Function at 0x4312f0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4851ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x364
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push 1
push 1
push 0x274
push str.._tvt_logged_on_userinfo.cpp
mov edi, ecx
push str.getCurrentWindowsUserAndDomain
push 0x493984
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], edi
call fcn.0040e269
mov al, byte [edi + 0x4c]
xor esi, esi
test al, al
mov dword [ebp - 4], esi
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0xffffffff
je 0x431723
lea eax, [ebp - 0x1c]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.explorer.exe
call fcn.00414780
mov ecx, edi
call fcn.00430fd0
mov ebx, dword [ebp - 0x1c]
cmp ebx, 0xffffffff
je 0x431723
mov cl, byte [edi + 0x4c]
test cl, cl
je 0x431723
test al, al
je 0x4317ef
lea ecx, [ebp - 0x30]
push ecx
push 8
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4313e9
push 1
push 1
push 0x2c3
push str.._tvt_logged_on_userinfo.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.hProcess
lea ecx, [ebp - 0x2b0]
call fcn.00429ad0
push 0x4b9314
lea edx, [ebp - 0x2b0]
push edx
call sub.MSVCR71.dll__CxxThrowException
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x431426
push 1
push 1
push 0x2c7
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.hProcess
lea ecx, [ebp - 0x94]
call fcn.0042adf0
lea ecx, [ebp - 0x94]
call fcn.004027cc
mov ecx, dword [ebp - 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push 1
push ecx
call edi
test eax, eax
je 0x431470
push 1
push 1
push 0x2cf
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.hToken
lea ecx, [ebp - 0x1b0]
call fcn.004303a0
push 0x4baec8
lea edx, [ebp - 0x1b0]
push edx
call sub.MSVCR71.dll__CxxThrowException
call ebx
cmp eax, 0x7a
je 0x4314a7
push 1
push 1
push 0x2d7
push str.._tvt_logged_on_userinfo.cpp
push eax
push str.hToken
lea ecx, [ebp - 0x130]
call fcn.004303a0
push 0x4baec8
lea eax, [ebp - 0x130]
push eax
call sub.MSVCR71.dll__CxxThrowException
mov ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
mov dword [ebp - 0x24], eax
jne 0x4314f2
push 1
push 1
push 0x2de
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.GetProcessHeap__
lea ecx, [ebp - 0x230]
call fcn.004304b0
push 0x4baeb8
lea edx, [ebp - 0x230]
push edx
call sub.MSVCR71.dll__CxxThrowException
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
push ecx
push edx
push eax
mov eax, dword [ebp - 0x30]
push 1
push eax
call edi
test eax, eax
jne 0x431539
push 1
push 1
push 0x2e4
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.hToken
lea ecx, [ebp - 0x330]
call fcn.004303a0
push 0x4baec8
lea ecx, [ebp - 0x330]
push ecx
call sub.MSVCR71.dll__CxxThrowException
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [ebp - 0x20]
add esi, 0x34
mov edi, eax
cmp dword [esi], 0
je 0x43155b
mov ecx, dword [ebp - 0x20]
push esi
call fcn.00432790
push edi
call sub.MSVCR71.dll_malloc
add esp, 4
test eax, eax
mov dword [esi], eax
je 0x4316f2
mov esi, dword [ebp - 0x24]
mov ecx, dword [esi]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CopySid]
cmp eax, 1
je 0x4315b3
push 1
push 1
push 0x2f1
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.this__m_pUserSID
lea ecx, [ebp - 0x170]
call fcn.004306d0
push 0x4bacc8
lea edx, [ebp - 0x170]
push edx
call sub.MSVCR71.dll__CxxThrowException
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x2c]
push edx
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
mov edx, dword [esi]
push eax
push edx
push eax
call edi
test eax, eax
jne 0x4316c0
call ebx
cmp eax, 0x7a
je 0x431614
push 1
push 1
push 0x308
push str.._tvt_logged_on_userinfo.cpp
push eax
push str.ptiUser__User.Sid
lea ecx, [ebp - 0x1f0]
call fcn.004305c0
push 0x4baea8
lea eax, [ebp - 0x1f0]
push eax
call sub.MSVCR71.dll__CxxThrowException
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00413bb0
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.00413bb0
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x40]
push edx
mov edx, dword [esi]
lea eax, [ebp - 0x1c]
push eax
push ecx
push edx
push 0
mov byte [ebp - 4], 5
call edi
test eax, eax
jne 0x431685
push 1
push 1
push 0x31c
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.ptiUser__User.Sid
lea ecx, [ebp - 0x270]
call fcn.004305c0
push 0x4baea8
lea eax, [ebp - 0x270]
push eax
call sub.MSVCR71.dll__CxxThrowException
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00414840
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x50]
push edx
call fcn.00414840
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 4
call fcn.004034a5
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.004034a5
xor esi, esi
jmp 0x4317f5
push 1
push 1
push 0x30d
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.ptiUser__User.Sid
lea ecx, [ebp - 0x2f0]
call fcn.004305c0
push 0x4baea8
lea eax, [ebp - 0x2f0]
push eax
call sub.MSVCR71.dll__CxxThrowException
push 0
push 1
push 1
push 0x2f6
push str.._tvt_logged_on_userinfo.cpp
push str.CTVTUserInfo::m_pUserSID
lea ecx, [ebp - 0x370]
call fcn.0040368a
push 0x4afc14
lea ecx, [ebp - 0x370]
push ecx
call sub.MSVCR71.dll__CxxThrowException
push 1
push str.ServicesActive
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 0x20], eax
je 0x43178b
push 4
push str.lanmanworkstation
mov edx, eax
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x431781
xor bl, bl
lea eax, [ebp - 0xf0]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x43177a
cmp dword [ebp - 0xec], 4
je 0x43177a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x431750
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea edx, [ebp - 0x18]
push edx
push 1
push 0
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov esi, eax
test esi, esi
jne 0x431894
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4317d0
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
push eax
call fcn.00414100
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00414100
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4317d0
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [edi + 0x34]
push eax
push ecx
push edx
mov ecx, edi
mov dword [ebp - 0x18], 0
call fcn.00432e90
mov byte [ebp - 0x11], al
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x30]
cmp eax, esi
mov dword [ebp - 4], esi
je 0x431836
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x431836
push 1
push 1
push 0x338
push str.._tvt_logged_on_userinfo.cpp
call ebx
push eax
push str.hToken
lea ecx, [ebp - 0x94]
call fcn.0042adf0
lea ecx, [ebp - 0x94]
call fcn.004027cc
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x43184c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x431859
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 0x38]
cmp ecx, esi
je 0x43186d
mov al, byte [ebp - 0x11]
mov dword [ecx + 0x24], 1
mov byte [ecx + 0x2c], al
cmp ecx, esi
mov dword [ebp - 4], 0xffffffff
je 0x43187e
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 1
lea ecx, [ebp - 0xd4]
call fcn.00402612
push 0
push 0
push 0x2b8
push str.._tvt_logged_on_userinfo.cpp
push 0
push 0
push 0
push esi
push str.An_unhandled_exception_occurred
push 2
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
mov dword [ebp - 0xd4], 0x48aee4
call fcn.00410e60
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 3
call fcn.00402681
push 0x4b82d0
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0xd4], 0x48aefc
call sub.MSVCR71.dll__CxxThrowException
mov ecx, dword [ebp - 0x54]
mov al, byte [ecx + 0xa]
test al, al
jne 0x431915
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 0x4317ed
ret