Function at 0x405101
Capabilities:
Check os version
Enumerate process modules
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1840
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x182c]
xor ebx, ebx
push eax
mov dword [ebp - 0x1840], ebx
mov dword [ebp - 0x182c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 0x1828]
mov byte [ebp - 0x181d], bl
push eax
lea eax, [ebp - 0x1824]
mov dword [ebp - 0x1824], ebx
push eax
push 5
push dword [ebp - 0x182c]
mov esi, ebx
push ebx
mov dword [ebp - 0x1834], esi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
cmp dword [ebp - 0x1824], ebx
je 0x4051a6
cmp dword [ebp - 0x1828], ebx
je 0x4051a6
push dword [ebp - 0x1824]
lea eax, [ebp - 0x614]
push 0x100
push eax
call fcn.004143b0
add esp, 0xc
push dword [ebp - 0x1824]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x4051dd
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x4053e1
cmp dword [ebp - 0x118], ebx
jne 0x4053e1
mov byte [ebp - 0x181d], 1
lea eax, [ebp - 0x1828]
push eax
push 0x1000
lea eax, [ebp - 0x181c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x4053e1
mov ebx, dword [ebp - 0x1828]
xor ecx, ecx
shr ebx, 2
mov eax, ecx
mov dword [ebp - 0x1830], eax
test ebx, ebx
je 0x4053c6
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + eax*4 - 0x181c]
test eax, eax
je 0x4053ab
cmp eax, 4
je 0x4053ab
cmp eax, 8
je 0x4053ab
mov dword [ebp - 0x183c], ecx
lea ecx, [ebp - 0x183c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [ebp - 0x183c]
cmp eax, dword [ebp - 0x182c]
jne 0x4053a9
mov eax, dword [ebp - 0x1830]
push dword [ebp + eax*4 - 0x181c]
xor eax, eax
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4053a9
cmp byte [0x42f7a0], 0
je 0x4052d2
xor eax, eax
mov dword [ebp - 0x1838], eax
mov eax, dword [0x42f7a8]
test eax, eax
je 0x4052c0
lea ecx, [ebp - 0x1838]
push ecx
push esi
call eax
test eax, eax
je 0x4052c0
cmp dword [ebp - 0x1838], 0
je 0x4052c0
xor eax, eax
jmp 0x4052c2
mov al, 1
cmp byte [0x42f7a0], al
je 0x4052d2
push esi
call edi
jmp 0x4053a9
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
lea edx, [ebp - 0x81c]
call fcn.00405020
pop ecx
test al, al
je 0x4052ca
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1840]
jne 0x4052f4
sub ecx, edx
sar ecx, 1
je 0x4052ca
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00414440
cmp byte [ebp - 0x181d], 0
pop ecx
pop ecx
jne 0x4053ca
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4052ca
cmp dword [ebp - 0x1834], eax
jne 0x405351
mov dword [ebp - 0x1834], esi
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
xor eax, eax
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4052ca
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x4053a9
push str.explorer.exe
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4053c6
xor ecx, ecx
mov eax, dword [ebp - 0x1830]
inc eax
mov dword [ebp - 0x1830], eax
cmp eax, ebx
jb 0x40521f
mov esi, dword [ebp - 0x1834]
mov eax, esi
jmp 0x4053e3
lea eax, [ebp - 0x20c]
push 0x4282d8
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
jmp 0x40533d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f870
leave
ret