Function at 0x103f9e9
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c0
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x6b4], 0
and dword [ebp - 0x6b0], 0
push ebx
push esi
push edi
mov dword [ebp - 0x6c0], eax
mov eax, dword [0x1075004]
mov ebx, 0x1075004
cmp eax, ebx
je 0x103fa44
test byte [eax + 0x1c], 4
je 0x103fa44
cmp byte [eax + 0x19], 5
jb 0x103fa44
push 0x1002dc0
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push 0x2c
pop edi
push edi
call fcn.0105c544
mov esi, eax
test esi, esi
jne 0x103fa82
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fa7a
test byte [eax + 0x1c], 4
je 0x103fa7a
cmp byte [eax + 0x19], 2
jb 0x103fa7a
push 0x1002dc0
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push 8
pop eax
jmp 0x103fe53
push edi
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1078040
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi], edi
mov eax, dword [0x107809c]
mov dword [esi + 0x24], eax
mov eax, dword [0x107808c]
mov dword [esi + 0x14], eax
mov eax, dword [0x107807c]
mov dword [esi + 4], eax
mov eax, dword [0x1078080]
xor edi, edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov eax, dword [0x1078088]
cmp eax, edi
je 0x103fb0d
push eax
call fcn.0105ccae
mov dword [esi + 0x10], eax
cmp eax, edi
jne 0x103fb0d
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push 0x1002dc0
push 0x30
jmp 0x103fc5c
mov eax, dword [0x1078090]
cmp eax, edi
je 0x103fb5a
push eax
call fcn.0105ccae
mov dword [esi + 0x18], eax
cmp eax, edi
jne 0x103fb5a
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push 0x1002dc0
push 0x31
jmp 0x103fc5c
mov eax, dword [0x1078094]
cmp eax, edi
je 0x103fba7
push eax
call fcn.0105ccae
mov dword [esi + 0x1c], eax
cmp eax, edi
jne 0x103fba7
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push 0x1002dc0
push 0x32
jmp 0x103fc5c
push 0x2001f
push edi
push 0x1001bb0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.010600a9
mov dword [ebp - 0x6b4], eax
cmp eax, edi
jne 0x103fc10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6b0], eax
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ca9d
jmp 0x103fdf1
push edi
push 1
push 0x1001768
push 0x1001b9c
push eax
call fcn.0106970c
mov dword [esi + 0x20], eax
cmp eax, edi
jne 0x103fc6c
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push 0x1002dc0
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
jmp 0x103fdf1
cmp dword [ebp + 0xc], edi
je 0x103fde9
cmp dword [0x1078080], 2
jne 0x103fde9
mov eax, dword [0x10780a0]
cmp eax, edi
jne 0x103fd91
xor eax, eax
push 0x400
mov word [ebp - 0x6ac], ax
lea eax, [ebp - 0x6aa]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2a0
mov word [ebp - 0x2a8], ax
lea eax, [ebp - 0x2a6]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x151
lea eax, [ebp - 0x2a8]
push eax
push 0x201
lea eax, [ebp - 0x6ac]
push eax
push dword [0x1078094]
call dword [sym.imp.credui.dll_CredUIParseUserNameW]
mov dword [ebp - 0x6b0], eax
cmp eax, edi
je 0x103fd29
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x35
jmp 0x103fdd3
lea eax, [ebp - 0x6bc]
push eax
push edi
push 2
push dword [esi + 0x20]
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x6ac]
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x103fd86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6b0], eax
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x36
jmp 0x103fdd3
mov eax, dword [ebp - 0x6bc]
mov dword [0x10780a0], eax
lea ecx, [ebp - 0x6b8]
push ecx
push 3
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x103fde0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6b0], eax
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103fdf1
test byte [eax + 0x1c], 4
je 0x103fdf1
cmp byte [eax + 0x19], 2
jb 0x103fdf1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ca9d
jmp 0x103fdf1
mov eax, dword [ebp - 0x6b8]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x6c0]
mov dword [eax], esi
push 0x1078040
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x6b4], edi
je 0x103fe3d
push dword [ebp - 0x6b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x103fe3d
mov ecx, dword [0x1075004]
cmp ecx, ebx
je 0x103fe3d
test byte [ecx + 0x1c], 4
je 0x103fe3d
cmp byte [ecx + 0x19], 2
jb 0x103fe3d
push eax
push 0x1002dc0
push 0x38
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102ca9d
cmp dword [ebp - 0x6b0], edi
je 0x103fe4d
push 1
push esi
call fcn.0103f458
mov eax, dword [ebp - 0x6b0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105bb63
leave
ret 8