Function at 0x487100
Capabilities:
Get common file path
Get hostname
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c845b
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x4fe37c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x494], ecx
mov ecx, dword [ebp - 0x494]
call fcn.00486e80
mov dword [ebp - 0x44c], 0x101
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x487343
lea edx, [ebp - 0x444]
push edx
mov ecx, dword [ebp - 0x494]
add ecx, 0x44
call fcn.00407010
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x458]
push ecx
push 0
lea edx, [ebp - 0x450]
push edx
push 0
lea eax, [ebp - 0x444]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0
cmp dword [ebp - 0x450], 0
jbe 0x4871fb
mov ecx, dword [ebp - 0x450]
push ecx
call fcn.00442b2d
add esp, 4
mov dword [ebp - 0x468], eax
mov edx, dword [ebp - 0x468]
mov dword [ebp - 0x460], edx
cmp dword [ebp - 0x458], 0
jbe 0x487235
xor ecx, ecx
mov eax, dword [ebp - 0x458]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00442b2d
add esp, 4
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x460], 0
je 0x4872e7
cmp dword [ebp - 0x45c], 0
je 0x4872e7
lea ecx, [ebp - 0x454]
push ecx
lea edx, [ebp - 0x458]
push edx
mov eax, dword [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x450]
push ecx
mov edx, dword [ebp - 0x460]
push edx
lea eax, [ebp - 0x444]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x4872e7
mov ecx, dword [ebp - 0x45c]
push ecx
mov ecx, dword [ebp - 0x494]
add ecx, 0x60
call fcn.00407010
mov dword [ebp - 0x464], 0
lea edx, [ebp - 0x464]
push edx
mov eax, dword [ebp - 0x460]
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x4872e7
mov ecx, dword [ebp - 0x464]
push ecx
mov ecx, dword [ebp - 0x494]
add ecx, 0x7c
call fcn.00407010
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x464], 0
cmp dword [ebp - 0x45c], 0
je 0x487315
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.004443f2
add esp, 4
mov dword [ebp - 0x45c], 0
cmp dword [ebp - 0x460], 0
je 0x487343
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x474], edx
mov eax, dword [ebp - 0x474]
push eax
call fcn.004443f2
add esp, 4
mov dword [ebp - 0x460], 0
push 0x1a
lea ecx, [ebp - 0x490]
push ecx
call fcn.0049e4f0
add esp, 8
mov dword [ebp - 0x498], eax
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x49c], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x49c]
push eax
mov ecx, dword [ebp - 0x494]
add ecx, 0xb4
call fcn.00406ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.00406fd0
lea ecx, [ebp - 0x23c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [ebp - 0x494]
add ecx, 0x98
call fcn.00407010
mov dword [ebp - 0x448], 0x10
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4873f2
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x494]
add ecx, 0x28
call fcn.00407010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004443e3
mov esp, ebp
pop ebp
ret