Function at 0x1001b4b0
Capabilities:
Acquire debug privileges
Check if file exists
Copy file
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc04b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x35d8
call fcn.100b7e70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x35bc], ecx
mov ecx, dword [ebp - 0x35bc]
call fcn.10019a90
push fcn.10019450
push str.Fusion::CProcessMonitor::Run_____Starting____p
call fcn.10010cb0
add esp, 8
lea eax, [ebp - 0x24]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1001b532
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push 1
push str.SeDebugPrivilege
mov edx, dword [ebp - 0x24]
push edx
call fcn.1001a190
add esp, 0xc
push 0xa000
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x354c], eax
mov eax, dword [ebp - 0x354c]
mov dword [ebp - 0x1664], eax
mov dword [ebp - 0x2c], 0xa000
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0
push str.ProcMonitorDrvEvent
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x43c], eax
push str.ClipboardDrvEvent
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1c], eax
push str.Run___1:_Creating_memory_file
call fcn.10010cb0
add esp, 4
push 0x20
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x3554], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x3554], 0
je 0x1001b605
mov ecx, dword [ebp - 0x3554]
mov dword [ecx], 0
mov edx, dword [ebp - 0x3554]
mov dword [edx + 4], 0
mov ecx, dword [ebp - 0x3554]
call fcn.10010710
mov eax, dword [ebp - 0x3554]
mov dword [ebp - 0x35c0], eax
jmp 0x1001b60f
mov dword [ebp - 0x35c0], 0
mov ecx, dword [ebp - 0x35c0]
mov dword [ebp - 0x3550], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x3550]
mov dword [0x100f4c78], edx
mov eax, dword [0x100f4c78]
mov dword [ebp - 0x3578], eax
mov ecx, dword [ebp - 0x3578]
cmp dword [ecx], 0
je 0x1001b646
jmp 0x1001b651
mov ecx, dword [ebp - 0x3578]
call fcn.100187b0
push str.Run___2:_Creating_global_events
call fcn.10010cb0
add esp, 4
push 0
push str.C:EATempSaveData.old
push str.C:EATempSaveData.txt
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.C:EATempSaveData.yes
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001b6a4
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push str.C:EATempSaveData.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x100f4c5c], eax
jmp 0x1001b6ae
mov dword [0x100f4c5c], 0
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
mov edx, dword [ebp - 0x35bc]
push edx
push 0x1001b470
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Run___3:_Creating_thread_events
call fcn.10010cb0
add esp, 4
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x145c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1458], ecx
push str.Run___4:_Creating_packet_processors
call fcn.10010cb0
add esp, 4
push 0x50
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x355c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x355c], 0
je 0x1001b740
mov ecx, dword [ebp - 0x355c]
call fcn.1007ee50
mov dword [ebp - 0x35c4], eax
jmp 0x1001b74a
mov dword [ebp - 0x35c4], 0
mov edx, dword [ebp - 0x35c4]
mov dword [ebp - 0x3558], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3558]
mov dword [ebp - 0x1460], eax
mov ecx, dword [ebp - 0x1460]
mov dword [ecx], 0x10012910
mov edx, dword [ebp - 0x1460]
mov eax, dword [ebp - 0x35bc]
mov dword [edx + 4], eax
push 1
push str.EnableClipboardLogging
mov ecx, dword [0x100f4c54]
call fcn.1000d5d0
mov byte [ebp - 0x15], al
mov ecx, 1
test ecx, ecx
je 0x1001c575
push 0x7d0
push 0
lea edx, [ebp - 0x145c]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x1668], eax
cmp dword [ebp - 0x1668], 1
jne 0x1001b8ab
mov dword [ebp - 0x166c], 0x8000e008
push 0
lea eax, [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x1664]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x166c]
push edx
mov eax, dword [ebp - 0x35bc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1670], eax
mov edx, dword [ebp - 0x440]
cmp edx, dword [ebp - 0x2c]
jbe 0x1001b826
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x1664]
mov dword [ebp - 0x1678], ecx
mov edx, dword [ebp - 0x1664]
mov dword [ebp - 0x1674], edx
cmp dword [ebp - 0x1670], 1
jne 0x1001b850
cmp dword [ebp - 0x440], 0
jne 0x1001b861
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1001b799
mov ecx, dword [ebp - 0x440]
push ecx
mov edx, dword [ebp - 0x1678]
mov eax, dword [edx]
push eax
push str.Fusion::CProcessMonitor::Run_____PackType:_d_Size:_d_n
call fcn.10010cb0
add esp, 0xc
mov ecx, dword [ebp - 0x1674]
mov edx, dword [ecx + 8]
mov eax, dword [ebp - 0x1674]
mov byte [eax + edx + 0x10], 0
mov dword [ebp - 0x167c], 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1001c563
cmp dword [ebp - 0x1668], 0
jne 0x1001c558
mov dword [ebp - 4], 2
mov dword [ebp - 0x1e90], 0x8000e000
push 0
lea edx, [ebp - 0x440]
push edx
push 0x400
lea eax, [ebp - 0x1440]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1e90]
push eax
mov ecx, dword [ebp - 0x35bc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1e94], eax
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x1e94]
push ecx
push str.Fusion::CProcessMonitor::Run_____retCode_d_BytesReturned_d_n
call fcn.10010cb0
add esp, 0xc
cmp dword [ebp - 0x1e94], 1
jne 0x1001b930
cmp dword [ebp - 0x440], 0
jne 0x1001b96c
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 0x35bc]
call fcn.10019a90
push str.Fusion::CProcessMonitor::Run_____Not_Found___
call fcn.10010cb0
add esp, 4
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
jmp 0x1001b799
mov eax, dword [ebp - 0x440]
push eax
push str.Fusion::CProcessMonitor::Run_____Found_Code___d_bytes
call fcn.10010cb0
add esp, 8
push 0x2e7
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x35c8], eax
mov ecx, dword [ebp - 0x35c8]
mov dword [ebp - 0x3564], ecx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x3564], 0
je 0x1001b9cb
mov ecx, dword [ebp - 0x3564]
call fcn.10018ae0
mov dword [ebp - 0x35cc], eax
mov edx, dword [ebp - 0x35cc]
mov dword [ebp - 0x35d0], edx
jmp 0x1001b9d5
mov dword [ebp - 0x35d0], 0
mov eax, dword [ebp - 0x35d0]
mov dword [ebp - 0x3560], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3560]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x440]
push edx
lea eax, [ebp - 0x1440]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10019450
add esp, 0xc
mov dword [ebp - 0x1e8c], 0x100
mov byte [ebp - 4], 4
lea edx, [ebp - 0x1e88]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
cmp eax, 1
jne 0x1001ba72
lea edx, [ebp - 0x1e84]
push edx
lea eax, [ebp - 0x1e8c]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x1e8c]
push edx
lea eax, [ebp - 0x1660]
push eax
mov ecx, dword [ebp - 0x1e88]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov edx, dword [ebp - 0x1e88]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001bb22
push bind
push 0
push 0x100
lea eax, [ebp - 0x1660]
push eax
call fcn.1009da4e
mov dword [ebp - 0x357c], eax
cmp dword [ebp - 0x357c], 0
jl 0x1001babc
push bind
push 0x100d7d68
push 0
push 0x100
lea ecx, [ebp - 0x1660]
push ecx
call fcn.1009db9f
mov dword [ebp - 0x357c], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x35]
mov dword [ebp - 0x3588], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x3584], edx
push bind
push 0
mov eax, dword [ebp - 0x3588]
push eax
mov ecx, dword [ebp - 0x3584]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x3580], eax
cmp dword [ebp - 0x3580], 0
jl 0x1001bb22
push bind
push 0x100d7d68
push 0
mov edx, dword [ebp - 0x3588]
push edx
mov eax, dword [ebp - 0x3584]
push eax
call fcn.1009db9f
mov dword [ebp - 0x3580], eax
jmp 0x1001bbe4
mov dword [ebp - 4], 2
push str.S_1_5_7
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
push eax
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001bc52
push bind
push 0
push 0x100
lea ecx, [ebp - 0x1660]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x359c], eax
cmp dword [ebp - 0x359c], 0
jl 0x1001bc4d
push bind
push str.Anonymous_Logon
push 0
push 0x100
lea edx, [ebp - 0x1660]
push edx
call fcn.1009db9f
mov dword [ebp - 0x359c], eax
jmp 0x1001bf1b
push str.S_1_5_11
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001bcb9
push bind
push 0
push 0x100
lea edx, [ebp - 0x1660]
push edx
call fcn.1009da4e
mov dword [ebp - 0x35a0], eax
cmp dword [ebp - 0x35a0], 0
jl 0x1001bcb4
push bind
push str.Authenticated_User
push 0
push 0x100
lea eax, [ebp - 0x1660]
push eax
call fcn.1009db9f
mov dword [ebp - 0x35a0], eax
jmp 0x1001bf1b
push str.S_1_5_3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
push edx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001bd20
push bind
push 0
push 0x100
lea eax, [ebp - 0x1660]
push eax
call fcn.1009da4e
mov dword [ebp - 0x35a4], eax
cmp dword [ebp - 0x35a4], 0
jl 0x1001bd1b
push bind
push str.System_Batch
push 0
push 0x100
lea ecx, [ebp - 0x1660]
push ecx
call fcn.1009db9f
mov dword [ebp - 0x35a4], eax
jmp 0x1001bf1b
push str.S_1_5_1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
push eax
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001bd87
push bind
push 0
push 0x100
lea ecx, [ebp - 0x1660]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x35a8], eax
cmp dword [ebp - 0x35a8], 0
jl 0x1001bd82
push bind
push str.Dialup
push 0
push 0x100
lea edx, [ebp - 0x1660]
push edx
call fcn.1009db9f
mov dword [ebp - 0x35a8], eax
jmp 0x1001bf1b
push str.S_1_1_0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001bdee
push bind
push 0
push 0x100
lea edx, [ebp - 0x1660]
push edx
call fcn.1009da4e
mov dword [ebp - 0x35ac], eax
cmp dword [ebp - 0x35ac], 0
jl 0x1001bde9
push bind
push str.Everyone
push 0
push 0x100
lea eax, [ebp - 0x1660]
push eax
call fcn.1009db9f
mov dword [ebp - 0x35ac], eax
jmp 0x1001bf1b
push str.S_1_5_18
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
push edx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001be55
push bind
push 0
push 0x100
lea eax, [ebp - 0x1660]
push eax
call fcn.1009da4e
mov dword [ebp - 0x35b0], eax
cmp dword [ebp - 0x35b0], 0
jl 0x1001be50
push bind
push str.Local_System
push 0
push 0x100
lea ecx, [ebp - 0x1660]
push ecx
call fcn.1009db9f
mov dword [ebp - 0x35b0], eax
jmp 0x1001bf1b
push str.S_1_5_4
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
push eax
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001beb9
push bind
push 0
push 0x100
lea ecx, [ebp - 0x1660]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x35b4], eax
cmp dword [ebp - 0x35b4], 0
jl 0x1001beb7
push bind
push str.System_Interactive
push 0
push 0x100
lea edx, [ebp - 0x1660]
push edx
call fcn.1009db9f
mov dword [ebp - 0x35b4], eax
jmp 0x1001bf1b
push str.S_1_5_13
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1001bf1b
push bind
push 0
push 0x100
lea edx, [ebp - 0x1660]
push edx
call fcn.1009da4e
mov dword [ebp - 0x35b8], eax
cmp dword [ebp - 0x35b8], 0
jl 0x1001bf1b
push bind
push str.Terminal_Services
push 0
push 0x100
lea eax, [ebp - 0x1660]
push eax
call fcn.1009db9f
mov dword [ebp - 0x35b8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
push edx
call fcn.1009ecbb
add esp, 4
cmp eax, 0xc
jbe 0x1001bfc6
push 0x100d7d68
lea eax, [ebp - 0x1660]
push eax
call fcn.1009ebf1
add esp, 8
test eax, eax
je 0x1001bfc6
movzx ecx, word [ebp - 0x1660]
cmp ecx, 0x27
jne 0x1001bfa2
lea edx, [ebp - 0x165e]
push edx
push 0x100d7814
push 0x80
mov eax, dword [0x100f4c54]
add eax, 0x150a
push eax
call fcn.10003de0
add esp, 0x10
mov ecx, dword [0x100f4c54]
add ecx, 0x150a
push ecx
call fcn.1009ecbb
add esp, 4
xor edx, edx
mov ecx, dword [0x100f4c54]
mov word [ecx + eax*2 + 0x1508], dx
jmp 0x1001bfc6
lea edx, [ebp - 0x1660]
push edx
push 0x100d7814
push 0x80
mov eax, dword [0x100f4c54]
add eax, 0x150a
push eax
call fcn.10003de0
add esp, 0x10
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x28]
cmp edx, 1
jne 0x1001c329
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x12]
push ecx
push str.Add_Process__p__n
call fcn.10010cb0
add esp, 8
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x12]
mov dword [ebp - 0x3568], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x3568]
push edx
mov ecx, dword [ebp - 0x35bc]
add ecx, 0x210
call fcn.1001cc90
mov dword [ebp - 0x25fc], 0
push 0x208
push 0
lea eax, [ebp - 0x438]
push eax
call fcn.1009eb40
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x2600], edx
jmp 0x1001c04f
mov eax, dword [ebp - 0x2600]
add eax, 2
mov dword [ebp - 0x2600], eax
mov ecx, dword [ebp - 0x2600]
movzx edx, word [ecx]
test edx, edx
je 0x1001c0d0
mov eax, dword [ebp - 0x25fc]
mov ecx, dword [ebp - 0x2600]
mov dx, word [ecx]
mov word [ebp + eax*2 - 0x438], dx
xor eax, eax
mov ecx, dword [ebp - 0x25fc]
mov word [ebp + ecx*2 - 0x436], ax
mov edx, dword [ebp - 0x25fc]
add edx, 2
cmp edx, 0x104
jle 0x1001c096
jmp 0x1001c0d0
mov eax, dword [ebp - 0x25fc]
add eax, 1
mov dword [ebp - 0x25fc], eax
mov ecx, dword [ebp - 0x2600]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0x1001c0c1
mov eax, dword [ebp - 0x2600]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x1001c0cb
mov dword [ebp - 0x25fc], 0
jmp 0x1001c040
lea ecx, [ebp - 0x25f8]
call fcn.10073e10
mov dword [ebp - 0x35d4], eax
mov byte [ebp - 4], 6
push 1
push str.Applications
lea ecx, [ebp - 0x25f8]
call fcn.10073fb0
push str.Machine
lea ecx, [ebp - 0x25f8]
call fcn.10074820
push str.StartTimeStamp
lea ecx, [ebp - 0x25f8]
call fcn.100746a0
lea ecx, [ebp - 0x25f8]
call fcn.10074350
push 1
push str.StillRunning
lea ecx, [ebp - 0x25f8]
call fcn.100745d0
push 0xffffffffffffffff
push 0x100e61bc
push str.HasGUI
lea ecx, [ebp - 0x25f8]
call fcn.10074400
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 0x16]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
push edx
push str.ImagePath
lea ecx, [ebp - 0x25f8]
call fcn.10074400
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xe]
push eax
push str.ParentPath
lea ecx, [ebp - 0x25f8]
call fcn.10074400
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1e]
push ecx
push str.CommandLine
lea ecx, [ebp - 0x25f8]
call fcn.10074400
push 0xffffffffffffffff
lea edx, [ebp - 0x1660]
push edx
push str.WindowsUser
lea ecx, [ebp - 0x25f8]
call fcn.10074400
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
push str.WindowsUserSID
lea ecx, [ebp - 0x25f8]
call fcn.10074400
push 0xffffffffffffffff
lea edx, [ebp - 0x230]
push edx
push str.WindowsDomain
lea ecx, [ebp - 0x25f8]
call fcn.10074400
mov eax, dword [ebp - 0x25fc]
push eax
lea ecx, [ebp - 0x438]
push ecx
push str.ShortName
lea ecx, [ebp - 0x25f8]
call fcn.10074400
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x12]
cdq
push edx
push eax
push str.ProcessID
lea ecx, [ebp - 0x25f8]
call fcn.10074500
push str.DateCode
lea ecx, [ebp - 0x25f8]
call fcn.10074780
lea eax, [ebp - 0x25f8]
push eax
mov ecx, 0x100f57d0
call fcn.10073b60
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x12]
push edx
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [0x100f4c54]
call fcn.1000b370
mov byte [ebp - 0x35d5], al
movzx ecx, byte [ebp - 0x35d5]
test ecx, ecx
je 0x1001c291
push str.Blocked_Application
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x12]
push eax
mov ecx, dword [0x100f4c54]
call fcn.1000d700
jmp 0x1001c315
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x12]
push edx
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2604], eax
cmp dword [ebp - 0x2604], 0
je 0x1001c301
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x2604]
push ecx
push str.____Injecting_into_process__p___ws__complete
call fcn.10010cb0
add esp, 0xc
push str.StartupFusionUser
push str.FusionUser.dll
mov edx, dword [ebp - 0x2604]
push edx
call fcn.100021d0
add esp, 0xc
mov eax, dword [ebp - 0x2604]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x2e6], 1
jmp 0x1001c315
lea edx, [ebp - 0x438]
push edx
push str.____Failed_to_open_process_for_inject___ws_
call fcn.10010cb0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25f8]
call fcn.10073ef0
jmp 0x1001c540
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x356c], eax
lea ecx, [ebp - 0x356c]
push ecx
mov ecx, dword [ebp - 0x35bc]
add ecx, 0x210
call fcn.1001ccf0
mov dword [ebp - 0x35dc], eax
mov edx, dword [ebp - 0x35dc]
mov dword [ebp - 0x2608], edx
cmp dword [ebp - 0x2608], 0
je 0x1001c37d
mov eax, dword [ebp - 0x2608]
push eax
mov ecx, dword [ebp - 0x35bc]
add ecx, 0x210
call fcn.1001ccb0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x3574], ecx
mov edx, dword [ebp - 0x3574]
mov dword [ebp - 0x3570], edx
cmp dword [ebp - 0x3570], 0
je 0x1001c3cd
mov ecx, dword [ebp - 0x3570]
call fcn.10018d60
mov eax, 1
and eax, 1
je 0x1001c3bf
mov ecx, dword [ebp - 0x3570]
push ecx
call fcn.1009ea5c
add esp, 4
mov edx, dword [ebp - 0x3570]
mov dword [ebp - 0x35e0], edx
jmp 0x1001c3d7
mov dword [ebp - 0x35e0], 0
lea ecx, [ebp - 0x2de8]
call fcn.10073e10
mov dword [ebp - 0x35e4], eax
mov byte [ebp - 4], 7
push 1
push str.Applications
lea ecx, [ebp - 0x2de8]
call fcn.10073fb0
push 0
push str.StillRunning
lea ecx, [ebp - 0x2de8]
call fcn.100745d0
push str.EndTimeStamp
lea ecx, [ebp - 0x2de8]
call fcn.100746a0
push 0x100f4c1c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x12]
cdq
push edx
push eax
push str.ProcessID_I64d_AND_SessionID_ws
push 0x80
lea ecx, [ebp - 0x2688]
push ecx
call fcn.10003100
add esp, 0x18
lea edx, [ebp - 0x2688]
push edx
lea eax, [ebp - 0x2de8]
push eax
call fcn.10073f30
add esp, 8
lea ecx, [ebp - 0x2de8]
push ecx
mov ecx, 0x100f57d0
call fcn.10073b60
mov ecx, dword [ebp - 0x14]
call fcn.100190f0
push str.explorer.exe
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x39]
push eax
call fcn.100c8f25
add esp, 8
test eax, eax
jne 0x1001c531
lea ecx, [ebp - 0x3548]
call fcn.10073e10
mov dword [ebp - 0x35e8], eax
mov byte [ebp - 4], 8
push 0
push str.EventsLogin
lea ecx, [ebp - 0x3548]
call fcn.10073fb0
push str.LogoutTime
lea ecx, [ebp - 0x3548]
call fcn.100746a0
push 0
push str.Active
lea ecx, [ebp - 0x3548]
call fcn.100745d0
mov ecx, dword [0x100f4c54]
add ecx, 0x150a
push ecx
push str.Active1_AND_WindowsUser_ws
lea edx, [ebp - 0x3548]
push edx
call fcn.10073f30
add esp, 0xc
lea eax, [ebp - 0x3548]
push eax
mov ecx, 0x100f57d0
call fcn.10073b60
push 0x100e6310
push str.GatewayExeLogin
mov ecx, dword [0x100f4c54]
call fcn.1000b6b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3548]
call fcn.10073ef0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2de8]
call fcn.10073ef0
jmp 0x1001c54f
mov dword [ebp - 4], 0xffffffff
jmp 0x1001c563
mov ecx, dword [ebp - 0x1460]
call fcn.1007f950
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1001b799
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret