Function at 0x1000d5e0
Capabilities:
Check mutex on windows
Create thread
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push 0x1002d4e8
mov dword [ebp - 8], esi
call edi
mov eax, 0x1002d4e0
mov dword [0x1002d4e4], eax
mov dword [0x1002d4e0], eax
mov dword [0x1002d504], esi
push 0x5c
mov dword [0x1002d500], esi
call fcn.100012ea
mov dword [0x1002d454], eax
cmp eax, esi
je 0x1000d670
push 0x5c
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [0x1002d454]
add esp, 0xc
add eax, 0x40
push eax
call edi
push 0x1002e263
xor eax, eax
call fcn.1001282f
mov ecx, dword [0x1002d454]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], 0x4eb7d2ca
mov dword [ecx + 0x2c], 0x1002c51c
mov dword [ecx + 0x34], 1
mov dword [ecx], 0x1002f1bd
xor eax, eax
jmp 0x1000d673
push 8
pop eax
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94b
push ebx
push dword [0x1002d200]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1002d204], eax
call ebx
mov ecx, dword [0x1002d204]
cmp ecx, esi
je 0x1000d6c0
cmp eax, 0xb7
jne 0x1000d6be
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002d204], esi
jmp 0x1000d947
xor eax, eax
cmp eax, esi
jne 0x1000d947
call fcn.100113d7
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94a
call fcn.1000b8fe
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94a
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 8]
push eax
push esi
call edi
cmp dword [ebp - 8], esi
je 0x1000d71a
push dword [ebp - 8]
push esi
push dword [0x1002d128]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002d154], eax
cmp eax, esi
je 0x1000d71a
lea ecx, [ebp - 8]
push ecx
push eax
call edi
call fcn.1001306e
xor ecx, ecx
cmp eax, 0x57
mov eax, dword [0x1002d1d8]
sete cl
inc ecx
mov dword [0x1002d4d4], ecx
cmp eax, 0x7a4ab374
je 0x1000d741
cmp eax, 0x5afb7e2a
jne 0x1000d787
lea eax, [ebp - 0x10]
push eax
push 0x18
lea eax, [ebp - 0x28]
push eax
push esi
push dword [0x1002d224]
xor edi, edi
call dword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
test eax, eax
jl 0x1000d761
mov edi, dword [ebp - 0x14]
push edi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
jne 0x1000d77b
call ebx
cmp eax, 5
jne 0x1000d782
jmp 0x1000d7af
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1002d1d8]
cmp eax, 0xbb272c80
je 0x1000d7af
cmp eax, 0x4e1dcf8f
je 0x1000d7af
cmp eax, 0x1545f149
je 0x1000d7af
push dword [ebp + 8]
call fcn.10018170
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94a
call fcn.1000d538
call fcn.1000b552
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94a
call fcn.10003ed1
push 0x18
push esi
push dword [0x1002d128]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002d194], eax
cmp eax, esi
je 0x1000d94a
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax + 4], esi
mov dword [eax], esi
lea edi, [eax + 4]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1000d23a
push esi
push esi
call ebx
mov ecx, dword [0x1002d194]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000d94a
inc eax
cmp dword [0x1002d1d8], 0x79405f4
mov dword [edi], eax
jne 0x1000d8c1
push 0x1002d1e0
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call fcn.10018ea5
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94a
test byte [0x1002c4f0], 4
je 0x1000d868
mov dword [0x1002d330], edi
mov dword [0x1002d37c], edi
mov dword [0x1002d348], edi
push section..bss
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000d888
push edi
push 0x1002cb34
push edi
push 0x1002cb28
call fcn.1000b41c
mov eax, dword [0x1002d194]
mov ecx, dword [eax + 4]
lea eax, [eax + ecx*4 + 8]
push eax
call fcn.1000bfee
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d94a
mov eax, dword [0x1002d194]
inc dword [eax + 4]
cmp dword [0x1002d148], esi
je 0x1000d8ce
push 0x1002d144
call fcn.10001e7d
jmp 0x1000d8ce
cmp dword [0x1002d238], esi
je 0x1000d8ce
call fcn.1000d175
mov eax, dword [0x1002d1d8]
cmp eax, esi
je 0x1000d947
cmp eax, 0x79405f4
jne 0x1000d918
push 0x43
push esi
push dword [0x1002d128]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002d2c4], eax
cmp eax, esi
je 0x1000d918
mov ecx, dword [0x1002d22c]
movzx edx, ch
push 0x10027417
push edx
movzx ecx, cl
push ecx
push 0x1002e11e
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [0x1002d194]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1000544f
push esi
push esi
add edi, 4
call ebx
mov ecx, dword [0x1002d194]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000d94a
inc eax
mov dword [edi], eax
mov dword [ebp - 4], esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4