Function at 0x1023c33
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [reloc.msvcrt.dll___p__fmode]
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
push edi
mov edi, 0x80
push eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
lea ebx, reloc.msvcrt.dll___p__fmode
lea esi, reloc.msvcrt.dll___p__fmode
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
call dword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
mov dword [ebp - 0x88], eax
je 0x1023b59
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1023d49
lea eax, [ebp - 0x94]
push eax
push 0
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1023b86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x88], eax
jmp 0x1023ceb
lea eax, [ebp - 0xac]
push eax
push edi
lea eax, [ebp - 0x84]
push eax
push 1
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1023b75
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, reloc.msvcrt.dll___p__fmode
push ecx
lea ecx, [ebp - 0x90]
push ecx
lea ecx, reloc.msvcrt.dll___p__fmode
push ecx
push eax
push 0
mov dword [ebp - 0xa8], eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x1023c76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov dword [ebp - 0x88], eax
jne 0x1023ceb
mov eax, dword [ebp - 0x90]
cmp eax, edi
jbe 0x1023c2a
add eax, eax
push eax
call fcn.01032298
mov ebx, eax
test ebx, ebx
pop ecx
mov dword [ebp - 0x9c], ebx
jne 0x1023c2a
mov dword [ebp - 0x88], 8
jmp 0x1023ceb
mov eax, dword [ebp - 0x8c]
cmp eax, edi
jbe 0x1023c49
add eax, eax
push eax
call fcn.01032298
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0x98], esi
je 0x1023c1b
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x8c]
push eax
push esi
lea eax, [ebp - 0x90]
push eax
push ebx
push dword [ebp - 0xa8]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x1023b75
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
push ebx
call edi
push esi
mov dword [ebp - 0x90], eax
call edi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x8c], eax
add eax, ecx
lea eax, [eax + eax + 4]
push eax
call fcn.01035a36
test eax, eax
mov dword [ebp - 0xa0], eax
je 0x1023c1b
mov ecx, dword [ebp - 0x8c]
mov edi, eax
rep movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 0x8c]
mov word [eax + ecx*2], 0x5c
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
lea ecx, [ecx + ecx + 2]
lea edi, [eax + edx*2 + 2]
mov eax, ecx
shr ecx, 2
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
xor esi, esi
cmp dword [ebp - 0x9c], esi
je 0x1023d07
push dword [ebp - 0x9c]
call fcn.0103228c
pop ecx
cmp dword [ebp - 0x98], esi
je 0x1023d1b
push dword [ebp - 0x98]
call fcn.0103228c
pop ecx
cmp dword [ebp - 0x94], esi
je 0x1023d2f
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x88], esi
je 0x1023d43
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01031d91
leave
ret