Function at 0x1001289a
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100128ef
xor eax, eax
jmp 0x10012b72
push str.WTSGetActiveConsoleSessionId
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
call dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.1001cbba
mov dword [ebp - 0x18], 0x30
push 0x44
push 0
lea eax, [ebp - 0x74]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x74], 0x44
mov byte [ebp - 0x88], 0x57
mov byte [ebp - 0x87], 0x69
mov byte [ebp - 0x86], 0x6e
mov byte [ebp - 0x85], 0x53
mov byte [ebp - 0x84], 0x74
mov byte [ebp - 0x83], 0x61
mov byte [ebp - 0x82], 0x30
mov byte [ebp - 0x81], 0x5c
mov byte [ebp - 0x80], 0x44
mov byte [ebp - 0x7f], 0x65
mov byte [ebp - 0x7e], 0x66
mov byte [ebp - 0x7d], 0x61
mov byte [ebp - 0x7c], 0x75
mov byte [ebp - 0x7b], 0x6c
mov byte [ebp - 0x7a], 0x74
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x78]
push ecx
push 0x201eb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10025cb4]
test eax, eax
jne 0x100129cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x10012b3f
lea edx, [ebp - 0x90]
push edx
push 0x10024418
push 0
call dword [0x10025d14]
test eax, eax
jne 0x100129f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x10012b3f
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], 2
lea edx, [ebp - 0x30]
push edx
push 1
push 1
push 0
push 0x2000000
mov eax, dword [ebp - 0x78]
push eax
call dword [0x10025cd8]
test eax, eax
jne 0x10012a4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x10012b3f
push 4
lea ecx, [ebp - 0x20]
push ecx
push 0xc
mov edx, dword [ebp - 0x30]
push edx
call dword [0x10025cdc]
test eax, eax
jne 0x10012a70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x10012b3f
push 0
push 0
push 0x10
lea eax, [ebp - 0xa0]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [0x10025d18]
test eax, eax
jne 0x10012a9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x10012b3f
mov dword [ebp - 0xa4], 0
push str.CreateEnvironmentBlock
push str.UserEnv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x10012acd
jmp 0x10012b3f
push 1
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0xa4]
push eax
call dword [ebp - 0xa8]
test eax, eax
je 0x10012aef
mov ecx, dword [ebp - 0x18]
or ch, 4
mov dword [ebp - 0x18], ecx
jmp 0x10012af9
mov dword [ebp - 0xa4], 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [0x10025ce0]
test eax, eax
je 0x10012b2a
jmp 0x10012b35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x10012b3f
xor edx, edx
test edx, edx
jne 0x10012907
cmp dword [ebp - 4], 0
je 0x10012b4f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0
je 0x10012b5f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], 0
je 0x10012b6f
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 4