Function at 0x401000
Capabilities:
Create process on windows
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 3
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
mov dword [ebp - 0x1c], 3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x401080
mov edx, dword [ebp - 0x1c]
imul edx, edx, 3
mov dword [ebp - 0x20], edx
jmp 0x401065
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0
jmp 0x40109f
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x10]
jae 0x4016b7
mov dword [ebp - 0x30], 0
jmp 0x4010bd
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 8
jge 0x4010c5
jmp 0x4010b4
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
mov dword [ebp - 0x34], 5
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
test edx, edx
je 0x401105
mov ecx, dword [ebp - 0x34]
imul ecx, ecx, 5
mov dword [ebp - 0x38], ecx
jmp 0x4010ea
cmp dword [ebp - 0x28], 2
jbe 0x401652
mov dword [ebp - 0xd8], 0
jmp 0x40112a
mov edx, dword [ebp - 0xd8]
add edx, 1
mov dword [ebp - 0xd8], edx
cmp dword [ebp - 0xd8], 4
jge 0x401135
jmp 0x40111b
mov dword [ebp - 0x50], 0
mov dword [ebp - 0xdc], 0
jmp 0x401157
mov eax, dword [ebp - 0xdc]
add eax, 1
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 7
jge 0x401162
jmp 0x401148
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xe0], 0xa
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xe0]
sub edx, 1
mov dword [ebp - 0xe0], edx
test ecx, ecx
je 0x40119d
mov eax, dword [ebp - 0xe0]
imul eax, eax, 0xa
mov dword [ebp - 0xe4], eax
jmp 0x401173
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov dword [ebp - 0xe8], 9
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0xe8]
sub edx, 1
mov dword [ebp - 0xe8], edx
test ecx, ecx
je 0x4011e0
mov eax, dword [ebp - 0xe8]
imul eax, eax, 9
mov dword [ebp - 0xec], eax
jmp 0x4011b6
lea ecx, [ebp - 0x4c]
push ecx
push 1
push 1
push 0
push 0x2000000
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
add eax, 1
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp - 0xf0]
add ecx, 0xa
mov dword [ebp - 0xf0], ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xf4], 0
jmp 0x401253
mov ecx, dword [ebp - 0xf4]
add ecx, 1
mov dword [ebp - 0xf4], ecx
cmp dword [ebp - 0xf4], 0xa
jge 0x40125e
jmp 0x401244
lea edx, [ebp - 0x28]
push edx
push 4
lea eax, [ebp - 0xd4]
push eax
push 0x13
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x401286
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0x4c], edx
jmp 0x4012bb
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xf8], 0
mov ecx, dword [ebp - 0xf8]
add ecx, 1
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0xf8]
add edx, 6
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0xfc], 0
jmp 0x4012d6
mov eax, dword [ebp - 0xfc]
add eax, 1
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x4012e1
jmp 0x4012c7
mov dword [ebp - 0x3c], 0
push 0
mov ecx, dword [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x3c]
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x401302
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x100], 0
jmp 0x40131d
mov eax, dword [ebp - 0x100]
add eax, 1
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x401328
jmp 0x40130e
push 0x44
push 0
lea ecx, [ebp - 0xd0]
push ecx
call fcn.004021a0
add esp, 0xc
mov dword [ebp - 0x104], 0
mov edx, dword [ebp - 0x104]
add edx, 1
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 0x104]
add eax, 4
mov dword [ebp - 0x104], eax
mov ecx, 0x54
mov word [ebp - 0x84], cx
mov edx, 0x4a
mov word [ebp - 0x82], dx
mov eax, 0x4d
mov word [ebp - 0x80], ax
mov ecx, 0x50
mov word [ebp - 0x7e], cx
mov edx, 0x57
mov word [ebp - 0x7c], dx
mov eax, 0x42
mov word [ebp - 0x7a], ax
mov ecx, 0x13
mov word [ebp - 0x78], cx
mov edx, 0x7f
mov word [ebp - 0x76], dx
mov eax, 0x47
mov word [ebp - 0x74], ax
mov ecx, 0x46
mov word [ebp - 0x72], cx
mov edx, 0x45
mov word [ebp - 0x70], dx
mov eax, 0x42
mov word [ebp - 0x6e], ax
mov ecx, 0x56
mov word [ebp - 0x6c], cx
mov edx, 0x4f
mov word [ebp - 0x6a], dx
mov eax, 0x57
mov word [ebp - 0x68], ax
xor ecx, ecx
mov word [ebp - 0x66], cx
lea edx, [ebp - 0x84]
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0x108], 0
jmp 0x40141d
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 8
jge 0x401428
jmp 0x40140e
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x10c], 5
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
sub edx, 1
mov dword [ebp - 0x10c], edx
test ecx, ecx
je 0x401463
mov eax, dword [ebp - 0x10c]
imul eax, eax, 5
mov dword [ebp - 0x110], eax
jmp 0x401439
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov edx, dword [ebp - 0x64]
and edx, 0x80000001
jns 0x401487
dec edx
or edx, 0xfffffffe
inc edx
add ecx, edx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x114], 4
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x114]
sub ecx, 1
mov dword [ebp - 0x114], ecx
test eax, eax
je 0x4014c3
mov edx, dword [ebp - 0x114]
shl edx, 2
mov dword [ebp - 0x118], edx
jmp 0x401499
mov dword [ebp - 0x11c], 0
jmp 0x4014de
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xf
jae 0x401508
mov ecx, dword [ebp - 0x11c]
movzx edx, word [ebp + ecx*2 - 0x84]
xor edx, 0x23
mov eax, dword [ebp - 0x11c]
mov word [ebp + eax*2 - 0x84], dx
jmp 0x4014cf
mov dword [ebp - 0x120], 0
jmp 0x401523
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
cmp dword [ebp - 0x120], 7
jge 0x40152e
jmp 0x401514
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0xd0]
push eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x420
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x124], 0
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
add edx, 3
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x3c], 0
je 0x4015b9
mov dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x128]
add eax, 1
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp - 0x128]
add ecx, 9
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x3c]
push edx
call sub.USERENV.dll_DestroyEnvironmentBlock
mov dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
add eax, 1
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
add ecx, 9
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x130], 0
jmp 0x40160e
mov edx, dword [ebp - 0x130]
add edx, 1
mov dword [ebp - 0x130], edx
cmp dword [ebp - 0x130], 3
jae 0x40162a
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp + eax*4 - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4015ff
mov dword [ebp - 0x134], 0
mov edx, dword [ebp - 0x134]
add edx, 1
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x134]
add eax, 2
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], 0
jmp 0x40166d
mov ecx, dword [ebp - 0x138]
add ecx, 1
mov dword [ebp - 0x138], ecx
cmp dword [ebp - 0x138], 5
jge 0x401678
jmp 0x40165e
mov edx, dword [ebp - 0xc]
add edx, 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x13c]
sub ecx, 1
mov dword [ebp - 0x13c], ecx
test eax, eax
je 0x4016b2
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], edx
jmp 0x40168b
jmp 0x401096
mov dword [ebp - 0x144], 1
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x144]
sub ecx, 1
mov dword [ebp - 0x144], ecx
test eax, eax
je 0x4016e8
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x148], edx
jmp 0x4016c1
mov eax, dword [ebp - 4]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x14c], 0
jmp 0x40170c
mov ecx, dword [ebp - 0x14c]
add ecx, 1
mov dword [ebp - 0x14c], ecx
cmp dword [ebp - 0x14c], 3
jge 0x401717
jmp 0x4016fd
mov esp, ebp
pop ebp
ret