Function at 0x470770
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1550
call fcn.00461aa0
mov eax, dword [0x4a7740]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1548], ecx
mov eax, dword [ebp - 0x1548]
mov dword [eax], vtable.CNTService.0
mov ecx, dword [ebp - 0x1548]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
cmp dword [ebp + 0xc], 0
je 0x4707b6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x154c], eax
jmp 0x4707bf
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x154c], ecx
mov edx, dword [ebp - 0x1548]
mov eax, dword [ebp - 0x154c]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x1548]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x38], 1
mov eax, dword [ebp - 0x1548]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x48], 0xf01ff
mov eax, dword [ebp - 0x1548]
mov dword [eax + 0x4c], 0x110
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0x50], 2
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x54], 1
mov eax, dword [ebp - 0x1548]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0x5c], 0
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 0x1548]
mov dword [eax + 0x64], 0
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0x68], 0
cmp dword [ebp + 0x10], 0
je 0x4708af
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1550], edx
jmp 0x4708b8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1550], eax
mov ecx, dword [ebp - 0x1548]
mov edx, dword [ebp - 0x1550]
mov dword [ecx + 0x6c], edx
mov dword [ebp - 0x1540], 0
mov byte [ebp - 0x1530], 0
push 0xfff
push 0
lea eax, [ebp - 0x152f]
push eax
call fcn.00453b10
add esp, 0xc
mov dword [ebp - 0x1538], 0
mov dword [ebp - 0x40c], 0
mov word [ebp - 0x408], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x406]
push ecx
call fcn.00453b10
add esp, 0xc
mov dword [ebp - 0x530], 0xff
mov word [ebp - 0x208], 0
push 0x1fe
push 0
lea edx, [ebp - 0x206]
push edx
call fcn.00453b10
add esp, 0xc
mov dword [ebp - 0x52c], 0xff
mov dword [ebp - 0x1534], 0
mov dword [ebp - 0x40c], 0x1000
mov dword [ebp - 0x528], 0x114
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
cmp dword [ebp - 0x518], 2
sete cl
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x40], ecx
mov dword [0x4ab270], 1
mov eax, dword [ebp - 0x1548]
mov dword [0x4ab274], eax
mov ecx, dword [ebp - 0x1548]
mov dword [ecx + 0x18], 0x10
mov edx, dword [ebp - 0x1548]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x1548]
cmp dword [eax + 0x40], 0
jne 0x4709d4
jmp 0x470ae2
push 0x200
push 0
lea ecx, [ebp - 0x408]
push ecx
call fcn.00453b10
add esp, 0xc
push 0x200
push 0
lea edx, [ebp - 0x208]
push edx
call fcn.00453b10
add esp, 0xc
mov eax, dword [ebp - 0x40c]
push eax
push 0
lea ecx, [ebp - 0x1530]
push ecx
call fcn.00453b10
add esp, 0xc
lea edx, [ebp - 0x530]
push edx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x153c]
push ecx
lea edx, [ebp - 0x52c]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x1530]
push edx
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x1540], eax
cmp dword [ebp - 0x1540], 0
jne 0x470a6f
jmp 0x470ae2
lea ecx, [ebp - 0x1530]
push ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
mov dword [ebp - 0x1540], eax
cmp dword [ebp - 0x1540], 0
jne 0x470a8d
jmp 0x470ae2
lea edx, [ebp - 0x1530]
push edx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [ebp - 0x1534], eax
mov eax, dword [ebp - 0x1534]
push eax
call fcn.0044e86a
add esp, 4
mov dword [ebp - 0x1544], eax
mov ecx, dword [ebp - 0x1548]
mov edx, dword [ebp - 0x1544]
mov dword [ecx + 0x3c], edx
lea eax, [ebp - 0x1530]
push eax
mov ecx, dword [ebp - 0x1548]
mov edx, dword [ecx + 0x3c]
push edx
mov eax, dword [ebp - 0x1534]
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, dword [ebp - 0x1548]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450ba2
mov esp, ebp
pop ebp
ret 0xc