Function at 0x402669
Capabilities:
Impersonate user

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x40275d
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x40]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.004025a6
test eax, eax
jne 0x4026c0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rdx, str.error_Incorrect_runas_credentials_n
mov rcx, rax
call fcn.004020f1
jmp 0x40295a
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [rbp + 0x10]
lea r8, [rax + 0x28]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0
mov r9d, 2
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_LogonUserA]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x402750
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r9d, eax
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, str.error_Cannot_LogonUser__s__s__s___d_n
mov rcx, rax
call fcn.004020f1
jmp 0x40295a
mov dword [rbp - 4], 1
nop
jmp 0x40295a
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x34]
test eax, eax
je 0x4027c8
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 0x10]
mov r8, rax
mov edx, 0xf01ff
mov rax, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rax
test eax, eax
jne 0x40287b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_OpenProcessToken__d_n
mov rcx, rax
call fcn.004020f1
jmp 0x40295a
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
call rax
test eax, eax
jne 0x402819
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_ImpersonateNamedPipeClient__d_n
mov rcx, rax
call fcn.004020f1
jmp 0x40295a
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rcx, rax
lea rax, [rbp - 0x10]
mov r9, rax
mov r8d, 0
mov edx, 0xf01ff
mov rax, qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
call rax
test eax, eax
jne 0x40287b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_OpenThreadToken__d_n
mov rcx, rax
call fcn.004020f1
jmp 0x402906
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 0x28]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x30]
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov r9d, ecx
mov r8d, 0
mov edx, 0x2000000
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call rax
test eax, eax
jne 0x4028ef
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_Duplicate_Token__d_n
mov rcx, rax
call fcn.004020f1
jmp 0x4028f6
mov dword [rbp - 4], 1
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x34]
test eax, eax
jne 0x402959
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_RevertToSelf]
call rax
test eax, eax
jne 0x402959
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_RevertToSelf__d_n
mov rcx, rax
call fcn.004020f1
mov dword [rbp - 4], 0
jmp 0x40295a
nop
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret