Function at 0x40a820
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x40a859
push str.WTSGetActiveConsoleSessionId
push 0x43d418
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
mov dword [esi + 0x2c], eax
jne 0x40a859
push str.WTSGetActiveConsoleSessionId_Fail__r_n
call ebp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x43db28
call ebx
test eax, eax
mov dword [esi + 0x10], eax
je 0x40a94f
mov ecx, dword [esi + 0x30]
test ecx, ecx
jne 0x40a88f
push str.OpenProcessToken
push eax
call edi
test eax, eax
mov dword [esi + 0x30], eax
jne 0x40a88f
push str.OpenProcessToken_Fail__r_n
call ebp
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x40a8af
mov eax, dword [esi + 0x10]
push str.DuplicateTokenEx
push eax
call edi
test eax, eax
mov dword [esi + 0x34], eax
jne 0x40a8af
push str.DuplicateTokenEx_Fail__r_n
call ebp
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x40a8cf
mov ecx, dword [esi + 0x10]
push str.SetTokenInformation
push ecx
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x40a8cf
push str.SetTokenInformation_Fail__r_n
call ebp
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x40a8ef
mov edx, dword [esi + 0x10]
push str.CreateProcessAsUserW
push edx
call edi
test eax, eax
mov dword [esi + 0x44], eax
jne 0x40a8ef
push str.CreateProcessAsUserW_Fail__r_n
call ebp
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x40a90f
mov eax, dword [esi + 0x10]
push str.CreateProcessAsUserA
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
jne 0x40a90f
push str.Get_CreateProcessAsUserA_Fail__r_n
call ebp
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x40a92f
mov ecx, dword [esi + 0x10]
push str.GetTokenInformation
push ecx
call edi
test eax, eax
mov dword [esi + 0x20], eax
jne 0x40a92f
push str.Get_GetTokenInformation_Fail__r_n
call ebp
mov eax, dword [esi + 0x4c]
test eax, eax
jne 0x40a956
mov edx, dword [esi + 0x10]
push str.LookupAccountSidA
push edx
call edi
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x40a956
push str.Get_LookupAccountSid_Fail___r_n
jmp 0x40a954
push str.LoadLibrary_Advapi32.dll__Fail__r_n
call ebp
push str.Userenv.dll
call ebx
test eax, eax
mov dword [esi + 0xc], eax
je 0x40a9e1
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jne 0x40a981
push str.CreateEnvironmentBlock
push eax
call edi
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x40a981
push str.CreateEnvironmentBlock_Fail__r_n
call ebp
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x40a9a1
mov eax, dword [esi + 0xc]
push str.DestroyEnvironmentBlock
push eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
jne 0x40a9a1
push str.DestroyEnvironmentBlock_Fail__r_n
call ebp
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x40a9c1
mov ecx, dword [esi + 0xc]
push str.UnloadUserProfile
push ecx
call edi
test eax, eax
mov dword [esi + 0x18], eax
jne 0x40a9c1
push str.UnloadUserProfile_Fail__r_n
call ebp
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x40a9e8
mov edx, dword [esi + 0xc]
push str.LoadUserProfileA
push edx
call edi
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x40a9e8
push str.LoadUserProfile_Fail__r_n
jmp 0x40a9e6
push str.LoadLibrary_Userenv.dll__Fail__r_n
call ebp
push str.Wtsapi32.dll
call ebx
test eax, eax
mov dword [esi + 8], eax
je 0x40aa13
mov ecx, dword [esi + 0x48]
test ecx, ecx
jne 0x40aa1a
push str.WTSQueryUserToken
push eax
call edi
test eax, eax
mov dword [esi + 0x48], eax
jne 0x40aa1a
push str.WTSQueryUserToken_Fail__r_n
jmp 0x40aa18
push str.LoadLibrary_Wtsapi32.dll__Fail__r_n
call ebp
push 0x43d82c
call ebx
test eax, eax
mov dword [esi + 4], eax
pop ebx
je 0x40aa66
mov ecx, dword [esi + 0x24]
test ecx, ecx
jne 0x40aa46
push str.RtlConvertSidToUnicodeString
push eax
call edi
test eax, eax
mov dword [esi + 0x24], eax
jne 0x40aa46
push str.Get_RtlConvertSidToUnicodeString_Fail__r_n
call ebp
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x40aa66
mov eax, dword [esi + 4]
push str.RtlFreeUnicodeString
push eax
call edi
test eax, eax
mov dword [esi + 0x28], eax
jne 0x40aa66
push str.Get_RtlFreeUnicodeString_Fail__r_n
call ebp
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x30]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x38]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x44]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x40]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x48]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x24]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40aac3
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x40aac3
pop edi
pop esi
mov eax, 1
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebp
ret