Function at 0x10001810
Capabilities:
Create process on windows
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10015540
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x16c0
call fcn.10014b30
mov eax, dword [0x100210f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x62c], 0
xor eax, eax
mov word [ebp - 0x620], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x61e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, 6
mov esi, str.explorer.exe
lea edi, [ebp - 0x220]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ee
push 0
lea edx, [ebp - 0x206]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.10002170
push eax
push str._sLckRun.exe__s
push 0x200
lea ecx, [ebp - 0x620]
push ecx
call fcn.10002110
add esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x1630], 0
push 0xffc
push 0
lea edx, [ebp - 0x162c]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x1644], 0
lea eax, [ebp - 0x169c]
push eax
push 0x1000
lea ecx, [ebp - 0x1630]
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov edx, dword [ebp - 0x169c]
shr edx, 2
mov dword [ebp - 0x16a0], edx
mov dword [ebp - 0x16a8], 0
jmp 0x1000194d
mov eax, dword [ebp - 0x16a8]
add eax, 1
mov dword [ebp - 0x16a8], eax
mov ecx, dword [ebp - 0x16a8]
cmp ecx, dword [ebp - 0x16a0]
jae 0x10001a2c
lea edx, [ebp - 0x630]
push edx
mov eax, dword [ebp - 0x16a8]
mov ecx, dword [ebp + eax*4 - 0x1630]
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x630]
je 0x10001987
jmp 0x1000193e
mov eax, dword [ebp - 0x16a8]
mov ecx, dword [ebp + eax*4 - 0x1630]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x16ac], eax
cmp dword [ebp - 0x16ac], 0
je 0x10001a27
mov edx, dword [ebp - 0x16a8]
mov eax, dword [ebp + edx*4 - 0x1630]
push eax
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x16ac]
push edx
call fcn.100010d0
add esp, 0xc
mov dword [ebp - 0x16c8], eax
cmp dword [ebp - 0x16c8], 0
je 0x10001a10
mov eax, dword [ebp - 0x16a8]
mov ecx, dword [ebp + eax*4 - 0x1630]
mov dword [ebp - 0x1644], ecx
mov edx, dword [ebp - 0x16ac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x16ac], 0
jmp 0x10001a2c
mov eax, dword [ebp - 0x16ac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x16ac], 0
jmp 0x1000193e
mov ecx, dword [ebp - 0x1644]
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jne 0x10001ab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x62c], eax
push 0x10016864
call fcn.100103d0
add esp, 4
mov dword [ebp - 0x16cc], eax
mov edx, dword [ebp - 0x62c]
push edx
push 0x128
push 0x10016880
push str._s._d____ERROR_OpenProcess__dwErr__d_
mov eax, dword [ebp - 0x16cc]
push eax
call fcn.10010c90
add esp, 0x14
mov ecx, dword [ebp - 0x62c]
mov dword [ebp - 0x16b4], ecx
push 0x1001e594
lea edx, [ebp - 0x16b4]
push edx
call sub.MSVCR90.dll__CxxThrowException
lea eax, [ebp - 0x628]
push eax
push 0xf01ff
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x16a4], eax
cmp dword [ebp - 0x16a4], 0
jne 0x10001b39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x62c], eax
push 0x1001691c
call fcn.100103d0
add esp, 4
mov dword [ebp - 0x16d0], eax
mov edx, dword [ebp - 0x62c]
push edx
push 0x130
push 0x10016938
push str._s._d____ERROR_OpenProcessToken__dwErr__d_
mov eax, dword [ebp - 0x16d0]
push eax
call fcn.10010c90
add esp, 0x14
mov ecx, dword [ebp - 0x62c]
mov dword [ebp - 0x16b8], ecx
push 0x1001e594
lea edx, [ebp - 0x16b8]
push edx
call sub.MSVCR90.dll__CxxThrowException
push 0x44
push 0
lea eax, [ebp - 0x1698]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x1640]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x1698], 0x44
mov dword [ebp - 0x1650], 0
mov dword [ebp - 0x164c], 0x420
push 0
mov edx, dword [ebp - 0x628]
push edx
lea eax, [ebp - 0x1650]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea ecx, [ebp - 0x1640]
push ecx
lea edx, [ebp - 0x1698]
push edx
push 0
mov eax, dword [ebp - 0x1650]
push eax
mov ecx, dword [ebp - 0x164c]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x620]
push edx
push 0
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x1648], eax
cmp dword [ebp - 0x1648], 0
jne 0x10001c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x62c], eax
mov ecx, dword [ebp - 0x62c]
mov dword [ebp - 0x16bc], ecx
push 0x1001e594
lea edx, [ebp - 0x16bc]
push edx
call sub.MSVCR90.dll__CxxThrowException
mov eax, dword [ebp - 0x163c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1640]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x624], 0
cmp dword [ebp - 0x628], 0
je 0x10001c3f
mov edx, dword [ebp - 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10001ce1
mov dword [ebp - 4], 0xffffffff
jmp 0x10001cf2
jmp 0x10001cfc
mov edx, dword [ebp + 8]
push edx
push 0x188
push str.COMMON_OPTS::RunDllInterfaceBySession
push str._s._d____Success_to_lock_key_for_session__d_
push 0x10016a60
call fcn.100103d0
add esp, 4
push eax
call fcn.10010a70
add esp, 0x14
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10014a4a
mov esp, ebp
pop ebp
ret