Function at 0x100095d0
Capabilities:
Check mutex on windows
Check os version
Compare security identifiers
Create process on windows
Enumerate processes
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088547
mov eax, dword fs:[0]
push eax
mov eax, 0x1374
call fcn.10021150
mov eax, dword [0x100ac06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x110
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x698], 0x114
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100096ec
cmp dword [ebp - 0x694], 5
jne 0x100096ec
cmp dword [ebp - 0x690], 0
jne 0x100096ec
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10009671
call esi
mov esi, eax
jmp 0x10009879
push 0x228
xor ebx, ebx
lea eax, [ebp - 0x1284]
push ebx
push eax
mov esi, 0x490
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x1288], 0x22c
lea eax, [ebp - 0x1288]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push edi
call eax
test eax, eax
je 0x10009826
nop
lea eax, [ebp - 0x1264]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x100096df
lea eax, [ebp - 0x1288]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100096b0
jmp 0x1000982e
mov ebx, dword [ebp - 0x1280]
xor esi, esi
jmp 0x1000982e
lea eax, [ebp - 0x12c0]
xor ebx, ebx
push eax
lea eax, [ebp - 0x12c4]
mov dword [ebp - 0x12c4], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x12c0], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x10009757
mov edx, dword [ebp - 0x12c0]
xor eax, eax
mov edi, dword [ebp - 0x12c4]
mov esi, 0x490
test edx, edx
je 0x10009746
lea ecx, [edi + 8]
cmp dword [ecx], ebx
je 0x1000973e
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10009730
jmp 0x10009746
lea eax, [eax + eax*2]
xor esi, esi
mov ebx, dword [edi + eax*4]
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x1000978e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009782
push 0x100aeaf0
push ebx
call eax
test eax, eax
jne 0x10009882
call esi
mov esi, eax
test esi, esi
je 0x10009882
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100097ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10009879
push 0x228
xor ebx, ebx
lea eax, [ebp - 0x1058]
push ebx
push eax
mov esi, 0x490
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x105c], 0x22c
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push edi
call eax
test eax, eax
je 0x10009826
nop word [eax + eax]
lea eax, [ebp - 0x1038]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x1000981c
lea eax, [ebp - 0x105c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100097f0
jmp 0x1000982e
mov ebx, dword [ebp - 0x1054]
xor esi, esi
jmp 0x1000982e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebx
push 0
push 0x400
call eax
mov edi, eax
test edi, edi
jne 0x10009854
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10009879
mov eax, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x100aeaf0
push 0xf01ff
push edi
call eax
test eax, eax
jne 0x10009872
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x1000aed5
push 1
lea eax, [ebp - 0x133c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x133c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [0x100af954], 8
lea eax, [ebp - 0x133c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, 0x100af940
mov dword [ebp - 0x1324], eax
mov eax, esi
cmovae eax, dword [0x100af940]
push eax
push 0
lea eax, [ebp - 0x1328]
mov dword [ebp - 0x1328], 0xc
push eax
call edi
cmp dword [0x100af954], 8
push 0x10003df0
cmovae esi, dword [0x100af940]
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x100af9a8], eax
test eax, eax
je 0x1000aed5
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea eax, [ebp - 0x460]
push eax
push dword [0x100af9a8]
mov dword [ebp - 0x460], 0x20
mov dword [0x100af9ac], 2
mov dword [ebp - 0x45c], 2
mov dword [ebp - 0x458], 7
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 1
mov dword [ebp - 0x448], 0xbb8
call esi
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0x20
push eax
push dword [0x100af9a8]
mov dword [0x100af9ac], 4
mov dword [ebp - 0x440], 4
mov dword [ebp - 0x43c], 7
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0xbb8
call esi
push 0x25
mov edx, 0x100a5918
lea ecx, [ebp - 0x428]
call fcn.10002360
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x100099f6
mov eax, dword [eax]
push eax
push 0
push 0
call edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x414]
cmp eax, 8
jb 0x10009a22
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.1000c440
xor eax, eax
mov dword [ebp - 0x414], 7
mov dword [ebp - 0x418], 0
mov word [ebp - 0x428], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10009a5d
push 1
push 0x100a5878
mov ecx, 0x100af928
call fcn.1000ba10
xor eax, eax
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
lea eax, [ebp - 0x308]
mov dword [ebp - 4], 1
push eax
push 3
call fcn.10014210
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x57e40
call ebx
call fcn.10007540
push 0
call fcn.10067b4f
movsd xmm0, qword [0x100a6978]
mov esi, eax
mov edi, edx
mov dword [ebp - 0x12e4], esi
add esp, 4
mov dword [ebp - 0x12c8], edi
movsd qword [ebp - 0x12f0], xmm0
push 0
call fcn.10067b4f
push edi
push esi
push edx
push eax
call fcn.10064e87
fstp qword [ebp - 0x1298]
movsd xmm0, qword [ebp - 0x1298]
add esp, 0x14
comisd xmm0, xmmword [ebp - 0x12f0]
jbe 0x10009b2e
push 0
call fcn.10067b4f
xorps xmm0, xmm0
mov dword [ebp - 0x12e4], eax
add esp, 4
mov dword [ebp - 0x12c8], edx
movlpd qword [0x100aeaf8], xmm0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x1294], esp
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100af888
mov word [ecx], ax
call fcn.1000bb10
mov byte [ebp - 4], 2
mov eax, dword [0x100af820]
test eax, 0xfffffffe
jne 0x10009ba1
mov ecx, 1
xor eax, eax
mov edx, 0x100af820
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10009b97
mov eax, dword [0x100af820]
cmp eax, 1
jne 0x10009ba1
push 0
call ebx
mov eax, dword [0x100af820]
cmp eax, 1
je 0x10009b87
jmp 0x10009ba1
mov dword [0x100af820], 0x100af824
mov eax, dword [0x100af820]
mov byte [ebp - 4], 1
call fcn.1001d000
xor edx, edx
mov ecx, 0x100af888
call fcn.10011de0
cmp byte [0x100aca50], 0
je 0x1000a599
mov eax, dword [0x100aeb00]
or eax, dword [0x100aeb04]
je 0x1000a599
call fcn.10008860
mov esi, eax
mov edi, edx
mov ecx, esi
or ecx, edi
je 0x10009c3d
push 0
call fcn.10067b4f
push edi
push esi
push edx
push eax
call fcn.10064e87
add esp, 0x14
fstp qword [ebp - 0x1298]
push dword [0x100aca74]
push dword [0x100aca70]
push 0
push 0x18
call fcn.10083780
push 0
push 0xe10
push edx
push eax
call fcn.10020be0
mov ecx, eax
call fcn.10083b80
movsd xmm1, qword [ebp - 0x1298]
comisd xmm1, xmm0
jbe 0x1000a599
push ecx
mov edx, 0x100af8d8
lea ecx, [ebp - 0x368]
call fcn.10012500
add esp, 4
mov byte [ebp - 4], 4
lea ebx, [ebp - 0x368]
cmp dword [ebp - 0x354], 0x10
cmovae ebx, dword [ebp - 0x368]
mov dword [ebp - 0x1294], ebx
test ebx, ebx
je 0x1000a55c
push 0x104
lea eax, [ebp - 0x16c]
push 0
push eax
call fcn.10062800
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009c92
sub ecx, edx
cmp ecx, 2
jbe 0x10009cbd
cmp byte [ebx + 1], 0x3a
jne 0x10009cbd
push ebx
lea eax, [ebp - 0x16c]
push 0x104
push eax
call fcn.100650d8
add esp, 0xc
jmp 0x10009cec
push 0x104
lea eax, [ebp - 0x16c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push ebx
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push ecx
mov dword [ebp - 0x1290], 0
call fcn.10001a00
add esp, 4
test al, al
jne 0x10009fa8
push 0x110
lea eax, [ebp - 0x580]
push 0
push eax
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x584], 0x114
lea eax, [ebp - 0x584]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10009e4f
cmp dword [ebp - 0x580], 5
jne 0x10009e4f
cmp dword [ebp - 0x57c], 0
jne 0x10009e4f
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10009d7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
jmp 0x1000a18f
push 0x228
xor ebx, ebx
lea eax, [ebp - 0xe2c]
push ebx
push eax
mov esi, 0x490
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0xe30], 0x22c
lea eax, [ebp - 0xe30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10009de8
lea eax, [ebp - 0xe0c]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x10009dde
lea eax, [ebp - 0xe30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009db2
jmp 0x10009df0
mov ebx, dword [ebp - 0xe28]
xor esi, esi
jmp 0x10009df0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10009e1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
jmp 0x1000a18f
lea eax, [ebp - 0x1290]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10009e3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x1000a18f
lea eax, [ebp - 0x12e0]
xor ebx, ebx
push eax
lea eax, [ebp - 0x12dc]
mov dword [ebp - 0x12dc], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x12e0], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x10009eb4
mov edx, dword [ebp - 0x12e0]
xor eax, eax
mov edi, dword [ebp - 0x12dc]
mov esi, 0x490
test edx, edx
je 0x10009ea9
lea ecx, [edi + 8]
cmp dword [ecx], ebx
je 0x10009ea1
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10009e93
jmp 0x10009ea9
lea eax, [eax + eax*2]
xor esi, esi
mov ebx, dword [edi + eax*4]
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x10009ef7
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10009edb
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
jmp 0x10009efd
lea ecx, [ebp - 0x1290]
push ecx
push ebx
call eax
test eax, eax
jne 0x10009ef5
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
jmp 0x10009efd
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x10009f9d
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10009f25
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, eax
jmp 0x1000a18f
push 0x228
xor ebx, ebx
lea eax, [ebp - 0xc00]
push ebx
push eax
mov esi, 0x490
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0xc04], 0x22c
lea eax, [ebp - 0xc04]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10009de8
lea eax, [ebp - 0xbe0]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x10009f90
lea eax, [ebp - 0xc04]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009f61
jmp 0x10009df0
mov ebx, dword [ebp - 0xbfc]
xor esi, esi
jmp 0x10009df0
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x1000a18d
lea eax, [ebp - 0x12d8]
mov dword [ebp - 0x129c], 0
push eax
lea eax, [ebp - 0x12d4]
xor ebx, ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x12d4], ebx
mov dword [ebp - 0x12d8], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x1000a017
mov edx, dword [ebp - 0x12d8]
xor eax, eax
mov edi, dword [ebp - 0x12d4]
mov esi, 0x490
test edx, edx
je 0x1000a00c
lea ecx, [edi + 8]
cmp dword [ecx], ebx
je 0x1000a004
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10009ff6
jmp 0x1000a00c
lea eax, [eax + eax*2]
xor esi, esi
mov ebx, dword [edi + eax*4]
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x1000a05a
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000a03e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
jmp 0x1000a060
lea ecx, [ebp - 0x129c]
push ecx
push ebx
call eax
test eax, eax
jne 0x1000a058
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
jmp 0x1000a060
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x1000a158
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000a082
call ebx
mov edi, eax
jmp 0x1000a149
push 0x228
xor ebx, ebx
lea eax, [ebp - 0x9d4]
push ebx
push eax
mov edi, 0x490
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x9d8], 0x22c
lea eax, [ebp - 0x9d8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000a0f6
nop word [eax + eax]
lea eax, [ebp - 0x9b4]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x1000a0ec
lea eax, [ebp - 0x9d8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000a0c0
jmp 0x1000a0fe
mov ebx, dword [ebp - 0x9d0]
xor edi, edi
jmp 0x1000a0fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x1000a123
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1000a149
lea eax, [ebp - 0x129c]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000a142
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000a158
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
or esi, 0xffffffff
jmp 0x1000a18f
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x130c]
push eax
push 4
lea eax, [ebp - 0x12e8]
push eax
push 0x13
push dword [ebp - 0x129c]
call edi
mov ecx, dword [ebp - 0x12e8]
test eax, eax
cmove ecx, dword [ebp - 0x129c]
mov dword [ebp - 0x1290], ecx
xor esi, esi
test esi, esi
jne 0x1000a54b
push 0x40
lea eax, [ebp - 0x137c]
mov dword [ebp - 0x1380], 0x44
push esi
push eax
call fcn.10062800
add esp, 0xc
mov esi, dword [ebp - 0x1290]
lea eax, [ebp - 0x12b8]
mov dword [ebp - 0x12b8], 0
xorps xmm0, xmm0
mov dword [ebp - 0x278], 0
xor bl, bl
mov word [ebp - 0x274], 0x500
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x278]
mov byte [ebp - 0x1289], bl
push eax
movups xmmword [ebp - 0x131c], xmm0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1000a2b4
lea eax, [ebp - 0x12b4]
push eax
push 0
push 0
push 2
push esi
call edi
test eax, eax
jne 0x1000a244
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
jne 0x1000a2ba
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x12b4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [ebp - 0x12b4]
push eax
push dword [ebp - 0x12b4]
push ebx
push 2
push esi
call edi
test eax, eax
je 0x1000a2a3
xor edi, edi
cmp dword [ebx], edi
jbe 0x1000a2a3
lea esi, [ebx + 4]
nop dword [eax]
nop dword [eax + eax]
push dword [esi]
push dword [ebp - 0x12b8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000a29c
inc edi
add esi, 8
cmp edi, dword [ebx]
jb 0x1000a280
jmp 0x1000a2a3
mov byte [ebp - 0x1289], 1
test ebx, ebx
je 0x1000a2ae
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov bl, byte [ebp - 0x1289]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x12b8]
test eax, eax
je 0x1000a2cb
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test bl, bl
jne 0x1000a436
lea eax, [ebp - 0x12d0]
mov dword [ebp - 0x12a0], 0
push eax
lea eax, [ebp - 0x12cc]
mov dword [ebp - 0x12a4], 0
push eax
push 1
push 0
push 0
mov dword [ebp - 0x12bc], 0
mov dword [ebp - 0x12cc], 0
mov dword [ebp - 0x12d0], 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x1000a36e
push 0x110
push eax
lea eax, [ebp - 0x7a8]
push eax
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x7ac], 0x114
lea eax, [ebp - 0x7ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000a362
cmp dword [ebp - 0x7a8], 6
jne 0x1000a362
call edi
mov edi, eax
jmp 0x1000a3ac
mov dword [ebp - 0x12bc], 0
jmp 0x1000a3b4
mov edx, dword [ebp - 0x12d0]
xor eax, eax
mov esi, dword [ebp - 0x12cc]
mov edi, 0x490
test edx, edx
je 0x1000a3a5
lea ecx, [esi + 8]
cmp dword [ecx], 0
je 0x1000a397
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x1000a388
jmp 0x1000a3a5
lea eax, [eax + eax*2]
xor edi, edi
mov eax, dword [esi + eax*4]
mov dword [ebp - 0x12bc], eax
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test edi, edi
jne 0x1000a436
lea eax, [ebp - 0x12a0]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x12a0]
test eax, eax
je 0x1000a436
lea ecx, [ebp - 0x12a4]
push ecx
push 1
push 1
push 0
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [ebp - 0x12a4], 0
push dword [ebp - 0x12a0]
jne 0x1000a404
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000a436
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
lea eax, [ebp - 0x12bc]
push eax
push 0xc
push dword [ebp - 0x12a4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov ecx, dword [ebp - 0x1290]
test eax, eax
cmovne ecx, dword [ebp - 0x12a4]
mov dword [ebp - 0x1290], ecx
push str.userenv.dll
mov dword [ebp - 0x1378], str.Winsta0Default
xor ebx, ebx
mov dword [ebp - 0x12ac], 0x30
mov dword [ebp - 0x12a8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000a4b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push esi
call ebx
push str.DestroyEnvironmentBlock
push esi
mov edi, eax
call ebx
mov ebx, eax
test edi, edi
je 0x1000a4b0
push 0
push dword [ebp - 0x1290]
lea eax, [ebp - 0x12a8]
push eax
call edi
test eax, eax
je 0x1000a4a6
mov dword [ebp - 0x12ac], 0x430
jmp 0x1000a4b0
mov dword [ebp - 0x12a8], 0
push 0x104
lea eax, [ebp - 0x270]
push 0
push eax
call fcn.10062800
push dword [ebp - 0x1294]
lea eax, [ebp - 0x270]
push 0x103
push eax
call fcn.100650d8
add esp, 0x18
lea eax, [ebp - 0x131c]
push eax
lea eax, [ebp - 0x1380]
push eax
push 0
push dword [ebp - 0x12a8]
lea eax, [ebp - 0x270]
push dword [ebp - 0x12ac]
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x1290]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov eax, dword [ebp - 0x131c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000a527
push eax
call edi
mov eax, dword [ebp - 0x1318]
test eax, eax
je 0x1000a534
push eax
call edi
test ebx, ebx
je 0x1000a540
push dword [ebp - 0x12a8]
call ebx
test esi, esi
je 0x1000a54b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x1290]
test eax, eax
je 0x1000a55c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x354]
cmp eax, 0x10
jb 0x1000a57e
inc eax
lea ecx, [ebp - 0x368]
push eax
push dword [ebp - 0x368]
call fcn.1000c330
mov dword [ebp - 0x354], 0xf
mov dword [ebp - 0x358], 0
mov byte [ebp - 0x368], 0
xor eax, eax
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c4], 7
mov dword [ebp - 0x2c8], 0
mov word [ebp - 0x2d8], ax
mov byte [ebp - 4], 5
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], eax
mov word [ebp - 0x290], ax
mov byte [ebp - 4], 6
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2ac], 7
mov dword [ebp - 0x2b0], eax
mov word [ebp - 0x2c0], ax
xorps xmm0, xmm0
mov byte [ebp - 4], 7
movlpd qword [ebp - 0x12b0], xmm0
call 0x1000a62c
pop eax
add eax, 0xf
push eax
xor eax, eax
mov eax, ecx
ret
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100205ba
mov esp, ebp
pop ebp
ret 8