Function at 0x469fc4
Capabilities:
Get session user name
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
mov edi, 0x4f4c80
xor eax, eax
push ebp
push 0x46a23a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4f4c84
mov edx, dword [ebp - 4]
call fcn.00404888
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404888
mov eax, dword [edi]
call fcn.00404aec
mov esi, eax
test esi, esi
jle 0x46a035
mov ebx, 1
mov eax, dword [edi]
cmp byte [eax + ebx - 1], 0x20
jne 0x46a031
mov eax, edi
call fcn.00404d3c
mov byte [eax + ebx - 1], 0x5f
inc ebx
dec esi
jne 0x46a01c
mov edx, 0x46a24c
mov cl, 1
mov eax, 0x46a274
call fcn.0040e828
test al, al
jne 0x46a063
mov edx, 0x46a24c
mov cl, 1
mov eax, 0x46a284
call fcn.0040e828
test al, al
jne 0x46a063
xor eax, eax
jmp 0x46a065
mov al, 1
mov byte [0x4f4c7c], al
cmp byte [0x4f4c7c], 0
je 0x46a0a1
mov eax, dword [0x4f2dec]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x34]
push 0
mov ecx, dword [0x4f2dec]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x469e10]
call fcn.00469f30
mov dword [0x4f4c74], eax
mov bl, 1
jmp 0x46a217
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46a189
push 0xf01ff
mov eax, dword [edi]
call fcn.00404ce4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [0x4f4c7c]
cmp byte [0x4f4c7c], 0
je 0x46a180
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x1c]
call fcn.00408fa0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x46a170
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1c]
call fcn.00404a24
mov edx, 0x46a298
mov eax, dword [ebp - 0x14]
call fcn.004090ec
test eax, eax
jne 0x46a158
lea eax, [ebp - 0x14]
mov edx, 0x46a2ac
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a177
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.00402830
ret
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [0x4f4c7c], 0
je 0x46a1e1
mov dword [ebp - 0x1c], pe_nt_image_headers32
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00404e70
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404ce4
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0x10]
call fcn.00404ce4
call fcn.00409c70
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404e70
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004090ec
test eax, eax
sete byte [0x4f4c7c]
mov bl, byte [0x4f4c7c]
cmp byte [0x4f4c7c], 0
je 0x46a217
mov eax, dword [0x4f2dec]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x34]
push 0
mov ecx, dword [0x4f2dec]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x469e10]
call fcn.00469f30
mov dword [0x4f4c74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a241
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404858
lea eax, [ebp - 4]
call fcn.00404834
ret