
jne 0x1000085d6
mov rdx, qword [r12]
mov rcx, qword [rdi + 8]
call fcn.100007a34
cmp eax, 0x1388
ja 0x1000085d6
mov ecx, 0x34
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
mov ecx, 0x157f
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
xor eax, eax
jmp 0x1000088d9
mov rax, qword [r12]
cmp rax, rsi
je 0x1000085e7
mov rax, qword [rax + 0x20]
mov qword [rdi + 0x60], rax
cmp dword [rbx], 1
jne 0x100008683
lea rcx, [rdi + 0x30]
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
cmp dword [rax + 4], esi
je 0x100008683
mov ecx, 0x35
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
mov ecx, 0x41
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [0x100001800]
lea rcx, [rax + 0x60]
call fcn.100019d78
lea rdx, [0x1000017d4]
lea rcx, [rdi + 0x30]
call sub.framedynos.dll_public:_class_CHString_const____ptr64___cdecl_CHString::operator_unsigned_short_int_const____ptr64____ptr64
mov qword [rdi + 0x60], rsi
mov rcx, qword [rdi + 0xc8]
cmp rcx, rsi
je 0x100008683
lea rdx, [rdi + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
lea rbx, [rdi + 0x40]
mov rcx, rbx
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
cmp dword [rax + 4], esi
jne 0x100008730
mov qword [rsp + 0x50], rsi
mov edx, dword [rsp + 0xa8]
mov rcx, rbx
call sub.framedynos.dll_public:_unsigned_short_int____ptr64___cdecl_CHString::GetBufferSetLength_int____ptr64
mov qword [rsp + 0x50], rax
jmp 0x1000086c2
lea r8, [rsp + 0xa8]
mov rdx, rax
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
cmp al, sil
jne 0x100008721
mov ecx, 0x34
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
mov ecx, 0x5c
call fcn.100018cd0
mov rbx, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.100019d78
xor eax, eax
jmp 0x1000088d9
lea rbx, [rdi + 0x40]
or edx, 0xffffffff
mov rcx, rbx
call sub.framedynos.dll_public:_void___cdecl_CHString::ReleaseBuffer_int____ptr64
lea rdx, [0x1000016f4]
mov rcx, rbx
call sub.framedynos.dll_public:_int___cdecl_CHString::Compare_unsigned_short_int_const____ptr64_const___ptr64
cmp eax, esi
je 0x1000088a2
mov dword [rsp + 0xb0], esi
mov edx, 0x5c
mov rcx, rbx
call sub.framedynos.dll_public:_int___cdecl_CHString::Find_unsigned_short_int_const___ptr64
mov r12d, eax
or r13d, 0xffffffff
cmp eax, r13d
je 0x1000087d5
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, rbx
call sub.framedynos.dll_public:_class_CHString___cdecl_CHString::Left_int____ptr64
nop
lea rcx, [rdi + 0x50]
mov rdx, rax
call sub.framedynos.dll_public:_class_CHString_const____ptr64___cdecl_CHString::operator_class_CHString_const____ptr64____ptr64
nop
lea rcx, [rsp + 0xb8]
call fcn.10001de98
mov rcx, rbx
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
lea r8d, [r12 + 1]
mov r9d, dword [rax + 4]
lea rdx, [rsp + 0xb8]
mov rcx, rbx
call sub.framedynos.dll_public:_class_CHString___cdecl_CHString::Mid_int__int____ptr64
nop
mov rdx, rax
mov rcx, rbx
call sub.framedynos.dll_public:_class_CHString_const____ptr64___cdecl_CHString::operator_class_CHString_const____ptr64____ptr64
nop
lea rcx, [rsp + 0xb8]
call fcn.10001de98
jmp 0x100008896
mov edx, 0x40
mov rcx, rbx
call sub.framedynos.dll_public:_int___cdecl_CHString::Find_unsigned_short_int_const___ptr64
mov r12d, eax
cmp eax, r13d
je 0x100008853
mov rcx, rbx
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
lea r8d, [r12 + 1]
mov r9d, dword [rax + 4]
lea rdx, [rsp + 0xb8]
mov rcx, rbx
call sub.framedynos.dll_public:_class_CHString___cdecl_CHString::Mid_int__int____ptr64
nop
lea rcx, [rdi + 0x50]
mov rdx, rax
call sub.framedynos.dll_public:_class_CHString_const____ptr64___cdecl_CHString::operator_class_CHString_const____ptr64____ptr64
nop
lea rcx, [rsp + 0xb8]
call fcn.10001de98
mov r8d, r12d
lea rdx, [rsp + 0xb8]
mov rcx, rbx
call sub.framedynos.dll_public:_class_CHString___cdecl_CHString::Left_int____ptr64
nop
mov rdx, rax
mov rcx, rbx
call sub.framedynos.dll_public:_class_CHString_const____ptr64___cdecl_CHString::operator_class_CHString_const____ptr64____ptr64
nop
lea rcx, [rsp + 0xb8]
call fcn.10001de98
mov edx, 0x2e
lea rcx, [rdi + 0x50]
call sub.framedynos.dll_public:_int___cdecl_CHString::Find_unsigned_short_int_const___ptr64
cmp eax, r13d
je 0x100008896
mov r8d, eax
lea rdx, [rsp + 0xb8]
lea rcx, [rdi + 0x50]
call sub.framedynos.dll_public:_class_CHString___cdecl_CHString::Left_int____ptr64
nop
mov rdx, rax
lea rcx, [rdi + 0x50]
call sub.framedynos.dll_public:_class_CHString_const____ptr64___cdecl_CHString::operator_class_CHString_const____ptr64____ptr64
nop
lea rcx, [rsp + 0xb8]
call fcn.10001de98
nop
jmp 0x1000088a2
mov ecx, 0x161
call fcn.100018cd0
mov rdx, rax
lea r8, [rdi + 0xd0]
mov rcx, qword [rdi + 0xc8]
call fcn.100005160
mov edx, dword [rsp + 0xb0]
mov rcx, rdi
call fcn.100009e14
cmp eax, esi
setne sil
mov eax, esi
add rsp, 0x68
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret