Function at 0x42fbc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x998
mov eax, dword [0x521e28]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x128], 0
push 0x118
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.004ad2c0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 5
jae 0x42fc21
xor eax, eax
jmp 0x430246
cmp dword [ebp - 0x124], 5
jne 0x42ff30
cmp dword [ebp - 0x120], 0
jne 0x42ff30
push 0x4f5198
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x42ff30
mov dword [ebp - 0x130], 0
push 0x4f51b4
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x130], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x42fc8d
lea eax, [ebp + 0xc]
push eax
call fcn.004304c0
add esp, 4
mov dword [ebp - 0x134], 0
push 0x4f51c4
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x42ff19
cmp dword [ebp - 0x130], 0
je 0x42ff19
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x13c]
push eax
push 1
push 0
push 0
call dword [ebp - 0x134]
test eax, eax
je 0x42ff19
cmp dword [ebp - 0x13c], 0
je 0x42fef9
cmp dword [ebp - 0x138], 0
jbe 0x42fef9
mov cx, word [0x4f51dc]
mov word [ebp - 0x550], cx
push 0x206
push 0
lea edx, [ebp - 0x54e]
push edx
call fcn.004ad2c0
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x42fd73
push 0x104
lea eax, [ebp - 0x550]
push eax
call fcn.0042fb50
add esp, 8
test eax, eax
jne 0x42fd71
push 0x4f51e0
push 0x104
lea ecx, [ebp - 0x550]
push ecx
call fcn.00405230
jmp 0x42fd88
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x550]
push eax
call fcn.00405230
push 0x104
lea ecx, [ebp - 0x550]
push ecx
call fcn.004b25c7
add esp, 8
mov dx, word [0x4f51fc]
mov word [ebp - 0x348], dx
push 0x206
push 0
lea eax, [ebp - 0x346]
push eax
call fcn.004ad2c0
add esp, 0xc
mov dword [ebp - 0x554], 0
jmp 0x42fddb
mov ecx, dword [ebp - 0x554]
add ecx, 1
mov dword [ebp - 0x554], ecx
mov edx, dword [ebp - 0x554]
cmp edx, dword [ebp - 0x138]
jae 0x42fef9
mov eax, dword [ebp - 0x554]
shl eax, 4
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx + eax + 8]
push edx
push 0x104
lea eax, [ebp - 0x348]
push eax
call fcn.00405230
push 0x104
lea ecx, [ebp - 0x348]
push ecx
call fcn.004b25c7
add esp, 8
lea edx, [ebp - 0x550]
push edx
lea eax, [ebp - 0x348]
push eax
call fcn.00419d50
add esp, 8
test eax, eax
je 0x42fef4
mov ecx, dword [ebp - 0x554]
shl ecx, 4
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + ecx]
jne 0x42fef4
mov ecx, dword [ebp - 0x554]
shl ecx, 4
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + ecx + 4]
mov dword [ebp - 0x55c], eax
mov ecx, dword [ebp - 0x55c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
je 0x42fef2
mov dword [ebp - 0x560], 0xffffffff
lea edx, [ebp - 0x560]
push edx
push 0xb
mov eax, dword [ebp - 0x558]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42fedb
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x560]
mov dword [ecx], edx
mov dword [ebp - 0x560], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x558]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x558], 0
jmp 0x42fef9
jmp 0x42fdcc
cmp dword [ebp - 0x13c], 0
je 0x42ff0f
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x130]
mov dword [ebp - 0x13c], 0
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x12c], 0
cmp dword [ebp - 0x124], 5
jne 0x42ff42
cmp dword [ebp - 0x120], 1
jae 0x42ff4f
cmp dword [ebp - 0x124], 5
jbe 0x430243
push 0x4f5200
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0
je 0x430243
cmp dword [ebp + 0xc], 0xffffffff
jne 0x42ff7f
lea eax, [ebp + 0xc]
push eax
call fcn.004304c0
add esp, 4
mov dword [ebp - 0x56c], 0
push str.WTSEnumerateProcessesW
mov ecx, dword [ebp - 0x564]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x568], 0
push 0x4f5234
mov edx, dword [ebp - 0x564]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x56c], 0
je 0x43022c
cmp dword [ebp - 0x568], 0
je 0x43022c
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x570], 0
lea eax, [ebp - 0x570]
push eax
lea ecx, [ebp - 0x574]
push ecx
push 1
push 0
push 0
call dword [ebp - 0x56c]
test eax, eax
je 0x43020c
cmp dword [ebp - 0x574], 0
je 0x43020c
cmp dword [ebp - 0x570], 0
jbe 0x43020c
mov dx, word [0x4f5244]
mov word [ebp - 0x988], dx
push 0x206
push 0
lea eax, [ebp - 0x986]
push eax
call fcn.004ad2c0
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x430087
push 0x104
lea ecx, [ebp - 0x988]
push ecx
call fcn.0042fb50
add esp, 8
test eax, eax
jne 0x430085
push str.EXPLORER.EXE
push 0x104
lea edx, [ebp - 0x988]
push edx
call fcn.00405230
jmp 0x43009c
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x988]
push ecx
call fcn.00405230
push 0x104
lea edx, [ebp - 0x988]
push edx
call fcn.004b25c7
add esp, 8
mov ax, word [0x4f5264]
mov word [ebp - 0x780], ax
push 0x206
push 0
lea ecx, [ebp - 0x77e]
push ecx
call fcn.004ad2c0
add esp, 0xc
mov dword [ebp - 0x98c], 0
jmp 0x4300ee
mov edx, dword [ebp - 0x98c]
add edx, 1
mov dword [ebp - 0x98c], edx
mov eax, dword [ebp - 0x98c]
cmp eax, dword [ebp - 0x570]
jae 0x43020c
mov ecx, dword [ebp - 0x98c]
shl ecx, 4
mov edx, dword [ebp - 0x574]
mov eax, dword [edx + ecx + 8]
push eax
push 0x104
lea ecx, [ebp - 0x780]
push ecx
call fcn.00405230
push 0x104
lea edx, [ebp - 0x780]
push edx
call fcn.004b25c7
add esp, 8
lea eax, [ebp - 0x988]
push eax
lea ecx, [ebp - 0x780]
push ecx
call fcn.00419d50
add esp, 8
test eax, eax
je 0x430207
mov edx, dword [ebp - 0x98c]
shl edx, 4
mov eax, dword [ebp - 0x574]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + edx]
jne 0x430207
mov edx, dword [ebp - 0x98c]
shl edx, 4
mov eax, dword [ebp - 0x574]
mov ecx, dword [eax + edx + 4]
mov dword [ebp - 0x994], ecx
mov edx, dword [ebp - 0x994]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 0
je 0x430205
mov dword [ebp - 0x998], 0xffffffff
lea eax, [ebp - 0x998]
push eax
push 0xb
mov ecx, dword [ebp - 0x990]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4301ee
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x998]
mov dword [edx], eax
mov dword [ebp - 0x998], 0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x990]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x990], 0
jmp 0x43020c
jmp 0x4300df
cmp dword [ebp - 0x574], 0
je 0x430222
mov edx, dword [ebp - 0x574]
push edx
call dword [ebp - 0x568]
mov dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x564]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x564], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ad2aa
mov esp, ebp
pop ebp
ret