Function at 0x460780
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.0065e090
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1218], edx
cmp ecx, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4607df
movups xmm0, xmmword [0x6f4b00]
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x6f4b10]
movups xmmword [edx + 0x10], xmm0
mov eax, dword [0x6f4b20]
mov dword [edx + 0x20], eax
mov ax, word [0x6f4b24]
mov word [edx + 0x24], ax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
cmp ecx, reloc.WS2_32.dll_closesocket
jne 0x46080f
movups xmm0, xmmword [0x6f4b28]
mov eax, 1
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x6f4b38]
movups xmmword [edx + 0x10], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
cmp ecx, reloc.WS2_32.dll_accept
jne 0x460a0b
movups xmm0, xmmword [0x6f4b28]
push 0x800
lea eax, [ebp - 0x1204]
movups xmmword [edx], xmm0
push 0
movups xmm0, xmmword [0x6f4b38]
push eax
movups xmmword [edx + 0x10], xmm0
call fcn.005f46f0
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.005f46f0
push 0x100
lea eax, [ebp - 0x204]
mov dword [ebp - 0x1208], 0x80
push 0
push eax
call fcn.005f46f0
push 0x800
lea eax, [ebp - 0xa04]
mov dword [ebp - 0x120c], 0x80
push 0
push eax
call fcn.005f46f0
add esp, 0x30
mov dword [ebp - 0x1210], 0x400
lea eax, [ebp - 0x1208]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x460a5e
lea eax, [ebp - 0x121c]
push eax
lea eax, [ebp - 0x120c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x1210]
push eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x460a5e
push ebx
push esi
push edi
lea eax, [ebp - 0xa04]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edi, eax
lea eax, [ebp - 0xa04]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
push 1
push 0x6f4b90
push 0x80
mov bl, byte [eax]
lea eax, [ebp - 0x1204]
push eax
call fcn.0040ca40
lea esi, [ebp - 0x1204]
lea esi, [esi + eax*2]
movzx eax, byte [edi + 5]
push eax
push 0x6f4b9c
push 0x80
push esi
call fcn.0040ca40
add esp, 0x20
xor edi, edi
lea esi, [esi + eax*2]
movzx eax, bl
mov dword [ebp - 0x1214], eax
test bl, bl
je 0x46099f
mov ebx, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
push edi
lea eax, [ebp - 0xa04]
push eax
call ebx
mov ecx, esi
push dword [eax]
lea eax, [ebp - 0x1204]
sub ecx, eax
mov eax, 0x400
sar ecx, 1
push 0x6f4b9c
sub eax, ecx
push eax
push esi
call fcn.0040ca40
inc edi
add esp, 0x10
lea esi, [esi + eax*2]
cmp edi, dword [ebp - 0x1214]
jl 0x460965
lea ebx, [ebp - 0x1204]
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4609a7
mov edx, dword [ebp - 0x1218]
sub ebx, esi
lea edi, [edx - 2]
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4609c0
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
add edx, 0xfffffffe
rep movsb byte es:[edi], byte [esi]
nop dword [eax]
mov ax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x4609e0
mov eax, dword [0x6ea880]
mov edi, edx
mov dword [edi], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
cmp ecx, 0x80000000
jne 0x460a5e
movups xmm0, xmmword [0x6f4b48]
mov eax, 1
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x6f4b58]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [0x6f4b68]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [0x6f4b78]
movups xmmword [edx + 0x30], xmm0
movq xmm0, qword [0x6f4b88]
movq qword [edx + 0x40], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret