Function at 0x1002b850
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push edi
mov dword [ebp - 0x14], 0x24a8c6a5
mov dword [ebp - 0x14], 0
jmp 0x1002b871
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
jne 0x1002b881
push 1
call fcn.1002b729
pop ecx
jmp 0x1002b86a
mov dword [ebp - 0x14], 0xffffffe7
jmp 0x1002b891
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffeb
jg 0x1002b8b3
mov dword [ebp - 0xa8], 0
push 1
lea eax, [ebp - 0xa8]
push eax
call fcn.1002b77c
pop ecx
pop ecx
jmp 0x1002b88a
and dword [ebp - 0x12c], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xf4], 0xfffffffe
mov dword [ebp - 0x10c], 0xe53d8da8
mov dword [ebp - 0xe8], 0xe0b4074d
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x108], 0xfffffff9
mov dword [ebp - 0x58], 0x7543
mov dword [ebp - 0x34], 0
jmp 0x1002b924
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1002b93a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x13c], 5
jmp 0x1002b91d
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
push 0x1c
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 8]
push 0x3819
push 0x461d
call fcn.100233d8
pop ecx
pop ecx
call eax
test eax, eax
je 0x1002bc21
mov dword [ebp - 0xc], 0xe8cff0ea
mov dword [ebp - 0xe0], 0x9b4a
mov dword [ebp - 0xdc], 0x9b4a
mov dword [ebp - 0xd8], 0x9b4a
mov dword [ebp - 0xd4], 0x9b4a
mov dword [ebp - 0xc], 0
jmp 0x1002b9a7
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x17
jne 0x1002bb4f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x1002b9c8
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffea
je 0x1002bb4a
mov dword [ebp - 0x1c], 0x7d65121a
mov dword [ebp - 0x24], 0x83398963
mov dword [ebp - 0x38], 0
jmp 0x1002b9f0
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002ba06
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xc0], 0x1fc3eee2
jmp 0x1002b9e9
mov dword [ebp - 0x1c], 1
jmp 0x1002ba16
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1002bb12
mov dword [ebp - 0x3c], 0x43836745
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xc0], 0
jae 0x1002ba40
mov dword [ebp - 0x98], 1
jmp 0x1002ba47
and dword [ebp - 0x98], 0
cmp dword [ebp - 0xc], 0
jne 0x1002ba5c
mov eax, 0x5f07c70a
test eax, eax
jne 0x1002ba5c
and dword [ebp - 0x50], 0
jmp 0x1002ba63
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
je 0x1002ba7d
mov dword [ebp - 0x54], 1
jmp 0x1002ba81
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x54], eax
jne 0x1002ba95
mov dword [ebp - 0x94], 1
jmp 0x1002ba9c
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xc0], ecx
mov eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x20]
je 0x1002bad1
mov dword [ebp - 0x7c], 1
jmp 0x1002bad5
and dword [ebp - 0x7c], 0
cmp dword [ebp - 0x7c], 0xdb80
jl 0x1002bae7
mov dword [ebp - 0x64], 1
jmp 0x1002baeb
and dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 2
jbe 0x1002bafd
mov dword [ebp - 0x8c], 1
jmp 0x1002bb04
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x24], eax
jmp 0x1002ba0f
mov dword [ebp - 0x24], 1
jmp 0x1002bb22
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1002bb45
mov byte [ebp - 0x17], 0
movzx eax, byte [ebp - 0x17]
test eax, eax
je 0x1002bb43
push 0x44a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x1002bb1b
jmp 0x1002b9c1
jmp 0x1002b9a0
mov dword [ebp - 0xc], 0
jmp 0x1002bb5f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1002bb75
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], 0x74fd
jmp 0x1002bb58
mov dword [ebp - 0xac], 0xee
mov dword [ebp - 0x28], 0xe0a8eac8
mov byte [ebp - 0x16], 0
movzx eax, byte [ebp - 0x16]
test eax, eax
je 0x1002bb9c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x28], 0
jmp 0x1002bbac
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff7
jg 0x1002bbe7
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x2c], 0
jmp 0x1002bbc9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jl 0x1002bbe5
mov byte [ebp - 0x15], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x1002bbe3
push 1
call fcn.1002b80e
pop ecx
jmp 0x1002bbc2
jmp 0x1002bba5
mov eax, dword [ebp - 0x118]
and eax, dword [ebp - 0xac]
jne 0x1002bbfe
mov dword [ebp - 0x6c], 1
jmp 0x1002bc02
and dword [ebp - 0x6c], 0
mov al, byte [ebp - 0x6c]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x118]
and eax, 0x101
je 0x1002bc19
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
jmp 0x1002befa
mov dword [ebp - 4], 0x2c7c8a6b
mov dword [ebp - 0xd0], 0x869e
mov dword [ebp - 0xcc], 0x869e
mov dword [ebp - 0xc8], 0x869e
mov dword [ebp - 0xc4], 0x869e
mov dword [ebp - 0x10], 0
jmp 0x1002bc60
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002bc76
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0
jmp 0x1002bc59
mov dword [ebp - 0x10], 0
jmp 0x1002bc86
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002bc9c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb8], 0x1dc6b79d
jmp 0x1002bc7f
cmp dword [ebp - 4], 0
jne 0x1002bd1c
or eax, 0xffffffff
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
je 0x1002bcb9
mov dword [ebp - 0x84], 1
jmp 0x1002bcc0
and dword [ebp - 0x84], 0
imul eax, dword [ebp - 0x84], 0xf996
cmp eax, 2
je 0x1002bcd8
mov dword [ebp - 0x74], 1
jmp 0x1002bcdc
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x74]
jne 0x1002bcea
cmp dword [ebp - 4], 0
je 0x1002bcfc
mov eax, 0x6ae49a2f
test eax, eax
je 0x1002bcfc
mov dword [ebp - 0x4c], 1
jmp 0x1002bd00
and dword [ebp - 0x4c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + eax - 0xb8], ecx
cmp dword [ebp - 4], 0
jne 0x1002bd1c
and dword [ebp - 0x60], 0
jmp 0x1002bd23
mov dword [ebp - 0x60], 1
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x48]
mov dword [ebp + eax - 0xa0], ecx
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x60]
je 0x1002bd78
mov eax, 0x955a
test eax, eax
je 0x1002bd78
mov dword [ebp - 4], 0
jmp 0x1002bd5d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x1002bd73
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb8], 0xdf29855e
jmp 0x1002bd56
jmp 0x1002bef8
mov dword [ebp - 0x90], 0x9ac92d14
mov dword [ebp - 0x30], 0
jmp 0x1002bd92
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1002bda5
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x44], 0xec1b16eb
jmp 0x1002bd8b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x104], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xe4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xa0]
cmp dword [ebp + eax - 0x44], ecx
jle 0x1002bde7
mov dword [ebp - 0x68], 1
jmp 0x1002bdeb
and dword [ebp - 0x68], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x68], eax
jne 0x1002be03
mov dword [ebp - 0x70], 1
jmp 0x1002be07
and dword [ebp - 0x70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x70], eax
je 0x1002be1f
mov dword [ebp - 0x78], 1
jmp 0x1002be23
and dword [ebp - 0x78], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp eax, dword [ebp - 0x78]
je 0x1002be3e
mov dword [ebp - 0x80], 1
jmp 0x1002be42
and dword [ebp - 0x80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80]
sub ecx, dword [ebp + eax - 0x44]
cmp ecx, 0x4380d33b
jne 0x1002be63
mov dword [ebp - 0x88], 1
jmp 0x1002be6a
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x90], eax
jle 0x1002be94
mov dword [ebp - 0xa4], 1
jmp 0x1002be9b
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x110], eax
push 8
pop eax
neg eax
cmp eax, 0xfa014801
jbe 0x1002bebc
mov dword [ebp - 0xb0], 1
jmp 0x1002bec3
and dword [ebp - 0xb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 4]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xb8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa0], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret