Function at 0x414175
Capabilities:
Create thread
Link many functions at runtime
Load ntoskrnl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
cmp dword [0x4622c8], 0
je 0x414193
jmp 0x414baa
call fcn.004354a9
cmp dword [0x45e03c], 0
je 0x4141b2
push str._nInitiating_NT_Calls
call fcn.00452380
add esp, 4
call fcn.0045174d
call fcn.00410b89
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4258b4
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x46214c], eax
cmp dword [0x45e03c], 0
je 0x414205
cmp dword [ebp - 0xc], 0
jne 0x414205
push 0x46e6e4
call fcn.00452380
add esp, 4
cmp dword [0x45e03c], 0
je 0x414229
cmp dword [ebp - 0xc], 0
jne 0x414229
push str._nError_Starting_Thread_0
call fcn.00452380
add esp, 4
push str.AllowSetForegroundWindow
push 0x46e738
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462074], eax
call fcn.0041414e
push str.InternalGetWindowText
push 0x46e758
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46204c], eax
cmp dword [0x45e03c], 0
je 0x414286
mov eax, dword [0x46204c]
push eax
push str._n_rIGWT___x
call fcn.00452380
add esp, 8
push str.GetDevicePowerState
push 0x46e780
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462050], eax
cmp dword [0x45e03c], 0
je 0x4142c2
mov eax, dword [0x462050]
push eax
push str._n_rGDPS___x
call fcn.00452380
add esp, 8
push str.IsProcessorFeaturePresent
push 0x46e7b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462054], eax
cmp dword [0x45e03c], 0
je 0x41430a
mov eax, dword [0x462054]
push eax
push 0x46e7c0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push str._n_rK32b__x_.IsPFP___x_
call fcn.00452380
add esp, 0xc
push str.ProcessIdToSessionId
push 0x46e7fc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462078], eax
cmp dword [0x45e03c], 0
je 0x414346
mov eax, dword [0x462078]
push eax
push str._n_rPIDSID___x_
call fcn.00452380
add esp, 8
cmp dword [0x462254], 0
jne 0x414360
cmp dword [0x462280], 0
je 0x41463d
cmp dword [0x462280], 0
jne 0x41438a
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x42fd11
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4143ae
cmp dword [ebp - 0xc], 0
jne 0x4143ae
push str._nError_Starting_Thread_1
call fcn.00452380
add esp, 4
push str.winsta.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x462144], eax
push str.WinStationSendMessageW
mov eax, dword [0x462144]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f97c0], eax
cmp dword [0x45e03c], 0
je 0x4143fa
mov eax, dword [0x5f97c0]
push eax
mov eax, dword [0x462144]
push eax
push str._n_rWINSTA_load___x_.__x_
call fcn.00452380
add esp, 0xc
push 0x46e870
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x462148], eax
push 0x46e880
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5ad4e0], eax
push 0x46e890
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dfaac], eax
push 0x46e8a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x462148], eax
push 0x46e8b0
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46209c], eax
push 0x46e8cc
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4620a0], eax
cmp dword [0x45e03c], 0
je 0x414492
mov eax, dword [0x46209c]
push eax
push str._n_rHOOK_UP_WQI___x_
call fcn.00452380
add esp, 8
push str.WTSEnumerateProcessesA
mov eax, dword [0x462148]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4620a4], eax
push 0x46e908
push 0x46e924
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462058], eax
cmp dword [0x462058], 0
jne 0x4144ed
push str.NtQueryInformationProcess
push 0x46e94c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x462058], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x44a1f0
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x41452e
cmp dword [ebp - 0xc], 0
jne 0x41452e
push str._nError_Starting_Thread_0SESSTL
call fcn.00452380
add esp, 4
push str.ConvertSidToStringSidW
push 0x46e994
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4620ec], eax
push str.ConvertStringSidToSidW
push 0x46e9bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4620f0], eax
push 0x46e9cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4620f4], eax
cmp dword [0x4620f4], 0xffffffff
jne 0x414592
mov dword [0x4620f4], 0
jmp 0x4145cb
push 0x46e9d8
mov eax, dword [0x4620f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4620e8], eax
cmp dword [0x4620e8], 0
jne 0x4145cb
mov eax, dword [0x4620f4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4620f4], 0
cmp dword [0x45e03c], 0
je 0x4145f7
mov eax, dword [0x5dfaac]
push eax
mov eax, dword [0x5ad4e0]
push eax
mov eax, dword [0x462148]
push eax
push str._n_rWTSAPI32_load___x_.__x___w_x
call fcn.00452380
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4300bb
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414638
cmp dword [ebp - 0xc], 0
jne 0x414638
push str._nError_Starting_Thread_2
call fcn.00452380
add esp, 4
jmp 0x41463d
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x430fbe
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x41467e
cmp dword [ebp - 0xc], 0
jne 0x41467e
push str._nError_Starting_Thread_3
call fcn.00452380
add esp, 4
cmp dword [0x462254], 0
jne 0x414712
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4321a4
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4146cc
cmp dword [ebp - 0xc], 0
jne 0x4146cc
push 0x46ea40
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x433f4a
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x41470d
cmp dword [ebp - 0xc], 0
jne 0x41470d
push 0x46ea5c
call fcn.00452380
add esp, 4
jmp 0x4147e7
cmp dword [0x462260], 0
je 0x4147a6
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4321a4
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414760
cmp dword [ebp - 0xc], 0
jne 0x414760
push str._nError_Starting_Thread_4
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x433f4a
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4147a1
cmp dword [ebp - 0xc], 0
jne 0x4147a1
push 0x46ea94
call fcn.00452380
add esp, 4
jmp 0x4147e7
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x433f4a
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4147e7
cmp dword [ebp - 0xc], 0
jne 0x4147e7
push str._nError_Starting_Thread_6
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x434c96
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414828
cmp dword [ebp - 0xc], 0
jne 0x414828
push str._nError_Starting_Thread_6i
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x430c1d
push 0xc000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414869
cmp dword [ebp - 0xc], 0
jne 0x414869
push str._nError_Starting_Thread_DC1
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x438f93
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4148a7
cmp dword [ebp - 0xc], 0
jne 0x4148a7
push str._nError_Starting_Thread_PW1
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x43f75d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4148e5
cmp dword [ebp - 0xc], 0
jne 0x4148e5
push str._nError_Starting_Thread_EFS1
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40fd5c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414923
cmp dword [ebp - 0xc], 0
jne 0x414923
push str._nError_Starting_Thread_ATERM
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x43e63b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414961
cmp dword [ebp - 0xc], 0
jne 0x414961
push str._nError_Starting_Thread_BXATX
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x43400c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x41499f
cmp dword [ebp - 0xc], 0
jne 0x41499f
push str._nError_Starting_Thread_PCR
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40eec9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x4149dd
cmp dword [ebp - 0xc], 0
jne 0x4149dd
push str._nError_Starting_Thread_ASILOS
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40efb6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414a1b
cmp dword [ebp - 0xc], 0
jne 0x414a1b
push str._nError_Starting_Thread_ASILOSPX
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40f6c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414a59
cmp dword [ebp - 0xc], 0
jne 0x414a59
push str._nError_Starting_Thread_ASILOS_SSA
call fcn.00452380
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x44991d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x414a97
cmp dword [ebp - 0xc], 0
jne 0x414a97
push str._nError_Starting_Thread_APLUGS_SSA
call fcn.00452380
add esp, 4
mov eax, 0x508800
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
movsx eax, byte [0x984f20]
test eax, eax
je 0x414af1
movsx eax, byte [0x9854e0]
test eax, eax
je 0x414af1
push 0x9854e0
push 0x984f20
push 0x46ec20
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x414b0b
push 0x9854e0
push 0x46ec28
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x9854e0
push 0x508800
call fcn.0042f366
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x414b4e
push 0x508800
push 0
call fcn.00452990
add esp, 4
push eax
push str._n_r__X__SpinStart__ThisComputerLdap___s_
call fcn.00452380
add esp, 0xc
movsx eax, byte [0x508800]
test eax, eax
je 0x414b71
push 1
push 0x508800
call fcn.0042b038
add esp, 8
jmp 0x414baa
push 0
push 0x508800
call fcn.0042b038
add esp, 8
cmp dword [0x45e03c], 0
je 0x414baa
push 0x508800
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_n__X__Machine_LDAP_from_cached___s_
call fcn.00452380
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret