Function at 0x180056500
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push r14
lea rbp, [rsp - 0x1fd0]
mov eax, 0x20d0
call fcn.18006ce90
sub rsp, rax
lea eax, [rdx + 0xa]
mov r14, r8
mov rsi, rcx
cmp edx, eax
jae 0x18005677f
mov qword [rsp + 0x2100], rbx
lea r8, [0x180000000]
mov ebx, dword [rbp + 0x1ff8]
mov qword [rsp + 0x20c8], rdi
mov edi, dword [rbp + 0x1ff8]
mov qword [rsp + 0x20c0], r12
mov r12, qword [rbp - 0x78]
mov qword [rsp + 0x20b8], r13
lea r13d, [rdx - 0x7d]
mov edx, 3
mov qword [rsp + 0x20b0], r15
mov qword [rsp + 0x50], 0xa
lea r15d, [rdx - 2]
lea eax, [rdx + 7]
nop dword [rax]
cmp r13d, 0x17
ja case.default.0x1800565a5
mov ecx, dword [r8 + r13*4 + 0x56acc]
add rcx, r8
jmp rcx
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x800
call fcn.18006e5e0
lea rcx, [rbp + 0x17b0]
mov r8d, 0x800
lea rdx, [rbp - 0x50]
call fcn.18006e1d0
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x800
call fcn.18006e5e0
lea rcx, [rbp + 0xfb0]
mov r8d, 0x800
lea rdx, [rbp - 0x50]
call fcn.18006e1d0
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x800
call fcn.18006e5e0
lea rcx, [rbp + 0x7b0]
mov r8d, 0x800
lea rdx, [rbp - 0x50]
call fcn.18006e1d0
mov r9, qword [rbp + 0x2008]
lea r8, [0x180000000]
jmp 0x18005673b
mov rax, qword [rsi]
lea r8, [rbp + 0x1ff8]
mov r9d, 0x53
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov word [rbp + 0x1ff8], r15w
mov rcx, r12
call fcn.18002dab0
mov qword [rsp + 0x70], rax
mov byte [r12 + rax], 0
cmp byte [r12], 0x2a
jne 0x180056696
cmp byte [r12 + 1], 0
jne 0x180056696
mov rax, qword [rbp + 0x2010]
mov rax, qword [rax]
test rax, rax
je 0x180056727
mov rcx, rax
call fcn.180059f30
mov dword [rsp + 0x78], eax
jmp 0x180056727
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x1800566a0
test rax, rax
jne 0x1800566c1
cmp qword [0x1800be6c8], rax
je 0x1800566c1
mov rax, qword [0x1800be690]
jmp 0x180056716
mov rcx, r12
call fcn.180071acc
xor edx, edx
lea r8, [0x180095274]
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [r8 + rdx - 1]
jne 0x1800566f2
cmp rdx, 4
jne 0x1800566d2
mov rax, qword [0x1800be6a8]
test rax, rax
jne 0x180056685
mov rax, qword [rbp + 0x2010]
lea rdx, [rsp + 0x78]
mov r9d, 0x17
mov r8, r12
xor ecx, ecx
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
call fcn.180011cf0
test rax, rax
jne 0x180056685
mov dword [rsp + 0x78], 0xfffffffd
mov r9, qword [rbp + 0x2008]
lea r8, [0x180000000]
mov r15d, 1
mov edx, 3
mov rax, qword [rsp + 0x50]
inc r13d
sub rax, 1
mov qword [rsp + 0x50], rax
jne 0x180056590
mov r15, qword [rsp + 0x20b0]
mov r13, qword [rsp + 0x20b8]
mov r12, qword [rsp + 0x20c0]
mov rdi, qword [rsp + 0x20c8]
mov rbx, qword [rsp + 0x2100]
add rsp, 0x20d0
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rsi]
lea r8, [rbp + 0x1ff8]
mov r9d, 0x53
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x78], 0xffffffff
xor ecx, ecx
mov word [rbp + 0x1ff8], r15w
call fcn.18002dab0
lea r15, [rax + 1]
mov qword [rsp + 0x70], r15
jmp 0x180056727
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
lea r8, [rbp + 0x1ff8]
mov r9d, 0x53
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
mov word [rbp + 0x1ff8], r15w
lea rcx, [rbp + 0x17b0]
call fcn.18002dab0
mov eax, 2
lea r8, [rbp + 0x1ff8]
mov word [rbp + 0x1ff8], ax
lea rdx, [rsp + 0x58]
mov rax, qword [rsi]
lea rcx, [rbp + 0xfb0]
mov r9d, 0x53
mov qword [rsp + 0x58], rax
call fcn.18002dab0
mov r9, qword [rbp + 0x2008]
lea r8, [0x180000000]
jmp 0x18005673b
mov eax, dword [rsp + 0x78]
mov dword [rbp + 0x1ff8], eax
mov rax, qword [rsi]
lea r9, [rbp + 0x1ff8]
mov qword [rsp + 0x40], 0
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x38], 0
xor r8d, r8d
mov qword [rsp + 0x58], rax
xor edx, edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov r9, qword [rbp + 0x2008]
lea r8, [0x180000000]
jmp 0x18005673b
mov rcx, r12
call fcn.180072184
mov r9, qword [rbp + 0x2008]
lea r8, [0x180000000]
jmp 0x18005673b
mov qword [rbp - 0x80], 0
jmp case.0x1800565a5.1
mov rax, qword [rsi]
lea r8, [rbp + 0x1ff8]
mov word [rbp + 0x1ff8], dx
lea rcx, [rbp + 0x7b0]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov r9d, 0x53
call fcn.18002dab0
lea rax, [rbp - 0x80]
mov r9d, 3
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x7b0]
lea rdx, [rbp + 0xfb0]
mov dword [rsp + 0x20], 0
lea rcx, [rbp + 0x17b0]
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
mov esi, eax
test eax, eax
je 0x180056950
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180056950
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], 0
mov dword [rbp + 0x1ff8], esi
mov rsi, qword [rbp + 0x1ff0]
jmp 0x18005684f
xor r15d, r15d
mov dword [rsp + 0x60], 0xa0c0b
mov dword [rsp + 0x64], 0x1020f08
mov dword [rsp + 0x68], 0x3090406
mov dword [rsp + 0x6c], 0xe07050d
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [0x1800e0540], xmm0
mov edx, dword [r14]
mov eax, edx
shr eax, 0x18
mov ecx, edx
shr ecx, 0x10
add ecx, edx
shr edx, 8
add eax, ecx
lea ecx, [r15 + 0x10]
add eax, edx
and eax, 0xf
movzx r11d, byte [rax + r8 + 0xe0540]
cmp dword [r9], r15d
jle 0x180056735
mov r9, qword [rbp + 0x2010]
lea r12, [0x180000000]
sub rsi, r9
nop dword [rax]
nop word [rax + rax]
mov r8d, 5
lea r10d, [r8 + 1]
nop word [rax + rax]
cmp r8d, 5
ja case.default.0x180056a04
mov eax, r8d
mov edx, dword [r12 + rax*4 + 0x56b2c]
add rdx, r12
jmp rdx
movzx edx, bl
movzx eax, dil
shl dl, 4
and al, 0xf
or dl, al
mov byte [rsi + r9], dl
jmp case.default.0x180056a04
mov edx, dword [r14]
mov eax, edx
shr edx, cl
shr rax, cl
and eax, 0xf
movzx eax, byte [rax + r12 + 0xe0540]
add eax, edx
sub edi, eax
jmp case.default.0x180056a04
mov edx, dword [r14]
mov eax, edx
shr edx, cl
shr rax, cl
and eax, 0xf
movzx eax, byte [rax + r12 + 0xe0540]
add eax, edx
sub ebx, eax
test ecx, ecx
je 0x180056a59
sub ecx, 4
jmp case.default.0x180056a04
mov ecx, 0x10
jmp case.default.0x180056a04
sub edi, r11d
jmp case.default.0x180056a04
movzx ebx, byte [r9]
mov edi, ebx
shr ebx, 4
sub ebx, r11d
dec r8d
sub r10, 1
jne 0x1800569f0
mov rax, qword [rbp + 0x2008]
inc r15d
inc r9
cmp r15d, dword [rax]
jl 0x1800569e0
mov r12, qword [rbp - 0x78]
mov rsi, qword [rbp + 0x1ff0]
jmp 0x180056727
mov rcx, qword [rsp + 0x70]
call fcn.18007218c
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x78], rax
mov r12, rax
call fcn.18006e5e0
jmp 0x180056727