Function at 0x100005eb0
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov r12, r9
xor ebx, ebx
mov dword [rax - 0x68], ebx
lea rdx, [0x1000016f0]
lea rcx, [rax - 0x60]
call sub.framedynos.dll_public:_void___cdecl_CHString::constructor_unsigned_short_int_const____ptr64____ptr64
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13d, dword [rsp + 0xf0]
lea edi, [rbx + 1]
cmp r13d, edi
jne 0x100005f3b
lea rdx, [0x1000016f4]
mov rsi, qword [rsp + 0xe0]
mov rcx, rsi
call sub.framedynos.dll_public:_int___cdecl_CHString::Compare_unsigned_short_int_const____ptr64_const___ptr64
cmp eax, ebx
jne 0x100005f43
mov r14, qword [rsp + 0x100]
mov r15, qword [rsp + 0xe8]
jmp 0x100006053
mov rsi, qword [rsp + 0xe0]
mov rcx, r12
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
cmp dword [rax + 4], ebx
jne 0x100005fae
mov r14, qword [rsp + 0x100]
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
lea rax, [0x1000019a8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov r15, qword [rsp + 0xe8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call fcn.100005648
jmp 0x10000601a
mov rax, rbx
mov ecx, edi
cmp r13d, ebx
jne 0x100005fbd
mov rax, qword [rsi]
mov ecx, ebx
mov r14, qword [rsp + 0x100]
mov qword [rsp + 0x48], r14
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0x40], rdx
lea rdx, [0x1000019a8]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ecx
mov r15, qword [rsp + 0xe8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov r9, qword [r12]
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call fcn.100005648
cmp eax, edi
jne 0x100006023
jmp 0x1000061a9
mov ecx, dword [rsp + 0xf0]
cmp ecx, 0x80041064
je 0x100006047
cmp ecx, 0x80070005
je 0x100006047
call fcn.1000068a8
nop
mov edi, ebx
jmp 0x1000061a9
cmp r13d, ebx
jne 0x100006053
mov edi, ebx
jmp 0x1000061a9
mov rcx, r12
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
cmp dword [rax + 4], ebx
jne 0x1000060b9
mov edx, 0xfe
mov rcx, r12
call sub.framedynos.dll_public:_unsigned_short_int____ptr64___cdecl_CHString::GetBufferSetLength_int____ptr64
mov qword [rsp + 0x70], rax
mov dword [rsp + 0xf0], 0xfe
lea r8, [rsp + 0xf0]
mov rdx, rax
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
cmp al, bl
jne 0x1000060a3
call fcn.10001885c
nop
mov edi, ebx
jmp 0x1000061a9
or edx, 0xffffffff
mov rcx, r12
call sub.framedynos.dll_public:_void___cdecl_CHString::ReleaseBuffer_int____ptr64
jmp 0x1000060b9
mov edx, 0xfe
mov rcx, rsi
call sub.framedynos.dll_public:_unsigned_short_int____ptr64___cdecl_CHString::GetBufferSetLength_int____ptr64
mov qword [rsp + 0x60], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1000061a7
cmp rax, rbx
je 0x1000061a7
mov ecx, 0x157d
call fcn.100018cd0
mov rdx, rax
mov r8, qword [r12]
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_public:_void___cdecl_CHString::Format_unsigned_short_int_const____ptr64____ptr64
lea rcx, [rsp + 0x58]
call sub.framedynos.dll_protected:_struct_CHStringData____ptr64___cdecl_CHString::GetData_void_const___ptr64
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, dword [rax + 4]
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, 0x40
mov rcx, qword [rsp + 0x60]
call fcn.10001a4f8
cmp eax, edi
je 0x100006144
mov edi, ebx
jmp 0x1000061a9
or edx, 0xffffffff
mov rcx, rsi
call sub.framedynos.dll_public:_void___cdecl_CHString::ReleaseBuffer_int____ptr64
mov r11, qword [rsi]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
lea rax, [0x1000019a8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r11
mov r9, qword [r12]
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call fcn.100005648
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.10001de98
mov eax, ebx
jmp 0x1000061c3
mov edi, ebx
lea rcx, [rsp + 0x58]
call fcn.10001de98
mov eax, edi
jmp 0x1000061c3
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret