Function at 0x10004bb0
Capabilities:
Check os version
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0x100e70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x8c0], 0
push edi
push 0x110
mov dword [ebp - 0x8dc], eax
mov dword [eax], 0
lea eax, [ebp - 0x234]
push 0
push eax
mov dword [ebp - 0x8c4], 0
call fcn.100953e0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x238]
add esp, 0xc
mov dword [ebp - 0x238], 0x114
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10004e77
cmp dword [ebp - 0x234], 6
jne 0x10004e77
lea eax, [ebp - 8]
mov dword [ebp - 0x8c8], 0
push eax
lea eax, [ebp - 0x8cc]
xor esi, esi
push eax
push 1
push esi
push esi
mov dword [ebp - 0x8d8], esi
mov dword [ebp - 0x8cc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10004cb1
mov edx, dword [ebp - 8]
xor eax, eax
mov edi, dword [ebp - 0x8cc]
mov esi, 0x490
test edx, edx
je 0x10004ca0
lea ecx, [edi + 8]
cmp dword [ecx], 0
je 0x10004c92
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10004c83
jmp 0x10004ca0
lea eax, [eax + eax*2]
xor esi, esi
mov eax, dword [edi + eax*4]
mov dword [ebp - 0x8d8], eax
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x10004cea
mov esi, dword [ebp - 0x8d8]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10004cde
lea ecx, [ebp - 0x8c8]
push ecx
push esi
call eax
test eax, eax
jne 0x10004de5
call ebx
mov esi, eax
test esi, esi
je 0x10004de5
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004d0a
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
jmp 0x10004de1
push 0x228
lea eax, [ebp - 0x460]
mov dword [ebp - 0x8d8], 0
push 0
push eax
mov esi, 0x490
call fcn.100953e0
add esp, 0xc
mov dword [ebp - 0x464], 0x22c
lea eax, [ebp - 0x464]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10004d8c
nop dword [eax + eax]
lea eax, [ebp - 0x440]
push str.explorer.exe
push eax
call fcn.10097fa4
add esp, 8
test eax, eax
je 0x10004d7c
lea eax, [ebp - 0x464]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10004d50
jmp 0x10004d90
mov eax, dword [ebp - 0x45c]
xor esi, esi
mov dword [ebp - 0x8d8], eax
jmp 0x10004d90
call ebx
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
push dword [ebp - 0x8d8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10004dbd
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
jmp 0x10004de1
lea eax, [ebp - 0x8c8]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10004dd8
call ebx
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
test esi, esi
jne 0x10004e1b
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x8d4]
push eax
push 0x13
push dword [ebp - 0x8c8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [ebp - 0x8d4]
test eax, eax
cmove ecx, dword [ebp - 0x8c8]
mov dword [ebp - 0x8c4], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x8c4]
test esi, esi
je 0x10005143
lea eax, [ebp - 0x8c0]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x10004e61
push dword [ebp - 0x8c0]
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x10004e61
push dword [ebp - 0x8c0]
call ebx
mov dword [ebp - 0x8c0], 0
push esi
call ebx
mov edx, dword [ebp - 0x8dc]
mov ecx, dword [ebp - 0x8c0]
mov dword [edx], ecx
jmp 0x10005151
push 0x110
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.100953e0
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call esi
test eax, eax
je 0x10004fb7
cmp dword [ebp - 0x120], 5
jne 0x10004fb7
cmp dword [ebp - 0x11c], 0
jne 0x10004fb7
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10004ede
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10004e1b
push 0x228
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x8d8], 0
push 0
push eax
call fcn.100953e0
add esp, 0xc
mov dword [ebp - 0x690], 0x22c
lea eax, [ebp - 0x690]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10004f66
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
lea eax, [ebp - 0x66c]
push str.explorer.exe
push eax
call fcn.10097fa4
add esp, 8
test eax, eax
je 0x10004f58
lea eax, [ebp - 0x690]
push eax
push esi
call edi
test eax, eax
jne 0x10004f30
jmp 0x10004f68
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x8d8], eax
jmp 0x10004f68
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
push dword [ebp - 0x8d8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10004f90
call ebx
jmp 0x10004e15
lea eax, [ebp - 0x8c4]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10004fa9
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
jmp 0x10004e1b
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
lea eax, [ebp - 0x8d0]
mov dword [ebp - 0x8d8], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x8d0], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000502e
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ebx, dword [ebp - 0x8d0]
mov esi, 0x490
test edx, edx
je 0x1000501d
lea ecx, [ebx + 8]
nop
cmp dword [ecx], 0
je 0x1000500f
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10005000
jmp 0x1000501d
lea eax, [eax + eax*2]
xor esi, esi
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0x8d8], eax
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x10005067
mov ebx, dword [ebp - 0x8d8]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000505b
lea ecx, [ebp - 0x8c4]
push ecx
push ebx
call eax
test eax, eax
jne 0x10004e15
call edi
mov esi, eax
test esi, esi
je 0x10004e15
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000507f
call edi
jmp 0x10004e15
push 0x228
lea eax, [ebp - 0x8b8]
mov dword [ebp - 0x8d8], 0
push 0
push eax
call fcn.100953e0
add esp, 0xc
mov dword [ebp - 0x8bc], 0x22c
lea eax, [ebp - 0x8bc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100050f7
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x898]
push str.explorer.exe
push eax
call fcn.10097fa4
add esp, 8
test eax, eax
je 0x100050e9
lea eax, [ebp - 0x8bc]
push eax
push esi
call ebx
test eax, eax
jne 0x100050c1
jmp 0x100050f9
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x8d8], eax
jmp 0x100050f9
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push dword [ebp - 0x8d8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10005122
call edi
jmp 0x10004e1b
lea eax, [ebp - 0x8c4]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000513b
call edi
push esi
call ebx
jmp 0x10004e1b
mov edx, dword [ebp - 0x8dc]
mov eax, dword [ebp - 0x8c0]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov eax, edx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bf25
mov esp, ebp
pop ebp
ret 4