Function at 0x464c7d
Capabilities:
Get common file path
Get hostname
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x454], ecx
mov ecx, dword [ebp - 0x454]
call fcn.004659c7
mov dword [ebp - 0x468], 0x101
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x464e7e
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x454]
add ecx, 0x3c
call fcn.0040c49d
and dword [ebp - 0x45c], 0
and dword [ebp - 0x458], 0
mov dword [ebp - 0x464], 7
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x458]
push eax
push 0
lea eax, [ebp - 0x45c]
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
and dword [ebp - 0x450], 0
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x45c], 0
jbe 0x464d51
push dword [ebp - 0x45c]
call fcn.0043b0ea
pop ecx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x458], 0
jbe 0x464d87
xor ecx, ecx
mov eax, dword [ebp - 0x458]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043b0ea
pop ecx
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x450], 0
je 0x464e2e
cmp dword [ebp - 0x44c], 0
je 0x464e2e
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x450]
lea eax, [ebp - 0x228]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x464e2e
push dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x454]
add ecx, 0x54
call fcn.0040c49d
and dword [ebp - 0x460], 0
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x464e2e
push dword [ebp - 0x460]
mov ecx, dword [ebp - 0x454]
add ecx, 0x6c
call fcn.0040c49d
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x44c], 0
je 0x464e56
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x474], eax
push dword [ebp - 0x474]
call fcn.0043aeb5
pop ecx
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x450], 0
je 0x464e7e
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x478], eax
push dword [ebp - 0x478]
call fcn.0043aeb5
pop ecx
and dword [ebp - 0x450], 0
push 0x1a
lea eax, [ebp - 0x448]
push eax
call fcn.0045a6fa
pop ecx
pop ecx
mov dword [ebp - 0x47c], eax
push dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x454]
add ecx, 0x9c
call fcn.0040218f
lea ecx, [ebp - 0x448]
call fcn.00402e75
lea eax, [ebp - 0x430]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x430]
push eax
mov ecx, dword [ebp - 0x454]
add ecx, 0x84
call fcn.0040c49d
mov dword [ebp - 0x480], 0x10
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x464f11
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x454]
add ecx, 0x24
call fcn.0040c49d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a99c
mov esp, ebp
pop ebp
ret