Function at 0x1000d44f
Capabilities:
Check mutex on windows
Create thread
Get explorer pid
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push 0x1002c488
mov dword [ebp - 8], esi
call edi
mov eax, 0x1002c480
mov dword [0x1002c484], eax
mov dword [0x1002c480], eax
mov dword [0x1002c4a4], esi
push 0x5c
mov dword [0x1002c4a0], esi
call fcn.100012ea
mov dword [0x1002c3ec], eax
cmp eax, esi
je 0x1000d4ba
push 0x5c
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [0x1002c3ec]
add esp, 0xc
add eax, 0x40
push eax
call edi
mov eax, dword [0x1002c3ec]
mov dword [eax], 0x1002e22b
xor eax, eax
jmp 0x1000d4bd
push 8
pop eax
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7ca
push ebx
push dword [0x1002c1b4]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1002c1b8], eax
call ebx
mov ecx, dword [0x1002c1b8]
cmp ecx, esi
je 0x1000d50a
cmp eax, 0xb7
jne 0x1000d508
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002c1b8], esi
jmp 0x1000d7c6
xor eax, eax
cmp eax, esi
jne 0x1000d7c6
call fcn.100110f1
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7c9
call fcn.1000b76b
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7c9
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 8]
push eax
push esi
call edi
cmp dword [ebp - 8], esi
je 0x1000d564
push dword [ebp - 8]
push esi
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002c10c], eax
cmp eax, esi
je 0x1000d564
lea ecx, [ebp - 8]
push ecx
push eax
call edi
call fcn.10012dc0
xor ecx, ecx
cmp eax, 0x57
mov eax, dword [0x1002c190]
sete cl
inc ecx
mov dword [0x1002c474], ecx
cmp eax, 0x7a4eb174
je 0x1000d58b
cmp eax, 0x5aff7c2a
jne 0x1000d5cc
lea eax, [ebp - 0x14]
push eax
push 0x18
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [0x1002c1d8]
xor edi, edi
call dword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
test eax, eax
jl 0x1000d5ab
mov edi, dword [ebp - 0x18]
push edi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
jne 0x1000d5c5
call ebx
cmp eax, 5
jne 0x1000d5cc
jmp 0x1000d62e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002c190], 0x79007f4
jne 0x1000d601
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_GetShellWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x1000d601
cmp eax, dword [0x1002c1dc]
je 0x1000d601
mov dword [0x1002c190], esi
mov eax, dword [0x1002c190]
cmp eax, 0xbb232e80
je 0x1000d62e
cmp eax, 0x4e19cd8f
je 0x1000d62e
cmp eax, 0x1541f349
je 0x1000d62e
push dword [ebp + 8]
call fcn.1001794d
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7c9
call fcn.1000d3a8
call fcn.1000b3bf
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7c9
call fcn.10003daa
push 0x18
push esi
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002c14c], eax
cmp eax, esi
je 0x1000d7c9
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax + 4], esi
mov dword [eax], esi
lea edi, [eax + 4]
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x1000d0aa
push esi
push esi
call ebx
mov ecx, dword [0x1002c14c]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000d7c9
inc eax
cmp dword [0x1002c190], 0x79007f4
mov dword [edi], eax
jne 0x1000d740
push 0x1002c198
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call fcn.10018682
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7c9
test byte [0x1002b4f0], 4
je 0x1000d6e7
mov dword [0x1002c2e4], edi
mov dword [0x1002c330], edi
mov dword [0x1002c2fc], edi
push section..bss
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000d707
push edi
push 0x1002bb30
push edi
push 0x1002bb24
call fcn.1000b289
mov eax, dword [0x1002c14c]
mov ecx, dword [eax + 4]
lea eax, [eax + ecx*4 + 8]
push eax
call fcn.1000be5b
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x1000d7c9
mov eax, dword [0x1002c14c]
inc dword [eax + 4]
cmp dword [0x1002c100], esi
je 0x1000d74d
push 0x1002c0fc
call fcn.10001e84
jmp 0x1000d74d
cmp dword [0x1002c1ec], esi
je 0x1000d74d
call fcn.1000cfe5
mov eax, dword [0x1002c190]
cmp eax, esi
je 0x1000d7c6
cmp eax, 0x79007f4
jne 0x1000d797
push 0x43
push esi
push dword [0x1002c0e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002c278], eax
cmp eax, esi
je 0x1000d797
mov ecx, dword [0x1002c1e0]
movzx edx, ch
push 0x10026407
push edx
movzx ecx, cl
push ecx
push 0x1002d11e
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [0x1002c14c]
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x100052a1
push esi
push esi
add edi, 4
call ebx
mov ecx, dword [0x1002c14c]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000d7c9
inc eax
mov dword [edi], eax
mov dword [ebp - 4], esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4