Function at 0x1001dc30
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003666c
mov eax, dword fs:[0]
push eax
sub esp, 0x560
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54c], eax
lea eax, [ebp - 0x4a4]
push eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x4a4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1001dfeb
cmp dword [ebp - 0x494], 2
jne 0x1001dfeb
push str.explorer.exe
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Kernel32.DLL
mov dword [ebp - 4], 0
call edi
mov dword [ebp - 0x540], eax
test eax, eax
je 0x1001dfcd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Process32First
push dword [ebp - 0x540]
mov ebx, eax
call esi
push str.Process32Next
push dword [ebp - 0x540]
mov dword [ebp - 0x53c], eax
call esi
mov dword [ebp - 0x56c], eax
test eax, eax
je 0x1001dfc1
cmp dword [ebp - 0x53c], 0
je 0x1001dfc1
test ebx, ebx
je 0x1001dfc1
push str.WTSGetActiveConsoleSessionId
push dword [ebp - 0x540]
mov eax, 0x270f
mov dword [ebp - 0x554], eax
call esi
test eax, eax
je 0x1001dd47
call eax
mov dword [ebp - 0x554], eax
push str.Advapi32.DLL
call edi
mov dword [ebp - 0x550], eax
test eax, eax
je 0x1001dfc1
push 0x100395c4
push eax
call esi
push 0x100395d8
push dword [ebp - 0x550]
mov edi, eax
mov dword [ebp - 0x55c], edi
call esi
mov dword [ebp - 0x568], eax
test edi, edi
je 0x1001dfa9
test eax, eax
je 0x1001dfa9
push 0
push 2
call ebx
mov dword [ebp - 0x560], eax
cmp eax, 0xffffffff
je 0x1001df7f
lea ecx, [ebp - 0x538]
mov dword [ebp - 0x538], 0x128
push ecx
push eax
call dword [ebp - 0x53c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001df77
xor ebx, ebx
nop dword [eax]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x514]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x411], al
test al, al
jne 0x1001ddd2
lea eax, [ebp - 0x410]
push 0x5c
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x1001de1d
lea ecx, [eax + 1]
lea edx, [ebp - 0x410]
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1001de10
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x1001df57
push dword [ebp - 0x530]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001df57
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0xffffffff
push eax
push 0xb
push esi
call dword [ebp - 0x568]
test eax, eax
je 0x1001df54
mov ebx, dword [ebp - 0x554]
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x558], 0
cmp ebx, 0x270f
je 0x1001ded1
lea eax, [ebp - 0x53c]
push eax
push 4
lea eax, [ebp - 0x558]
push eax
push 0xc
push dword [ebp - 0x544]
call dword [ebp - 0x55c]
test eax, eax
je 0x1001ded1
cmp ebx, dword [ebp - 0x558]
je 0x1001ded1
xor ebx, ebx
jmp 0x1001df46
mov ebx, dword [ebp - 0x55c]
lea eax, [ebp - 0x53c]
push eax
mov eax, dword [ebp - 0x54c]
push 0
push dword [eax]
push 4
push dword [ebp - 0x544]
call ebx
test eax, eax
jne 0x1001df1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001df77
push dword [ebp - 0x53c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x54c]
mov dword [ecx], eax
lea eax, [ebp - 0x53c]
push eax
push dword [ebp - 0x53c]
mov eax, dword [ebp - 0x54c]
push dword [eax]
push 4
push dword [ebp - 0x544]
call ebx
test eax, eax
je 0x1001df77
mov ebx, 1
push dword [ebp - 0x544]
mov dword [ebp - 0x548], ebx
call edi
push esi
call edi
lea eax, [ebp - 0x538]
push eax
push dword [ebp - 0x560]
call dword [ebp - 0x56c]
test eax, eax
je 0x1001df77
cmp ebx, 1
jne 0x1001ddd0
push dword [ebp - 0x560]
call edi
push dword [ebp - 0x540]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x550]
call esi
lea ecx, [ebp - 0x564]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, dword [ebp - 0x548]
jmp 0x1001dfed
push dword [ebp - 0x540]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x550]
call esi
jmp 0x1001dfcd
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x548], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, dword [ebp - 0x548]
jmp 0x1001dfed
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret