Function at 0x140019230
Capabilities:
Impersonate user

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1400643c8]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r13, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp qword [rbx + 0x18], 0x10
jb 0x14001927a
mov rbx, qword [rbx]
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140019287
mov rdx, qword [rsi]
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140019294
mov rcx, qword [r14]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
mov r9d, 9
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
je 0x1400192c4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400192d4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 1
jb 0x1400195ed
cmp qword [rsi + 0x18], 0x10
jb 0x1400192fc
mov rsi, qword [rsi]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea r12, [r15 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x58]
cmp r12, rbx
jbe 0x140019394
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140019356
mov rbx, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.14001df20
test rax, rax
je 0x1400195f3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001938f
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001937e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400195e7
jmp 0x140019337
test rcx, rcx
je 0x14001938d
call fcn.14001df20
mov rdi, rax
jmp 0x14001938f
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], rbx
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.14001ff70
mov byte [rdi + r15], 0x5c
mov byte [rdi + r12], 0
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1400193c3
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400053f0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140019430
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001942b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400195f9
call fcn.14001df5c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x38]
call fcn.140018f60
lea r8, [rsp + 0x78]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbp - 0x70]
cmp rsi, 0x10
cmovae r8, rdi
mov rax, r13
cmp qword [r13 + 0x18], 0x10
jb 0x14001947e
mov rax, qword [r13]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140019494
inc rax
test ecx, ecx
jne 0x140019481
test edx, edx
jne 0x1400194c4
lea rax, [rsp + 0x38]
cmp r13, rax
je 0x1400194c0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov rcx, r13
call fcn.140005480
mov bl, 1
jmp 0x14001953b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp], eax
lea rbx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rbx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov qword [rsp + 0x20], rbx
lea r8, str.err:__d___s_n
mov edx, 0x64
lea rcx, [rbp - 0x60]
call fcn.14001a0f0
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140019523
lea rdx, [rbp - 0x60]
mov rcx, r13
call fcn.140005480
xor bl, bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140019578
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019573
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400195ff
call fcn.14001df5c
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
cmp rsi, 0x10
jb 0x1400195be
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400195b6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400195e1
mov rcx, rdi
call fcn.14001df5c
movzx eax, bl
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14001df00
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140024798
int3
call fcn.140002d50
int3
call fcn.140002d70
int3
call fcn.140024798
nop
call fcn.140024798
nop
call fcn.140024798
int3