Function at 0x46ed20
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4b39fc]
xor eax, esp
mov dword [esp + 0x58], eax
xor eax, eax
push ebp
push esi
mov esi, dword [esp + 0x68]
push edi
xor edi, edi
xor ebp, ebp
test byte [0x4b99ac], 1
mov dword [esp + 0x28], esi
mov byte [esp + 0x40], 0
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov dword [esp + 0x55], eax
mov dword [esp + 0x59], eax
mov dword [esp + 0x5d], eax
mov word [esp + 0x61], ax
mov byte [esp + 0x63], al
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], ebp
jne 0x46edad
or dword [0x4b99ac], 1
push str.AddAccessAllowedAceEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4b99a8], eax
cmp esi, edi
je 0x46ef64
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x20]
push edx
push edi
push 0x494094
push edi
call ebx
mov eax, dword [esp + 0x14]
cmp eax, edi
jbe 0x46ef78
cmp dword [esp + 0x10], edi
jbe 0x46ef78
push eax
call fcn.00476c60
mov ebp, eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00476c60
mov esi, eax
mov eax, dword [esp + 0x1c]
push eax
push 0
push ebp
mov dword [esp + 0x30], esi
call fcn.00477820
mov ecx, dword [esp + 0x24]
lea edx, [ecx + ecx]
push edx
push 0
push esi
call fcn.00477820
add esp, 0x20
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
push ebp
push str.everyone
push 0
call ebx
test eax, eax
je 0x46ef26
push 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x46ef26
mov esi, 0x2c
lea edi, [esp + 0x44]
lea ebx, [esi - 0x29]
push edi
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add edi, 0xc
sub ebx, 1
lea esi, [esi + eax - 4]
jne 0x46ee76
add esi, 3
and esi, 0xfffffffc
push esi
call fcn.00476c60
push esi
mov edi, eax
push ebx
push edi
call fcn.00477820
add esp, 0x10
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x46ef22
mov eax, dword [0x4b99a8]
push ebp
test eax, eax
je 0x46eec8
mov ecx, dword [esp + 0x78]
push ecx
push 3
push 2
push edi
call eax
jmp 0x46eed6
mov edx, dword [esp + 0x78]
push edx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x46ef22
push 0
push edi
push 1
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x46ef22
mov eax, dword [esp + 0x2c]
push 0
lea edx, [esp + 0x24]
push edx
push 0x5dd
push eax
lea ecx, [esp + 0x40]
push 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], ecx
call sub.NETAPI32.dll_NetShareSetInfo
test eax, eax
jne 0x46ef22
mov dword [esp + 0x18], 1
mov esi, dword [esp + 0x1c]
test ebp, ebp
je 0x46ef33
push ebp
call fcn.00478198
add esp, 4
test esi, esi
je 0x46ef40
push esi
call fcn.00478198
add esp, 4
test edi, edi
je 0x46ef4d
push edi
call fcn.00478198
add esp, 4
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004771de
add esp, 0x5c
ret
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004771de
add esp, 0x5c
ret
mov ecx, dword [esp + 0x68]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004771de
add esp, 0x5c
ret