Function at 0x47debb
Capabilities:
Get user security identifier

Disassembly:
push 0x14c
mov eax, 0x50a3ca
call fcn.0049caff
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x124], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x150], ecx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ecx + 0xc], ebx
push 0xf
pop edx
mov dword [ecx + 0x1c], ebx
mov dword [ecx + 0x20], edx
mov byte [ecx + 0xc], bl
mov eax, dword [eax]
mov esi, ebx
mov dword [ebp - 0x124], eax
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 4], 5
mov ecx, ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x11c], ebx
cmp ecx, 2
jge 0x47e0a6
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x13c], ebx
push ecx
cmp edx, 0x10
lea ecx, [ebp - 0x130]
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x12c]
push eax
push esi
push dword [ebp - 0x124]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
cmp eax, 1
je 0x47e027
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x47e217
cmp dword [ebp - 0x11c], 0
jg 0x47e217
jmp 0x47e030
cmp dword [ebp - 0x11c], 0
jg 0x47e0a0
lea eax, [ebp - 0x125]
push eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x14c]
call fcn.0047ddc4
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x1c]
ja 0x47e066
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
cmovae eax, dword [ebp - 0x2c]
mov byte [eax + ecx], bl
jmp 0x47e073
sub ecx, dword [ebp - 0x1c]
push ebx
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040fa1d
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x148]
inc ecx
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], eax
jmp 0x47df45
mov eax, dword [ebp - 0x120]
sub eax, esi
cmp eax, dword [ebp - 0x12c]
je 0x47e14a
push 0xb8
push 0x538a4c
push 4
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 8
call fcn.00417524
push 0x5581cc
lea eax, [ebp - 0x118]
jmp 0x47e23e
push esi
lea ecx, [ebp - 0x50]
call fcn.0047e7bc
mov ecx, dword [ebp - 0x134]
push eax
call fcn.0047ea87
lea ecx, [ebp - 0x44]
call fcn.0040dd63
lea ecx, [ebp - 0x50]
call fcn.004252c3
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x47e1b8
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], ecx
cmp eax, 0x1000
jb 0x47e1af
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040cd82
mov eax, dword [ebp - 0x120]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x11c]
push eax
push ecx
call fcn.0049c467
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
test esi, esi
je 0x47e209
sub edi, esi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x120], edi
cmp edi, 0x1000
jb 0x47e200
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040cd82
mov edi, dword [ebp - 0x120]
mov esi, dword [ebp - 0x11c]
pop ecx
pop ecx
push edi
push esi
call fcn.0049c467
pop ecx
pop ecx
mov eax, dword [ebp - 0x134]
call fcn.0049ca51
ret 4
push 0xac
push 0x538a4c
push eax
push 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 6
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0xb4]
push eax
call fcn.004a6281
int3