Function at 0x10010b40
Capabilities:
Check for debugger via api
Check if file exists
Enumerate processes
Get file attributes
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.100034d0
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.100034d0
add esp, 0x18
mov dword [ebp - 8], 0
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
je 0x10010cbd
mov esi, eax
cmp esi, 0xffffffff
je 0x10010cbd
push 0x228
lea eax, [ebp - 0xa34]
push ebx
push eax
call fcn.100034d0
add esp, 0xc
mov dword [ebp - 0xa38], 0x22c
lea eax, [ebp - 0xa38]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10010cdf
lea esi, [ebx + 1]
nop dword [eax + eax]
push 0x1001c228
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010cb6
push 0x1001c248
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010caf
push 0x1001c26c
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010ca8
push 0x1001c290
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010ca1
push 0x1001c2ac
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010c9a
push 0x1001c2c8
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010c93
push 0x1001c2e8
lea eax, [ebp - 0xa14]
push eax
call edi
test eax, eax
je 0x10010c8c
lea eax, [ebp - 0xa38]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10010cbd
inc esi
cmp esi, 0x3e8
jb 0x10010be0
jmp 0x10010cbf
mov ebx, 0x12
jmp 0x10010cbf
mov ebx, 0xf
jmp 0x10010cbf
mov ebx, 0xe
jmp 0x10010cbf
mov ebx, 0xb
jmp 0x10010cbf
mov ebx, 0xa
jmp 0x10010cbf
mov ebx, 9
jmp 0x10010cbf
mov ebx, 6
jmp 0x10010cbf
xor ebx, ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010cd2
cmp eax, 0xffffffff
je 0x10010cd2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10010cdf
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1001e664]
mov ecx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
je 0x10010d6e
push eax
call ecx
push dword [0x1001e664]
mov esi, eax
lea eax, [ebp - 0x80c]
push eax
call ebx
lea eax, [ebp - 0x80c]
lea eax, [eax + esi*2]
push 0x1001c300
push eax
mov dword [ebp - 4], eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x80c]
push eax
call esi
cmp eax, 0xffffffff
je 0x10010d40
test al, 0x10
je 0x10010d40
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c338
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0x80c]
push eax
call esi
cmp eax, 0xffffffff
je 0x10010d68
test al, 0x10
je 0x10010d68
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [0x1001e660]
test eax, eax
je 0x10010deb
push eax
call ecx
push dword [0x1001e660]
mov esi, eax
lea eax, [ebp - 0x80c]
push eax
call ebx
lea eax, [ebp - 0x80c]
lea eax, [eax + esi*2]
push 0x1001c364
push eax
mov dword [ebp - 4], eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x80c]
push eax
call esi
cmp eax, 0xffffffff
je 0x10010dc3
test al, 0x10
je 0x10010dc3
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c39c
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0x80c]
push eax
call esi
cmp eax, 0xffffffff
je 0x10010deb
test al, 0x10
je 0x10010deb
pop edi
pop esi
mov eax, 5
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c3c8
push 0x1001e680
call edi
test eax, eax
jne 0x10010e07
pop edi
pop esi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c3e4
push 0x1001e680
call edi
test eax, eax
jne 0x10010e23
pop edi
pop esi
mov eax, 0x2d
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c408
push 0x1001e680
call edi
test eax, eax
jne 0x10010e3f
pop edi
pop esi
mov eax, 0x2f
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c430
push 0x1001e680
call edi
test eax, eax
jne 0x10010e5b
pop edi
pop esi
mov eax, 0x30
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c464
push 0x1001e680
call edi
test eax, eax
jne 0x10010e77
pop edi
pop esi
mov eax, 0x31
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c48c
push 0x1001e680
call edi
test eax, eax
jne 0x10010e93
pop edi
pop esi
mov eax, 0x32
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c4a8
push 0x1001e680
call edi
test eax, eax
jne 0x10010eaf
pop edi
pop esi
mov eax, 0x33
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c4c4
push 0x1001e680
call edi
test eax, eax
jne 0x10010ecb
pop edi
pop esi
mov eax, 0x34
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c4e0
push 0x1001e680
call edi
test eax, eax
jne 0x10010ee7
pop edi
pop esi
mov eax, 0x35
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c4fc
push 0x1001e680
call edi
test eax, eax
jne 0x10010f03
pop edi
pop esi
mov eax, 0x36
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c524
push 0x1001e680
call edi
test eax, eax
jne 0x10010f1f
pop edi
pop esi
mov eax, 0x37
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c53c
push 0x1001e680
call edi
test eax, eax
jne 0x10010f3b
pop edi
pop esi
mov eax, 0x38
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c560
push 0x1001e680
call edi
test eax, eax
jne 0x10010f57
pop edi
pop esi
mov eax, 0x39
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c5a4
push 0x1001e680
call edi
test eax, eax
jne 0x10010f73
pop edi
pop esi
mov eax, 0x3a
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c5c4
push 0x1001e680
call edi
test eax, eax
jne 0x10010f8f
pop edi
pop esi
mov eax, 0x3b
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c5f0
push 0x1001e680
call edi
test eax, eax
jne 0x10010fab
pop edi
pop esi
mov eax, 0x3c
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea eax, [ebp - 0xc40]
push 0x1001c604
push eax
call esi
test eax, eax
je 0x10010fcf
pop edi
pop esi
mov eax, 0x2a
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c614
lea eax, [ebp - 0xc40]
push eax
call esi
test eax, eax
je 0x10010fed
pop edi
pop esi
mov eax, 0x2b
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c624
lea eax, [ebp - 0xc40]
push eax
call esi
test eax, eax
je 0x1001100b
pop edi
pop esi
mov eax, 0x2c
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c634
lea eax, [ebp - 0x80c]
push eax
call ebx
push 0x1001e680
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
sub ebx, 1
js 0x10011047
nop dword [eax + eax]
movzx eax, word [ebx*2 + 0x1001e680]
cmp eax, 0x5c
je 0x10011047
cmp eax, 0x2f
je 0x10011047
sub ebx, 1
jns 0x10011030
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebx*2 + 0x1001e682]
push ecx
lea ecx, [ebp - 0x80c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x80c]
push eax
call fcn.10011820
add esp, 4
cmp eax, 1
jne 0x1001108c
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c650
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100110ac
test al, 0x10
je 0x100110ac
pop edi
pop esi
mov eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c668
call fcn.10011820
add esp, 4
test eax, eax
je 0x100110c9
pop edi
pop esi
mov eax, 0xd
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c6a8
call fcn.10011820
add esp, 4
test eax, eax
je 0x100110e6
pop edi
pop esi
mov eax, 0x3d
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c6d0
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011103
pop edi
pop esi
mov eax, 0x3e
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c700
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011120
pop edi
pop esi
mov eax, 0x3f
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c728
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001113d
pop edi
pop esi
mov eax, 0x40
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c754
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001115a
pop edi
pop esi
mov eax, 0x41
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c770
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011177
pop edi
pop esi
mov eax, 0x42
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c794
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011194
pop edi
pop esi
mov eax, 0x43
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c7b0
call fcn.10011820
add esp, 4
test eax, eax
je 0x100111b1
pop edi
pop esi
mov eax, 0x44
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c7d4
call fcn.10011820
add esp, 4
test eax, eax
je 0x100111ce
pop edi
pop esi
mov eax, 0x45
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c804
call fcn.10011820
add esp, 4
test eax, eax
je 0x100111eb
pop edi
pop esi
mov eax, 0x46
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c81c
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011208
pop edi
pop esi
mov eax, 0x47
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c844
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011225
pop edi
pop esi
mov eax, 0x48
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c860
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011242
pop edi
pop esi
mov eax, 0x49
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c888
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001125f
pop edi
pop esi
mov eax, 0x4a
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c8b8
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001127c
pop edi
pop esi
mov eax, 0x4b
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c8ec
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011299
pop edi
pop esi
mov eax, 0x4c
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c924
call fcn.10011820
add esp, 4
test eax, eax
je 0x100112b6
pop edi
pop esi
mov eax, 0x4d
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c94c
call fcn.10011820
add esp, 4
test eax, eax
je 0x100112d3
pop edi
pop esi
mov eax, 0x4e
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c974
call fcn.10011820
add esp, 4
test eax, eax
je 0x100112f0
pop edi
pop esi
mov eax, 0x4f
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c994
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001130d
pop edi
pop esi
mov eax, 0x50
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c9c4
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001132a
pop edi
pop esi
mov eax, 0x51
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001c9ec
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011347
pop edi
pop esi
mov eax, 0x52
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001ca1c
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011364
pop edi
pop esi
mov eax, 0x53
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001ca3c
call fcn.10011820
add esp, 4
test eax, eax
je 0x10011381
pop edi
pop esi
mov eax, 0x54
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001ca74
call fcn.10011820
add esp, 4
test eax, eax
je 0x1001139e
pop edi
pop esi
mov eax, 0x55
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cab0
call fcn.10011820
add esp, 4
test eax, eax
je 0x100113bb
pop edi
pop esi
mov eax, 0x56
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1001cad8
call ebx
test eax, eax
je 0x100113d8
pop edi
pop esi
mov eax, 0x10
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001caf0
call ebx
test eax, eax
je 0x100113ef
pop edi
pop esi
mov eax, 0x11
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cb08
call ebx
test eax, eax
je 0x10011406
pop edi
pop esi
mov eax, 0x1d
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cb20
call ebx
test eax, eax
je 0x1001141d
pop edi
pop esi
mov eax, 0x1e
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cb3c
call ebx
test eax, eax
je 0x10011434
pop edi
pop esi
mov eax, 0x1f
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cb54
call ebx
test eax, eax
je 0x10011460
cmp eax, 0xffffffff
je 0x10011460
push 0x1001cb6c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10011460
pop edi
pop esi
mov eax, 0x13
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10011476
pop edi
pop esi
mov eax, 0x20
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x1001149d
cmp dword [ebp - 8], 0
je 0x1001149d
pop edi
pop esi
mov eax, 0x21
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0xc], 0x400
mov word [ebp - 0x80c], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x1001cb84
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x100114dc
pop edi
pop esi
mov eax, 0x22
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cb94
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x100114fa
pop edi
pop esi
mov eax, 0x23
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cbb4
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x10011518
pop edi
pop esi
mov eax, 0x24
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cbc4
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x10011536
pop edi
pop esi
mov eax, 0x25
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cbd0
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x10011554
pop edi
pop esi
mov eax, 0x26
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cbe0
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x10011572
pop edi
pop esi
mov eax, 0x27
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cbf4
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x10011590
pop edi
pop esi
mov eax, 0x28
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001cc00
lea eax, [ebp - 0x80c]
push eax
call edi
test eax, eax
jne 0x100115ae
pop edi
pop esi
mov eax, 0x29
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
push 0x400
lea eax, [ebp - 0x80c]
push eax
push 0
push edi
push 0x1001cc18
push 0x80000002
call fcn.100022b0
add esp, 0x18
movzx eax, al
mov dword [ebp - 8], eax
lea eax, [ebp - 0x80c]
push 0x1001cc5c
push eax
call esi
test eax, eax
jne 0x100117ea
push 0x1001cc68
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117de
push 0x1001cc78
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117d2
push 0x1001cca8
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117c6
push 0x1001ccbc
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117ba
cmp dword [ebp - 8], eax
je 0x1001166f
push 0x400
lea eax, [ebp - 0x80c]
push eax
push 0
push edi
push 0x1001ccd8
push 0x80000002
call fcn.100022b0
add esp, 0x18
test al, al
jne 0x100116e7
push 0x1001cd20
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117ea
push 0x1001cd2c
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117de
push 0x1001cd3c
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117d2
push 0x1001cd6c
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117c6
push 0x1001cd80
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
jne 0x100117ba
inc edi
cmp edi, 0x14
jb 0x100115b0
push 0x400
lea eax, [ebp - 0x80c]
push eax
push 0
push 0x1001cd98
push 0x1001cdbc
push 0x80000002
call fcn.100021a0
add esp, 0x18
test al, al
jne 0x1001176a
push 0x1001cdf4
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
je 0x1001172e
pop edi
pop esi
mov eax, 0x19
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001ce0c
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
je 0x1001174c
pop edi
pop esi
mov eax, 0x1a
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1001ce24
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
je 0x1001176a
pop edi
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x80c]
push eax
push 0
push 0x1001ce3c
push 0x1001ce60
push 0x80000002
call fcn.100021a0
add esp, 0x18
test al, al
jne 0x100117b1
push 0x1001ce98
lea eax, [ebp - 0x80c]
push eax
call esi
test eax, eax
je 0x100117b1
pop edi
pop esi
mov eax, 0x1c
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x18
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x17
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x16
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x15
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x14
pop ebx
mov esp, ebp
pop ebp
ret