Function at 0x10027906
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10027923
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10027b89
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 0x722a
mov dword [ebp - 8], 0
jmp 0x1002795b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x1002796e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x58], 9
jmp 0x10027954
mov dword [ebp - 8], 0
jmp 0x1002797e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x10027991
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0x4cd45360
jmp 0x10027977
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x50], 1
jmp 0x100279b6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x50], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x50], 0
jl 0x10027aae
mov dword [ebp - 0x44], 0xc234ac01
mov dword [ebp - 0x48], 0xfffffffc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp + eax*4 - 0x58], 1
jg 0x100279ef
mov dword [ebp - 0x20], 1
jmp 0x100279f3
and dword [ebp - 0x20], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x20], eax
jle 0x10027a0b
mov dword [ebp - 0x24], 1
jmp 0x10027a0f
and dword [ebp - 0x24], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x24], eax
jne 0x10027a27
mov dword [ebp - 0x28], 1
jmp 0x10027a2b
and dword [ebp - 0x28], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x58]
imul eax, dword [ebp - 0x28]
mov ecx, 0x244d
sub ecx, eax
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x50]
jg 0x10027a59
mov dword [ebp - 0x2c], 1
jmp 0x10027a5d
and dword [ebp - 0x2c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x58]
cmp dword [ebp - 0x2c], eax
jl 0x10027a79
mov dword [ebp - 0x30], 1
jmp 0x10027a7d
and dword [ebp - 0x30], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x58]
mov ecx, dword [ebp - 0x30]
lea eax, [eax + ecx + 0x83ac]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x50]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x58], eax
jmp 0x100279a1
cmp dword [ebp - 0x18], 0
jle 0x10027b89
push 4
push 0x1000
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
add ecx, dword [eax + 0xc]
push ecx
push 0x3819
push 0x4ac9
call fcn.100233d8
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], 0
jmp 0x10027afb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10027b0e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], 0x9841
jmp 0x10027af4
mov dword [ebp - 0x14], 3
jmp 0x10027b1e
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10027b6c
mov dword [ebp - 0xc], 0xbb6748f6
mov dword [ebp - 0xc], 0
jmp 0x10027b3b
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x10027b4e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], 0x7fd1
jmp 0x10027b34
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0xb72
push 0
push 0x1ad2
call fcn.10027c4d
add esp, 0x10
jmp 0x10027b17
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
push dword [ebp - 0x18]
push 0
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.100234d4
add esp, 0xc
mov esp, ebp
pop ebp
ret