Function at 0x402349
Capabilities:
Impersonate user

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x402422
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x40]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.00402286
test eax, eax
jne 0x4023a0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rdx, str.error_Incorrect_runas_credentials_n
mov rcx, rax
call fcn.00401e4e
jmp 0x4025d3
mov rax, qword [rbp + 0x10]
lea r8, [rax + 0x28]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0
mov r9d, 2
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_LogonUserA]
call rax
mov dword [rbp - 8], eax
cmp dword [rbp - 8], 0
jne 0x402415
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov rdx, qword [rbp - 0x20]
mov r9, qword [rbp - 0x28]
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, str.error_Cannot_LogonUser__s__s__s___d_n
call fcn.00401e4e
jmp 0x4025d3
mov dword [rbp - 4], 1
nop
jmp 0x4025d3
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x34]
test eax, eax
je 0x40247f
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
lea rdx, [rbp - 0x10]
mov r8, rdx
mov edx, 0xf01ff
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rax
test eax, eax
jne 0x402513
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_OpenProcessToken__d_n
mov rcx, rax
call fcn.00401e4e
jmp 0x4025d3
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
call rax
test eax, eax
jne 0x4024c2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_ImpersonateNamedPipeClient__d_n
mov rcx, rax
call fcn.00401e4e
jmp 0x4025d3
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
lea rdx, [rbp - 0x10]
mov r9, rdx
mov r8d, 0
mov edx, 0xf01ff
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
call rax
test eax, eax
jne 0x402513
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_OpenThreadToken__d_n
mov rcx, rax
call fcn.00401e4e
jmp 0x402590
mov rax, qword [rbp + 0x10]
lea rcx, [rax + 0x28]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x30]
mov edx, eax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, edx
mov r8d, 0
mov edx, 0x2000000
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call rax
test eax, eax
jne 0x402579
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_Duplicate_Token__d_n
mov rcx, rax
call fcn.00401e4e
jmp 0x402580
mov dword [rbp - 4], 1
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x34]
test eax, eax
jne 0x4025d3
mov rax, qword [sym.imp.ADVAPI32.dll_RevertToSelf]
call rax
test eax, eax
jne 0x4025d3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, edx
lea rdx, str.error_Cannot_RevertToSelf__d_n
mov rcx, rax
call fcn.00401e4e
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add rsp, 0x60
pop rbp
ret