Function at 0x10010892
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x265c
call fcn.10146cc0
mov ecx, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
call fcn.10010816
cmp eax, 0xffffffff
je 0x10010d29
mov dword [ebp - 0x2664], eax
call fcn.10013f4c
mov esi, eax
lea ebx, [ebp - 0x2010]
mov ecx, ebx
push str.Psapi.dll
call fcn.100349a0
mov ecx, esi
push ebx
call fcn.10013fbe
mov dword [ebp - 0x2648], eax
cmp byte [ebx + 0xb], 0
jns 0x10010904
push dword [ebp - 0x2010]
call fcn.10145bd4
add esp, 4
call fcn.10013f4c
mov esi, eax
mov ecx, ebx
push str.Advapi32.dll
call fcn.100349a0
mov ecx, esi
push ebx
call fcn.10013fbe
mov edi, eax
cmp byte [ebp - 0x2005], 0
mov esi, ebx
jns 0x1001093a
push dword [ebp - 0x2010]
call fcn.10145bd4
add esp, 4
call fcn.10013f4c
mov ebx, eax
mov ecx, esi
push str.Wtsapi32.dll
call fcn.100349a0
mov ecx, ebx
push esi
call fcn.10013fbe
cmp byte [ebp - 0x2005], 0
jns 0x10010970
push dword [ebp - 0x2010]
mov ebx, eax
call fcn.10145bd4
mov eax, ebx
add esp, 4
xor ebx, ebx
cmp dword [ebp - 0x2648], 0
je 0x10010d2b
mov esi, edi
test edi, edi
je 0x10010d2b
mov dword [ebp - 0x2660], eax
test eax, eax
je 0x10010d2b
push str.EnumProcesses
mov edi, dword [ebp - 0x2648]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.GetModuleFileNameExA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x264c], eax
push str.GetProcessImageFileNameA
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x2658], eax
push str.OpenProcessToken
push esi
call edi
mov dword [ebp - 0x2654], eax
push str.GetTokenInformation
push esi
call edi
test ebx, ebx
je 0x10010d29
mov esi, ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x264c]
or ecx, dword [ebp - 0x2658]
je 0x10010d2b
cmp dword [ebp - 0x2654], 0
je 0x10010d2b
test eax, eax
je 0x10010d2b
mov dword [ebp - 0x265c], eax
mov eax, 0x2000
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x2010]
push eax
call fcn.10149430
add esp, 0xc
lea edi, [ebp - 0x2634]
mov dword [edi], ebx
mov ecx, esi
call dword [section..00cfg]
push edi
mov eax, 0x2000
push eax
lea eax, [ebp - 0x2010]
push eax
call esi
test eax, eax
je 0x10010d2b
mov eax, dword [ebp - 0x2634]
mov ecx, eax
shr ecx, 2
cmp eax, 0x2000
mov eax, 0x800
cmovb eax, ecx
mov dword [ebp - 0x2638], ebx
mov dword [ebp - 0x263c], ebx
mov dword [ebp - 0x2668], eax
test eax, eax
je 0x10010d6f
xor edi, edi
push 0x209
xor esi, esi
push esi
lea eax, [ebp - 0x2219]
push eax
call fcn.10149430
add esp, 0xc
mov ebx, 0x105
push ebx
push esi
lea eax, [ebp - 0x231e]
push eax
call fcn.10149430
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x2423]
push eax
call fcn.10149430
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x2528]
push eax
call fcn.10149430
add esp, 0xc
push ebx
mov ebx, dword [ebp - 0x2658]
push esi
lea eax, [ebp - 0x262d]
push eax
call fcn.10149430
add esp, 0xc
push dword [ebp + edi*4 - 0x2010]
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test eax, eax
jne 0x10010b31
push dword [ebp + edi*4 - 0x2010]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test eax, eax
je 0x10010c0e
test ebx, ebx
je 0x10010b56
mov ecx, ebx
call dword [section..00cfg]
push 0x208
lea eax, [ebp - 0x2219]
push eax
push esi
call ebx
test eax, eax
sete al
setne bl
jmp 0x10010b5a
mov al, 1
xor ebx, ebx
mov ecx, dword [ebp - 0x264c]
mov dword [ebp - 0x2648], edi
test al, al
je 0x10010b89
test ecx, ecx
je 0x10010b89
call dword [section..00cfg]
push 0x208
lea eax, [ebp - 0x2219]
push eax
push 0
push esi
call ecx
test eax, eax
jne 0x10010b8d
test bl, bl
je 0x10010beb
mov ecx, 0x104
push ecx
lea eax, [ebp - 0x262d]
push eax
push ecx
lea ebx, [ebp - 0x2528]
push ebx
push ecx
lea eax, [ebp - 0x2423]
push eax
push ecx
lea eax, [ebp - 0x231e]
push eax
lea eax, [ebp - 0x2219]
push eax
call fcn.1015bf42
add esp, 0x24
push ebx
push str.explorer
call fcn.1015c490
add esp, 8
test eax, eax
jne 0x10010beb
lea eax, [ebp - 0x262d]
push eax
push 0x101782ea
call fcn.1015c490
add esp, 8
test eax, eax
je 0x10010c20
mov edi, esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10010c05
push eax
call esi
mov dword [ebx], 0
push edi
call esi
mov edi, dword [ebp - 0x2648]
inc edi
cmp dword [ebp - 0x2668], edi
jne 0x10010a94
jmp 0x10010d6f
mov ecx, dword [ebp - 0x2654]
call dword [section..00cfg]
push dword [ebp + 8]
push 0x2000e
push esi
call ecx
test eax, eax
je 0x10010beb
mov edi, esi
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10010c05
mov ecx, dword [ebp - 0x265c]
call dword [section..00cfg]
lea eax, [ebp - 0x263c]
push eax
push 4
lea eax, [ebp - 0x2638]
push eax
push 0xc
push ebx
call ecx
test eax, eax
mov esi, edi
je 0x10010beb
mov eax, dword [ebp - 0x2664]
cmp dword [ebp - 0x2638], eax
je 0x10010d5d
push str.WTSQuerySessionInformationW
mov ebx, dword [ebp - 0x2660]
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov ecx, edi
mov edi, eax
push str.WTSFreeMemory
push ebx
call ecx
test edi, edi
je 0x10010beb
test eax, eax
je 0x10010beb
mov ecx, edi
mov dword [ebp - 0x2650], eax
xor eax, eax
mov dword [ebp - 0x2640], eax
mov dword [ebp - 0x2644], eax
xor edi, edi
mov ebx, dword [ebp - 0x2638]
call dword [section..00cfg]
lea eax, [ebp - 0x2644]
push eax
lea eax, [ebp - 0x2640]
push eax
push 8
push ebx
push edi
call ecx
test eax, eax
je 0x10010beb
mov ebx, dword [ebp - 0x2640]
test ebx, ebx
je 0x10010beb
cmp dword [ebp - 0x2644], 4
jne 0x10010d15
cmp dword [ebx], 0
je 0x10010d44
mov ecx, dword [ebp - 0x2650]
call dword [section..00cfg]
push ebx
call ecx
jmp 0x10010beb
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
add esp, 0x265c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x2650]
call dword [section..00cfg]
push ebx
call ecx
mov dword [ebp - 0x2640], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2638]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
setne bl
jmp 0x10010d2b