Function at 0x10012670
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
cmp dword [esi + 0x2c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
jne 0x100126b0
push 0x10058ac0
push 0x10058ae0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x100126b0
push str.WTSGetActiveConsoleSessionId_Fail__r_n
call ebp
mov edi, str.WTSGetActiveConsoleSessionId_Fail__r_n
call fcn.10011e30
push 0x10058b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x10], eax
test eax, eax
je 0x100127df
cmp dword [esi + 0x30], 0
jne 0x100126ec
push 0x10058b28
push eax
call ebx
mov dword [esi + 0x30], eax
test eax, eax
jne 0x100126ec
push str.OpenProcessToken_Fail__r_n
call ebp
mov edi, str.OpenProcessToken_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x34], 0
jne 0x10012715
mov eax, dword [esi + 0x10]
push 0x10058b58
push eax
call ebx
mov dword [esi + 0x34], eax
test eax, eax
jne 0x10012715
push str.DuplicateTokenEx_Fail__r_n
call ebp
mov edi, str.DuplicateTokenEx_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x38], 0
jne 0x1001273e
mov ecx, dword [esi + 0x10]
push str.SetTokenInformation
push ecx
call ebx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x1001273e
push str.SetTokenInformation_Fail__r_n
call ebp
mov edi, str.SetTokenInformation_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x44], 0
jne 0x10012767
mov edx, dword [esi + 0x10]
push str.CreateProcessAsUserW
push edx
call ebx
mov dword [esi + 0x44], eax
test eax, eax
jne 0x10012767
push str.CreateProcessAsUserW_Fail__r_n
call ebp
mov edi, str.CreateProcessAsUserW_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x14], 0
jne 0x10012790
mov eax, dword [esi + 0x10]
push str.CreateProcessAsUserA
push eax
call ebx
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10012790
push str.Get_CreateProcessAsUserA_Fail__r_n
call ebp
mov edi, str.Get_CreateProcessAsUserA_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x20], 0
jne 0x100127b9
mov ecx, dword [esi + 0x10]
push 0x10058c2c
push ecx
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x100127b9
push str.Get_GetTokenInformation_Fail__r_n
call ebp
mov edi, str.Get_GetTokenInformation_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x4c], 0
jne 0x100127f0
mov edx, dword [esi + 0x10]
push str.LookupAccountSidA
push edx
call ebx
mov dword [esi + 0x4c], eax
test eax, eax
jne 0x100127f0
push str.Get_LookupAccountSid_Fail___r_n
call ebp
mov edi, str.Get_LookupAccountSid_Fail___r_n
jmp 0x100127eb
push str.LoadLibrary_Advapi32.dll__Fail__r_n
call ebp
mov edi, str.LoadLibrary_Advapi32.dll__Fail__r_n
call fcn.10011e30
push str.Userenv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100128a4
cmp dword [esi + 0x3c], 0
jne 0x1001282c
push str.CreateEnvironmentBlock
push eax
call ebx
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x1001282c
push str.CreateEnvironmentBlock_Fail__r_n
call ebp
mov edi, str.CreateEnvironmentBlock_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x40], 0
jne 0x10012855
mov eax, dword [esi + 0xc]
push str.DestroyEnvironmentBlock
push eax
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x10012855
push str.DestroyEnvironmentBlock_Fail__r_n
call ebp
mov edi, str.DestroyEnvironmentBlock_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x18], 0
jne 0x1001287e
mov ecx, dword [esi + 0xc]
push str.UnloadUserProfile
push ecx
call ebx
mov dword [esi + 0x18], eax
test eax, eax
jne 0x1001287e
push str.UnloadUserProfile_Fail__r_n
call ebp
mov edi, str.UnloadUserProfile_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x1c], 0
jne 0x100128b5
mov edx, dword [esi + 0xc]
push str.LoadUserProfileA
push edx
call ebx
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x100128b5
push str.LoadUserProfile_Fail__r_n
call ebp
mov edi, str.LoadUserProfile_Fail__r_n
jmp 0x100128b0
push str.LoadLibrary_Userenv.dll__Fail__r_n
call ebp
mov edi, str.LoadLibrary_Userenv.dll__Fail__r_n
call fcn.10011e30
push 0x10058db4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 8], eax
test eax, eax
je 0x100128ea
cmp dword [esi + 0x48], 0
jne 0x100128fb
push 0x10058dc4
push eax
call ebx
mov dword [esi + 0x48], eax
test eax, eax
jne 0x100128fb
push str.WTSQueryUserToken_Fail__r_n
call ebp
mov edi, str.WTSQueryUserToken_Fail__r_n
jmp 0x100128f6
push str.LoadLibrary_Wtsapi32.dll__Fail__r_n
call ebp
mov edi, str.LoadLibrary_Wtsapi32.dll__Fail__r_n
call fcn.10011e30
push 0x10057e44
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 4], eax
test eax, eax
je 0x1001295c
cmp dword [esi + 0x24], 0
jne 0x10012933
push 0x10058e18
push eax
call ebx
mov dword [esi + 0x24], eax
test eax, eax
jne 0x10012933
push str.Get_RtlConvertSidToUnicodeString_Fail__r_n
call ebp
mov edi, str.Get_RtlConvertSidToUnicodeString_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x28], 0
jne 0x1001295c
mov eax, dword [esi + 4]
push 0x10058e64
push eax
call ebx
mov dword [esi + 0x28], eax
test eax, eax
jne 0x1001295c
push str.Get_RtlFreeUnicodeString_Fail__r_n
call ebp
mov edi, str.Get_RtlFreeUnicodeString_Fail__r_n
call fcn.10011e30
cmp dword [esi + 0x2c], 0
je 0x100129ad
cmp dword [esi + 0x30], 0
je 0x100129ad
cmp dword [esi + 0x34], 0
je 0x100129ad
cmp dword [esi + 0x38], 0
je 0x100129ad
cmp dword [esi + 0x44], 0
je 0x100129ad
cmp dword [esi + 0x3c], 0
je 0x100129ad
cmp dword [esi + 0x40], 0
je 0x100129ad
cmp dword [esi + 0x48], 0
je 0x100129ad
cmp dword [esi + 0x20], 0
je 0x100129ad
cmp dword [esi + 0x24], 0
je 0x100129ad
cmp dword [esi + 0x28], 0
je 0x100129ad
cmp dword [esi + 0x4c], 0
je 0x100129ad
mov eax, 1
pop edi
pop ebp
pop ebx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
ret