Function at 0x4023b5
Capabilities:
Impersonate user

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x40249b
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x40]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.004022f2
test eax, eax
jne 0x40240c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rdx, str.error_Incorrect_runas_credentials_n
mov rcx, rax
call fcn.00401eb0
jmp 0x40264c
mov rax, qword [rbp + 0x10]
lea r8, [rax + 0x28]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0
mov r9d, 2
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_LogonUserA]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x40248e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r9d, eax
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, str.error_Cannot_LogonUser__s__s__s___d_n
mov rcx, rax
call fcn.00401eb0
jmp 0x40264c
mov dword [rbp - 4], 1
nop
jmp 0x40264c
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x34]
test eax, eax
je 0x4024f8
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 0x10]
mov r8, rax
mov edx, 0xf01ff
mov rax, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rax
test eax, eax
jne 0x40258c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_OpenProcessToken__d_n
mov rcx, rax
call fcn.00401eb0
jmp 0x40264c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
call rax
test eax, eax
jne 0x40253b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_ImpersonateNamedPipeClient__d_n
mov rcx, rax
call fcn.00401eb0
jmp 0x40264c
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rcx, rax
lea rax, [rbp - 0x10]
mov r9, rax
mov r8d, 0
mov edx, 0xf01ff
mov rax, qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
call rax
test eax, eax
jne 0x40258c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_OpenThreadToken__d_n
mov rcx, rax
call fcn.00401eb0
jmp 0x402609
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 0x28]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x30]
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov r9d, ecx
mov r8d, 0
mov edx, 0x2000000
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call rax
test eax, eax
jne 0x4025f2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_Duplicate_Token__d_n
mov rcx, rax
call fcn.00401eb0
jmp 0x4025f9
mov dword [rbp - 4], 1
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x34]
test eax, eax
jne 0x40264c
mov rax, qword [sym.imp.ADVAPI32.dll_RevertToSelf]
call rax
test eax, eax
jne 0x40264c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_RevertToSelf__d_n
mov rcx, rax
call fcn.00401eb0
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret