Function at 0x10001ad0
Capabilities:
Check os version
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0x100ac06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x8b8], 0
push edi
push 0x110
mov dword [ebp - 0x8d4], eax
mov dword [eax], 0
lea eax, [ebp - 0x228]
push 0
push eax
mov dword [ebp - 0x8bc], 0
call fcn.10062800
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x22c]
add esp, 0xc
mov dword [ebp - 0x22c], 0x114
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10001daa
cmp dword [ebp - 0x228], 6
jne 0x10001daa
lea eax, [ebp - 0x8c4]
mov dword [ebp - 0x8c0], 0
push eax
lea eax, [ebp - 0x8c8]
xor esi, esi
push eax
push 1
push esi
push esi
mov dword [ebp - 0x8b4], esi
mov dword [ebp - 0x8c8], esi
mov dword [ebp - 0x8c4], esi
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10001bde
mov edx, dword [ebp - 0x8c4]
xor eax, eax
mov edi, dword [ebp - 0x8c8]
mov esi, 0x490
test edx, edx
je 0x10001bcd
lea ecx, [edi + 8]
nop dword [eax]
cmp dword [ecx], 0
je 0x10001bbf
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10001bb0
jmp 0x10001bcd
lea eax, [eax + eax*2]
xor esi, esi
mov eax, dword [edi + eax*4]
mov dword [ebp - 0x8b4], eax
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x10001c17
mov esi, dword [ebp - 0x8b4]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001c0b
lea ecx, [ebp - 0x8c0]
push ecx
push esi
call eax
test eax, eax
jne 0x10001d15
call ebx
mov esi, eax
test esi, esi
je 0x10001d15
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001c37
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
jmp 0x10001d11
push 0x228
lea eax, [ebp - 0x454]
mov dword [ebp - 0x8b4], 0
push 0
push eax
mov esi, 0x490
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x458], 0x22c
lea eax, [ebp - 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10001cbc
nop dword [eax + eax]
lea eax, [ebp - 0x434]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x10001cac
lea eax, [ebp - 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001c80
jmp 0x10001cc0
mov eax, dword [ebp - 0x450]
xor esi, esi
mov dword [ebp - 0x8b4], eax
jmp 0x10001cc0
call ebx
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
push dword [ebp - 0x8b4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10001ced
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
jmp 0x10001d11
lea eax, [ebp - 0x8c0]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10001d08
call ebx
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
test esi, esi
jne 0x10001d4e
lea eax, [ebp - 0x8dc]
push eax
push 4
lea eax, [ebp - 0x8d8]
push eax
push 0x13
push dword [ebp - 0x8c0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [ebp - 0x8d8]
test eax, eax
cmove ecx, dword [ebp - 0x8c0]
mov dword [ebp - 0x8bc], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x8bc]
test esi, esi
je 0x10002082
lea eax, [ebp - 0x8b8]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x10001d94
push dword [ebp - 0x8b8]
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x10001d94
push dword [ebp - 0x8b8]
call ebx
mov dword [ebp - 0x8b8], 0
push esi
call ebx
mov edx, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x8b8]
mov dword [edx], ecx
jmp 0x10002090
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call esi
test eax, eax
je 0x10001ee7
cmp dword [ebp - 0x114], 5
jne 0x10001ee7
cmp dword [ebp - 0x110], 0
jne 0x10001ee7
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001e11
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10001d4e
push 0x228
lea eax, [ebp - 0x680]
mov dword [ebp - 0x8b4], 0
push 0
push eax
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x684], 0x22c
lea eax, [ebp - 0x684]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10001e96
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x660]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x10001e88
lea eax, [ebp - 0x684]
push eax
push esi
call edi
test eax, eax
jne 0x10001e60
jmp 0x10001e98
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x8b4], eax
jmp 0x10001e98
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
push dword [ebp - 0x8b4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001ec0
call ebx
jmp 0x10001d48
lea eax, [ebp - 0x8bc]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10001ed9
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
jmp 0x10001d4e
lea eax, [ebp - 0x8cc]
xor ebx, ebx
push eax
lea eax, [ebp - 0x8d0]
mov dword [ebp - 0x8b4], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x8d0], ebx
mov dword [ebp - 0x8cc], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10001f65
mov edx, dword [ebp - 0x8cc]
xor eax, eax
mov ebx, dword [ebp - 0x8d0]
mov esi, 0x490
test edx, edx
je 0x10001f54
lea ecx, [ebx + 8]
cmp dword [ecx], 0
je 0x10001f46
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10001f37
jmp 0x10001f54
lea eax, [eax + eax*2]
xor esi, esi
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0x8b4], eax
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x10001f9e
mov ebx, dword [ebp - 0x8b4]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001f92
lea ecx, [ebp - 0x8bc]
push ecx
push ebx
call eax
test eax, eax
jne 0x10001d48
call edi
mov esi, eax
test esi, esi
je 0x10001d48
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001fb6
call edi
jmp 0x10001d48
push 0x228
lea eax, [ebp - 0x8ac]
mov dword [ebp - 0x8b4], 0
push 0
push eax
call fcn.10062800
add esp, 0xc
mov dword [ebp - 0x8b0], 0x22c
lea eax, [ebp - 0x8b0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10002036
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax + eax]
lea eax, [ebp - 0x88c]
push str.explorer.exe
push eax
call fcn.10064f63
add esp, 8
test eax, eax
je 0x10002028
lea eax, [ebp - 0x8b0]
push eax
push esi
call ebx
test eax, eax
jne 0x10002000
jmp 0x10002038
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x8b4], eax
jmp 0x10002038
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push dword [ebp - 0x8b4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10002061
call edi
jmp 0x10001d4e
lea eax, [ebp - 0x8bc]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000207a
call edi
push esi
call ebx
jmp 0x10001d4e
mov edx, dword [ebp - 0x8d4]
mov eax, dword [ebp - 0x8b8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov eax, edx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100205ba
mov esp, ebp
pop ebp
ret 4