Function at 0x412fa0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jne 0x412fee
push str.WTSGetActiveConsoleSessionId
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2c], 0
jne 0x412fee
push 0x464a04
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTSGetActiveConsoleSessionId_Fail__r_n
call fcn.00411940
add esp, 4
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
je 0x4131dc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x30], 0
jne 0x41304e
push 0x464a64
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x30], 0
jne 0x41304e
push 0x464a78
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.OpenProcessToken_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x413090
push str.DuplicateTokenEx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x34], 0
jne 0x413090
push 0x464ac4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.DuplicateTokenEx_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4130d2
push str.SetTokenInformation
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x38], 0
jne 0x4130d2
push 0x464b10
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.SetTokenInformation_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x413114
push str.CreateProcessAsUserW
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x44], 0
jne 0x413114
push 0x464b60
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.CreateProcessAsUserW_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x413156
push 0x464ba0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
jne 0x413156
push 0x464bb8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Get_CreateProcessAsUserA_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
jne 0x413198
push str.GetTokenInformation
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x20], 0
jne 0x413198
push 0x464c14
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Get_GetTokenInformation_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
jne 0x4131da
push str.LookupAccountSidA
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
jne 0x4131da
push 0x464c68
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Get_LookupAccountSid_Fail___r_n
call fcn.00411940
add esp, 4
jmp 0x4131f4
push 0x464ca8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.LoadLibrary_Advapi32.dll__Fail__r_n
call fcn.00411940
add esp, 4
push str.Userenv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x41331c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x413254
push str.CreateEnvironmentBlock
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3c], 0
jne 0x413254
push 0x464d14
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.CreateEnvironmentBlock_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
jne 0x413296
push str.DestroyEnvironmentBlock
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x40], 0
jne 0x413296
push 0x464d6c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.DestroyEnvironmentBlock_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x4132d8
push str.UnloadUserProfile
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
jne 0x4132d8
push 0x464dc0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.UnloadUserProfile_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
jne 0x41331a
push str.LoadUserProfileA
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x41331a
push 0x464e0c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.LoadUserProfile_Fail__r_n
call fcn.00411940
add esp, 4
jmp 0x413334
push 0x464e3c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.LoadLibrary_Userenv.dll__Fail__r_n
call fcn.00411940
add esp, 4
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x413392
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
jne 0x413390
push str.WTSQueryUserToken
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x48], 0
jne 0x413390
push 0x464ea8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTSQueryUserToken_Fail__r_n
call fcn.00411940
add esp, 4
jmp 0x4133aa
push 0x464ee0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.LoadLibrary_Wtsapi32.dll__Fail__r_n
call fcn.00411940
add esp, 4
push 0x464f28
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x41344c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x41340a
push str.RtlConvertSidToUnicodeString
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x24], 0
jne 0x41340a
push 0x464f54
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Get_RtlConvertSidToUnicodeString_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x41344c
push str.RtlFreeUnicodeString
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jne 0x41344c
push 0x464fc4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Get_RtlFreeUnicodeString_Fail__r_n
call fcn.00411940
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
je 0x4134b8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x30], 0
je 0x4134b8
mov edx, dword [ebp - 4]
cmp dword [edx + 0x34], 0
je 0x4134b8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x4134b8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x44], 0
je 0x4134b8
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3c], 0
je 0x4134b8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4134b8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x48], 0
je 0x4134b8
mov edx, dword [ebp - 4]
cmp dword [edx + 0x20], 0
je 0x4134b8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4134b8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 0
je 0x4134b8
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
jne 0x4134bc
xor eax, eax
jmp 0x4134c1
mov eax, 1
mov esp, ebp
pop ebp
ret