Function at 0x43e0f0
Capabilities:
Get session user name
Get user security identifier
Receive data
Receive data on socket
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
sub esp, 0x37c
mov ecx, dword [0x4863ec]
lea eax, [esp + 8]
push ebp
xor ebp, ebp
push eax
push 0x47adc8
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ebp
call dword [ecx + 0x44]
cmp eax, ebp
je 0x43e15a
mov eax, dword [0x4863ec]
lea edx, [esp + 0xc]
push edx
push 0x479474
call dword [eax + 0x44]
cmp eax, ebp
je 0x43e15a
push eax
push 0x47ad94
call fcn.00446e00
add esp, 8
xor eax, eax
pop ebp
add esp, 0x37c
ret
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x68]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [0x4863ec]
push ebp
push ebp
push ebp
push ebp
push 1
push ecx
push ebp
call dword [edx + 0xc]
cmp eax, ebp
je 0x43e198
push eax
push 0x47ad6c
call fcn.00446e00
add esp, 8
xor eax, eax
pop ebp
add esp, 0x37c
ret
push ebx
push esi
lea eax, [esp + 0x20]
push edi
push eax
push 1
push 0xf01ff
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebx, dword [esp + 0x394]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov byte [esp + 0x13], cl
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
lea eax, [esp + 0x2c]
push 4
lea edx, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], 1
mov dword [esp + 0x78], edx
mov dword [esp + 0x3c], 2
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, ebp
je 0x43e40c
cmp eax, 0xffffffff
je 0x43e40c
mov ecx, dword [esp + 0x28]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x30], eax
cmp esi, ebp
mov edi, eax
je 0x43e251
push ebp
push esi
push edi
push ebx
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x43e4e0
cmp eax, ebp
je 0x43e4e0
sub esi, eax
add edi, eax
cmp esi, ebp
jne 0x43e22e
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x3c]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], 1
mov dword [esp + 0x5c], edx
mov dword [esp + 0x40], 2
mov eax, dword [eax + 8]
push eax
push ebp
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x74]
mov dword [esp + 0x44], eax
lea edx, [esp + 0x7c]
push ecx
lea eax, [esp + 0x58]
push edx
push eax
mov al, byte [esp + 0x1f]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x6c]
neg al
push ecx
lea ecx, [esp + 0x2c]
sbb eax, eax
push 0x10
push ebp
and eax, ecx
push edx
push eax
mov eax, dword [0x4863ec]
lea edx, [esp + 0x54]
push edx
call dword [eax + 0x1c]
mov esi, eax
cmp esi, 0x80090311
jg 0x43e313
je 0x43e30c
lea eax, [esi + 0x7ff6fd00]
cmp eax, 0xc
ja case.0x43e2db.2146893050
xor ecx, ecx
mov cl, byte [eax + 0x43e7fc]
jmp dword [ecx*4 + 0x43e7e0]
mov edi, 0x47ad24
jmp 0x43e35d
mov edi, 0x47acdc
jmp 0x43e35d
mov edi, 0x47aca4
jmp 0x43e35d
mov edi, 0x47ac74
jmp 0x43e35d
mov edi, 0x47ac28
jmp 0x43e35d
mov edi, 0x47abd0
jmp 0x43e35d
mov edi, 0x47ab78
jmp 0x43e35d
cmp esi, 0x90313
jg 0x43e33e
je 0x43e337
cmp esi, ebp
je 0x43e330
cmp esi, 0x90312
jne case.0x43e2db.2146893050
mov edi, 0x47ab60
jmp 0x43e35d
mov edi, 0x47ab54
jmp 0x43e35d
mov edi, 0x47ab3c
jmp 0x43e35d
mov eax, esi
sub eax, 0x90314
je 0x43e358
dec eax
je 0x43e351
mov edi, 0x47ab2c
jmp 0x43e35d
mov edi, 0x47ab18
jmp 0x43e35d
mov edi, 0x47aafc
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x43e370
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x30], ebp
cmp esi, 0x90314
je 0x43e380
cmp esi, 0x90313
jne 0x43e3b4
mov edx, dword [0x4863ec]
mov eax, dword [edx + 0x20]
cmp eax, ebp
je 0x43e399
lea ecx, [esp + 0x54]
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
cmp esi, 0x90313
jne 0x43e3a5
xor esi, esi
jmp 0x43e3b8
cmp esi, 0x90314
jne 0x43e3b4
mov esi, 0x90312
jmp 0x43e3b8
cmp esi, ebp
jl 0x43e3df
cmp dword [esp + 0x3c], ebp
je 0x43e3df
push ebp
lea eax, [esp + 0x40]
push 4
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_send]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebp
push ecx
push edx
push ebx
call dword [sym.imp.WSOCK32.dll_send]
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x43e3ee
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x90312
mov dword [esp + 0x44], ebp
je 0x43e402
cmp esi, 0x90314
jne 0x43e429
mov byte [esp + 0x13], 1
jmp 0x43e1d1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0x47aac8
call fcn.00446e00
add esp, 8
mov dword [esp + 0x14], ebp
jmp 0x43e763
cmp esi, ebp
je 0x43e46a
cmp esi, 0x90315
je 0x43e46a
push edi
lea eax, [esp + 0x188]
push 0x47aa8c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x190]
push esi
push ecx
call fcn.00446e00
add esp, 0x14
cmp esi, 0x90315
mov dword [esp + 0x14], ebp
jne 0x43e72f
call fcn.00445610
test eax, eax
je 0x43e72f
call fcn.00445640
mov ebx, dword [esp + 0x390]
test eax, eax
je 0x43e4c0
mov eax, dword [ebx + 0x579c]
lea esi, [ebx + 0x579c]
cmp eax, ebp
je 0x43e4a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebp
mov eax, dword [0x4863ec]
lea edx, [esp + 0x1c]
push esi
push edx
call dword [eax + 0x60]
cmp eax, ebp
je 0x43e4c0
push eax
push 0x47aa64
call fcn.00446e00
add esp, 8
mov edx, dword [0x4863ec]
lea ecx, [esp + 0x1c]
push ecx
call dword [edx + 0x30]
cmp eax, ebp
je 0x43e4e9
push eax
push 0x47aa30
call fcn.00446e00
add esp, 8
mov dword [esp + 0x14], ebp
jmp 0x43e763
mov al, byte [0x481910]
mov ecx, 0x40
mov byte [esp + 0x80], al
xor eax, eax
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004457a0
test eax, eax
je 0x43e572
mov eax, dword [ebx + 0x579c]
cmp eax, ebp
je 0x43e572
lea ecx, [esp + 0x70]
lea edx, [esp + 0x4c]
push ecx
push 4
push edx
push 0x12
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43e572
mov eax, dword [esp + 0x4c]
dec eax
je 0x43e55f
dec eax
je 0x43e550
dec eax
jne 0x43e572
lea eax, [esp + 0x80]
push 0x47a8e0
push eax
jmp 0x43e56c
lea ecx, [esp + 0x80]
push 0x47a8cc
push ecx
jmp 0x43e56c
lea edx, [esp + 0x80]
push 0x47a8b8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebp, [ebx + 0x2a3c]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x43e58d
cmp byte [ebp], 0x2e
jne 0x43e671
mov al, byte [0x481910]
mov ecx, 0x40
mov byte [esp + 0x288], al
xor eax, eax
lea edi, [esp + 0x289]
lea edx, [esp + 0x288]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
mov esi, 0x104
push ecx
push edx
stosb byte es:[edi], al
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x800
mov dword [esp + 0x54], esi
mov dword [esp + 0x4c], 0x800
call fcn.004520a2
mov esi, eax
add esp, 4
test esi, esi
je 0x43e61d
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x50]
push eax
push ecx
lea edx, [esp + 0x50]
push ebp
push edx
lea eax, [esp + 0x298]
push esi
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x43e612
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00451fb9
add esp, 4
jmp 0x43e671
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, byte [0x481910]
mov esi, eax
mov byte [esp + 0x184], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x185]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x288]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x188]
push 0x47a7e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x190]
push esi
push ecx
call fcn.00446e00
add esp, 0x14
mov dword [0x481bd0], 0
xor esi, esi
mov edx, dword [esi*4 + 0x47a670]
mov eax, dword [esi*4 + 0x47a654]
push edx
push eax
push ebx
call fcn.0043ea50
add esp, 0xc
test eax, eax
jne 0x43e6f6
inc esi
cmp esi, 7
jb 0x43e67d
call fcn.0043e810
mov dword [esp + 0x14], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x481bec]
test eax, eax
je 0x43e6c9
push ebp
push ebx
call fcn.0043ee20
add esp, 8
mov dword [0x481bd8], eax
mov eax, dword [0x481c68]
test eax, eax
je 0x43e6e4
push 0
push 0
push ebx
call fcn.0043f9c0
add esp, 0xc
mov dword [0x481bdc], eax
mov ecx, dword [0x4863ec]
lea eax, [esp + 0x1c]
push eax
call dword [ecx + 0x34]
xor ebp, ebp
jmp 0x43e763
test esi, esi
jne 0x43e704
mov dword [0x481bd0], 1
mov dword [esp + 0x14], 1
call fcn.004457a0
test eax, eax
je 0x43e6a9
lea ecx, [esp + 0x80]
lea edx, [ebx + 0x2938]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x43e6a9
cmp esi, ebp
jne 0x43e763
cmp dword [0x481be0], ebp
je 0x43e755
mov edx, dword [esp + 0x398]
push edx
call fcn.0043ecd0
add esp, 4
test eax, eax
jne 0x43e755
mov dword [esp + 0x14], ebp
jmp 0x43e763
mov eax, 1
mov dword [0x481bd0], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, dword [esp + 0x24]
pop edi
pop esi
cmp eax, ebp
pop ebx
je 0x43e781
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], ebp
cmp eax, ebp
je 0x43e797
mov ecx, dword [0x4863ec]
push eax
call dword [ecx + 0x40]
cmp dword [esp + 0x28], ebp
jne 0x43e7a3
cmp dword [esp + 0x2c], ebp
je 0x43e7b0
mov eax, dword [0x4863ec]
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x10]
mov al, byte [esp + 7]
test al, al
je 0x43e7d2
cmp dword [esp + 0x10], ebp
jne 0x43e7c4
cmp dword [esp + 0x14], ebp
je 0x43e7d2
mov edx, dword [0x4863ec]
lea ecx, [esp + 0x10]
push ecx
call dword [edx + 0x24]
mov eax, dword [esp + 8]
pop ebp
add esp, 0x37c
ret