Function at 0x964550
Capabilities:
Check os version

Disassembly:
sub esp, 0x43c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x438], eax
test byte [0xc0ec14], 1
push ebx
push ebp
push esi
push edi
mov ebp, 1
jne 0x9645a9
or dword [0xc0ec14], ebp
cmp dword [0xbfc9d0], 0
jne 0x96459f
mov dword [0xbfc9d0], ebp
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x96459f
cmp al, 6
jb 0x96459f
mov dword [0xbfc9d4], ebp
mov eax, dword [0xbfc9d4]
mov dword [0xc0ec10], eax
mov eax, 2
test byte [0xc0ec14], al
jne 0x9645c6
or dword [0xc0ec14], eax
call fcn.00968db0
mov dword [0xc0ec0c], eax
mov eax, 4
test byte [0xc0ec14], al
jne 0x9645e3
or dword [0xc0ec14], eax
call fcn.00968e40
mov dword [0xc0ec08], eax
mov eax, 8
test byte [0xc0ec14], al
jne 0x964600
or dword [0xc0ec14], eax
call fcn.009686d0
mov dword [0xc0ec04], eax
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x14], esi
cmp dword [0xc0ec10], ebx
jne 0x964636
push str.GlobalShellReadyEvent
push ebx
push 0x1f0003
call edi
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, ebx
je 0x964636
cmp esi, 0xffffffff
jne 0x96494a
xor ecx, ecx
call fcn.009790d0
test eax, eax
je 0x9648b8
cmp dword [0xc0ec08], ebx
jne 0x964659
cmp dword [0xc0ec04], ebx
je 0x9648b8
push 0x103
lea ecx, [esp + 0x341]
push ebx
push ecx
mov byte [esp + 0x348], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x239]
push ebx
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [esp + 0x234], bl
cmp dword [0xbfc958], ebx
jne 0x964713
mov ecx, str.Wtsapi32.dll
call fcn.0094c620
mov dword [0xbfc958], eax
cmp eax, ebx
je 0x9646da
cmp eax, 0xffffffff
je 0x9646da
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSFreeMemory
push eax
call edi
mov dword [0xbfc950], eax
mov eax, dword [0xbfc958]
push str.WTSEnumerateSessionsA
push eax
call edi
mov dword [0xbfc954], eax
jmp 0x964718
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x340]
call fcn.00960a40
add esp, 4
push eax
lea ecx, [esp + 0x238]
push str.Unable_to_load_Wtsapi32.dll__Reason:__s
push ecx
call fcn.00a78f30
add esp, 0xc
xor eax, eax
jmp 0x964982
mov eax, dword [0xbfc954]
cmp dword [0xbfc950], ebx
je 0x96489c
cmp eax, ebx
je 0x96489c
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
push ecx
push ebp
push ebx
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call eax
test eax, eax
jne 0x964780
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x340]
call fcn.00960a40
add esp, 4
push eax
lea edx, [esp + 0x238]
push str.Unable_to_Enumerate_Sessions__Reason:__s
push edx
call fcn.00a78f30
add esp, 0xc
xor eax, eax
jmp 0x964982
mov ebp, dword [esp + 0x1c]
cmp ebp, ebx
jne 0x96479e
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x964797
push eax
call dword [0xbfc950]
xor eax, eax
jmp 0x964982
mov dword [esp + 0x20], ebx
cmp ebp, ebx
jbe 0x964882
lea ebx, [ebx]
mov eax, dword [esp + 0x18]
push 0x103
lea ecx, [esp + 0x29]
push 0
push ecx
lea edi, [ebx + eax]
mov byte [esp + 0x30], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x131]
push 0
push edx
mov byte [esp + 0x138], 0
call fcn.00a7ffb0
add esp, 0xc
test edi, edi
je 0x96486e
mov eax, dword [edi]
push eax
lea ecx, [esp + 0x28]
push str.Session_dShellReadyEvent
push ecx
call fcn.00a78f30
mov edx, dword [edi]
add esp, 0xc
push edx
lea eax, [esp + 0x130]
push str.Session_dShellDesktopSwitchEvent
push eax
call fcn.00a78f30
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x1f0003
call edi
mov esi, eax
mov dword [esp + 0x14], esi
call fcn.00964530
test eax, eax
jne 0x964882
cmp dword [0xc0ec10], eax
je 0x96486a
lea edx, [esp + 0x12c]
push edx
push eax
push 0x1f0003
call edi
mov esi, eax
mov dword [esp + 0x14], esi
call fcn.00964530
test eax, eax
jne 0x964882
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
inc eax
add ebx, 0xc
mov dword [esp + 0x20], eax
cmp eax, ebp
jb 0x9647b0
mov eax, dword [esp + 0x18]
xor ebx, ebx
cmp eax, ebx
je 0x96494a
push eax
call dword [0xbfc950]
jmp 0x96494a
lea eax, [esp + 0x234]
push str.Unable_to_get_ProcAddress_
push eax
call fcn.00a78f30
add esp, 8
xor eax, eax
jmp 0x964982
push 0x103
lea ecx, [esp + 0x131]
push ebx
push ecx
mov byte [esp + 0x138], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x29]
push ebx
push edx
mov byte [esp + 0x30], bl
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x12c]
push str.ShellReadyEvent
push eax
call fcn.00a78f30
lea ecx, [esp + 0x2c]
push str.ShellDesktopSwitchEvent
push ecx
call fcn.00a78f30
add esp, 0x10
lea edx, [esp + 0x12c]
push edx
push ebx
push 0x1f0003
call edi
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, ebx
je 0x96492f
cmp esi, 0xffffffff
jne 0x96494a
cmp dword [0xc0ec10], ebx
je 0x96494a
lea eax, [esp + 0x24]
push eax
push ebx
push 0x1f0003
call edi
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, ebx
je 0x96470c
cmp esi, 0xffffffff
je 0x96470c
cmp dword [0xc0ec0c], ebx
je 0x964967
xor esi, esi
jmp 0x964971
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00985290
xor eax, eax
cmp esi, ebx
sete al
mov ecx, dword [esp + 0x448]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x43c
ret