Function at 0x404221
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x5b0]
mov eax, 0x1560
call fcn.0040bf50
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp + 0x5ac], eax
mov eax, dword [ebp + 0x5b8]
and dword [eax], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push edi
push str.Kernel32.dll
mov dword [ebp + 0x74], eax
call ebx
mov edi, eax
test edi, edi
je 0x40456b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSGetActiveConsoleSessionId
push edi
call esi
test eax, eax
je 0x404564
call eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp + 0x64], eax
call edi
cmp dword [ebp + 0x64], 0xffffffff
je 0x40456b
push str.psapi.dll
call ebx
push str.advapi32.dll
mov dword [ebp + 0x80], eax
call ebx
xor ebx, ebx
cmp dword [ebp + 0x80], ebx
mov dword [ebp + 0x7c], eax
je 0x404554
cmp eax, ebx
je 0x40454c
push str.EnumProcesses
push dword [ebp + 0x80]
call esi
push str.GetModuleFileNameExA
push dword [ebp + 0x80]
mov dword [ebp + 0x78], eax
call esi
push str.OpenProcessToken
push dword [ebp + 0x7c]
mov dword [ebp + 0x60], eax
call esi
push str.GetTokenInformation
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], eax
call esi
cmp dword [ebp + 0x78], ebx
mov dword [ebp + 0x54], eax
je 0x404343
cmp dword [ebp + 0x60], ebx
je 0x404343
cmp dword [ebp + 0x68], ebx
je 0x404343
cmp eax, ebx
je 0x404343
push 0xffc
lea eax, [ebp - 0xfac]
push ebx
push eax
mov dword [ebp - 0xfb0], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp + 0x58]
push eax
push 0x1000
lea eax, [ebp - 0xfb0]
push eax
mov dword [ebp + 0x58], ebx
call dword [ebp + 0x78]
test eax, eax
jne 0x404358
push ebx
call edi
push dword [ebp + 0x80]
call edi
push dword [ebp + 0x7c]
call edi
jmp 0x40456b
mov eax, dword [ebp + 0x58]
shr eax, 2
mov esi, 0x104
push esi
mov dword [ebp + 0x5c], eax
lea eax, [ebp + 0x295]
push ebx
push eax
mov byte [ebp + 0x294], bl
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp + 0x85]
push ebx
push eax
mov byte [ebp + 0x84], bl
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp + 0x18d]
push ebx
push eax
mov byte [ebp + 0x18c], bl
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp + 0x39d]
push ebx
push eax
mov byte [ebp + 0x39c], bl
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp + 0x4a5]
push ebx
push eax
mov byte [ebp + 0x4a4], bl
call sub.MSVCR80.dll_memset
add esp, 0x3c
cmp dword [ebp + 0x5c], ebx
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x70], ebx
jbe 0x404533
lea ebx, [esi + 1]
push ebx
lea eax, [ebp + 0x294]
push 0
push eax
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp + 0x84]
push 0
push eax
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp + 0x18c]
push 0
push eax
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp + 0x39c]
push 0
push eax
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp + 0x4a4]
push 0
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 0x70]
add esp, 0x3c
push dword [ebp + eax*4 - 0xfb0]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp + 0x78], eax
je 0x404517
push ebx
lea ecx, [ebp + 0x294]
push ecx
push 0
push eax
call dword [ebp + 0x60]
test eax, eax
je 0x4044f8
push esi
lea eax, [ebp + 0x4a4]
push eax
push esi
lea eax, [ebp + 0x39c]
push eax
push esi
lea eax, [ebp + 0x18c]
push eax
push esi
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp + 0x294]
push eax
call dword [sym.imp.MSVCR80.dll__splitpath_s]
lea eax, [ebp + 0x39c]
push eax
push str.explorer
call dword [sym.imp.MSVCR80.dll__stricmp]
add esp, 0x2c
test eax, eax
jne 0x4044f8
lea eax, [ebp + 0x4a4]
push eax
push str..exe
call dword [sym.imp.MSVCR80.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x4044f8
push dword [ebp + 0x74]
push 0x2000e
push dword [ebp + 0x78]
call dword [ebp + 0x68]
test eax, eax
je 0x4044f8
lea eax, [ebp + 0x50]
push eax
push 4
lea eax, [ebp + 0x6c]
push eax
mov eax, dword [ebp + 0x74]
push 0xc
push dword [eax]
call dword [ebp + 0x54]
test eax, eax
je 0x4044f8
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x6c], eax
je 0x404528
mov eax, dword [ebp + 0x74]
mov eax, dword [eax]
test eax, eax
je 0x404508
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x74]
push dword [ebp + 0x78]
and dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x5c]
jb 0x4043e2
jmp 0x404531
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push dword [ebp + 0x80]
call edi
push dword [ebp + 0x7c]
call edi
mov ecx, dword [ebp + 0x74]
xor eax, eax
cmp dword [ecx], ebx
setne al
jmp 0x40456d
push dword [ebp + 0x80]
call edi
cmp dword [ebp + 0x7c], ebx
je 0x40455e
push dword [ebp + 0x7c]
call edi
push ebx
jmp 0x404351
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov ecx, dword [ebp + 0x5ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b47e
add ebp, 0x5b0
leave
ret 4