Function at 0x103c390
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf38
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x10015d4]
mov word [ebp - 0x408], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x406]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0xf30], dx
push 0x3fe
push 0
lea eax, [ebp - 0xf2e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cx, word [0x10015d4]
mov word [ebp - 0xb30], cx
push 0x3fe
push 0
lea edx, [ebp - 0xb2e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x40c], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.01020830
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x103c542
cmp dword [ebp - 0x40c], 2
jne 0x103c48a
push 0x200
lea edx, [ebp - 0x408]
push edx
push 0x1b5
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x4d8]
push edx
lea eax, [ebp - 0x408]
push eax
push 0x200
lea ecx, [ebp - 0xb30]
push ecx
call fcn.01011d00
add esp, 0x10
jmp 0x103c4e0
push 0x200
lea edx, [ebp - 0x408]
push edx
push 0x1b3
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp + 0xc]
add ecx, 0x10c
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x4d8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x63e
push ecx
lea edx, [ebp - 0x408]
push edx
push 0x200
lea eax, [ebp - 0xb30]
push eax
call fcn.01011d00
add esp, 0x18
push 0x200
lea ecx, [ebp - 0x408]
push ecx
push 0xdb
mov edx, dword [0x104ef34]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0xb30]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x408]
push eax
push 0x400
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x96c]
push edx
call fcn.01011d00
add esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x96c]
mov word [ecx + 0x7fe], 0
xor eax, eax
jmp 0x103c85b
lea edx, [ebp - 0x730]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x4d8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.010206b0
add esp, 0xc
test eax, eax
je 0x103c7a7
lea eax, [ebp - 0x730]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.01020a70
add esp, 8
test eax, eax
je 0x103c7a7
mov dword [ebp - 0xf34], 0
lea edx, [ebp - 0xf34]
push edx
push 0
push 8
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x730]
push edx
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x103c641
mov eax, dword [ebp + 0xc]
add eax, 0x758
push eax
push 1
push 0
push 0
push 0
mov ecx, dword [ebp - 0xf34]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x103c641
lea edx, [ebp - 0x730]
push edx
push 0x84
mov eax, dword [ebp + 0xc]
add eax, 0x75c
push eax
call fcn.01010390
lea ecx, [ebp - 0x628]
push ecx
push 0x84
mov edx, dword [ebp + 0xc]
add edx, 0x864
push edx
call fcn.01010390
push 0x31c
lea eax, [ebp - 0x730]
push eax
call fcn.01020dc0
add esp, 8
mov ecx, dword [ebp - 0xf34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x103c85b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xf38], eax
push 0
push 0x1ff
lea edx, [ebp - 0x408]
push edx
push 0x400
mov eax, dword [ebp - 0xf38]
push eax
push 0
push 0x3000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp - 0xf38], 0x569
jne 0x103c6d0
push 0x200
lea ecx, [ebp - 0xf30]
push ecx
push 0x1b6
mov edx, dword [0x104ef34]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x730]
push ecx
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0xf30]
push eax
push 0x200
lea ecx, [ebp - 0xb30]
push ecx
call fcn.01011d00
add esp, 0x18
jmp 0x103c71d
push 0x200
lea edx, [ebp - 0xf30]
push edx
push 0x1b1
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x730]
push edx
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0xf30]
push ecx
push 0x200
lea edx, [ebp - 0xb30]
push edx
call fcn.01011d00
add esp, 0x18
push 0x200
lea eax, [ebp - 0x408]
push eax
push 0xdb
mov ecx, dword [0x104ef34]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [ebp - 0xb30]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0x400
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x96c]
push ecx
call fcn.01011d00
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x96c]
mov word [eax + 0x7fe], 0
push 0x31c
lea ecx, [ebp - 0x730]
push ecx
call fcn.01020dc0
add esp, 8
cmp dword [ebp - 0xf34], 0
je 0x103c7a2
mov edx, dword [ebp - 0xf34]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x103c859
push 0x200
lea eax, [ebp - 0x408]
push eax
push 0x1b2
mov ecx, dword [0x104ef34]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x4d8]
push eax
lea ecx, [ebp - 0x408]
push ecx
push 0x200
lea edx, [ebp - 0xb30]
push edx
call fcn.01011d00
add esp, 0x10
push 0x200
lea eax, [ebp - 0x408]
push eax
push 0xdb
mov ecx, dword [0x104ef34]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [ebp - 0xb30]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0x400
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x96c]
push ecx
call fcn.01011d00
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x96c]
mov word [eax + 0x7fe], 0
push 0x31c
lea ecx, [ebp - 0x730]
push ecx
call fcn.01020dc0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret