Function at 0x4085a0
Capabilities:
Impersonate user
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468613
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x48b270]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [esi + 0x44]
cmp dword [ecx + 0x54], 0
mov edx, 0x46f104
jne 0x4085e3
mov edx, 0x46f31c
mov eax, dword [ecx + 0x3c]
mov ebx, dword [esi + 0x48]
push 0
push 0
push 1
push eax
push eax
mov eax, dword [ecx + 0x30]
lea edi, [esi + 0x48]
push edx
mov edx, dword [ebx + 4]
push eax
mov ecx, edi
call edx
test eax, eax
jne 0x4086a3
call fcn.00432e51
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408622
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x18]
push str.CW3MFCServer::ListenSocketFunction__Failed_to_create_thread_pool__GetLastError:_d
push ecx
call fcn.00401f50
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call edx
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x44]
xor ebx, ebx
cmp dword [ecx + 0x3c], ebx
jle 0x4086d3
lea ecx, [ecx]
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
push ebx
mov ecx, edi
call eax
mov dword [eax + 0x34], esi
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x44]
inc ebx
cmp ebx, dword [edx + 0x3c]
jl 0x4086b0
mov eax, dword [esi + 0x44]
mov ecx, dword [eax + 0x4c]
mov edx, dword [eax + 0x48]
push ecx
push edx
mov ecx, edi
call fcn.00407320
test eax, eax
jne 0x408750
call fcn.00432e51
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408703
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x1c]
push str.CW3MFCServer::ListenSocketFunction__Failed_in_call_to_m_ThreadPool.SetMaxThreadClientLifetime__GetLastError:_d
push ecx
call fcn.00401f50
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x1c]
jmp 0x40866a
lea ecx, [ebp - 0x7c]
call fcn.004078a0
mov eax, dword [esi + 0x44]
add eax, 0x24
mov edi, 2
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call fcn.004042c0
mov eax, dword [esi + 0x44]
mov ecx, dword [eax + 0x20]
movzx edx, word [eax + 4]
neg ecx
sbb ecx, ecx
and ecx, 0x15
add ecx, edi
push ecx
push 1
push edx
lea ecx, [ebp - 0x7c]
call fcn.00406a10
mov dword [ebp - 4], edi
push SysReAllocString
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 6
call fcn.00406350
mov dword [ebp - 4], edi
mov edi, dword [esi + 0x44]
mov eax, dword [edi + 0x34]
mov edx, dword [eax - 0xc]
add edi, 0x34
xor eax, eax
test edx, edx
setne al
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x40], eax
test eax, eax
je 0x408a37
mov eax, dword [edi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, edx
or eax, ecx
jge 0x4087ec
push edx
mov ecx, edi
call fcn.004017a0
mov ebx, dword [edi]
mov edi, dword [esi + 0x44]
mov ecx, dword [edi + 0x38]
mov edx, dword [ecx - 0xc]
add edi, 0x38
mov eax, ecx
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, edx
or eax, ecx
jge 0x408818
push edx
mov ecx, edi
call fcn.004017a0
mov eax, dword [edi]
lea edi, [esi + 0x9c]
push edi
push 0
push 3
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
je 0x408841
mov edi, dword [edi]
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [ebp - 0x34], eax
jmp 0x4088b7
call fcn.00432e51
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40885b
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
lea ecx, [ebp - 0x20]
push str.CW3MFCServer::ListenSocketFunction__Failed_to_logon_using_user_name:__s__GetLastError:_d
push ecx
call fcn.00401f50
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call edx
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esi + 0x44]
mov eax, dword [edi + 0x34]
mov ecx, dword [eax - 8]
add edi, 0x34
test eax, eax
je 0x4088d9
push ecx
push eax
call fcn.00450e3f
add esp, 8
test eax, eax
jl 0x4089ae
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4089ae
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 0x44]
mov eax, dword [edi + 0x38]
mov ecx, dword [eax - 8]
add edi, 0x38
test eax, eax
je 0x40890f
push ecx
push eax
call fcn.00450e3f
add esp, 8
test eax, eax
jl 0x4089ae
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4089ae
mov dword [ecx - 0xc], eax
mov edx, dword [edi]
mov byte [eax + edx], 0
mov edi, dword [esi + 0x44]
mov eax, dword [edi + 0x38]
mov ebx, dword [eax - 0xc]
add edi, 0x38
test ebx, ebx
je 0x408980
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or eax, ecx
jge 0x40894c
push ebx
mov ecx, edi
call fcn.004017a0
mov eax, dword [edi]
mov edi, edi
mov byte [eax], 0
inc eax
sub ebx, 1
jne 0x408950
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x408970
push ecx
push eax
call fcn.00450e3f
add esp, 8
test eax, eax
jl 0x4089ae
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4089ae
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
cmp dword [ebp - 0x40], 0
je 0x408a37
cmp dword [ebp - 0x34], 0
jne 0x408a37
call fcn.00432e51
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4089b8
push 0x80004005
call fcn.00401090
push 0x80070057
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
push str.CW3MFCServer::ListenSocketFunction__Failed_to_impersonate_using_supplied_user_credentials
push ecx
mov byte [ebp - 4], 0xa
call fcn.00401f50
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
add esp, 8
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call edx
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a16
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.00407900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
push 8
push eax
lea ecx, [ebp - 0x7c]
call fcn.004063f0
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x408ab5
call fcn.00432e51
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408a6b
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
push str.CW3MFCServer::ListenSocketFunction__Failed_in_call_to_WSAEventSelect__GetLastError:_d
push ecx
call fcn.00401f50
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call edx
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x28]
jmp 0x4089f6
mov ecx, dword [esi + 0x2c]
push ecx
mov dword [esi + 0x40], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x60]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x28], ecx
nop
cmp dword [ebp - 0x3c], 0
jne 0x408c93
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x58]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x408b07
mov dword [ebp - 0x3c], 1
jmp 0x408ae0
cmp eax, 1
jne 0x408ae0
push 0x30
call fcn.0043189c
mov edi, eax
add esp, 4
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0xc
test edi, edi
je 0x408b43
lea ecx, [edi + 0x1c]
call fcn.004078a0
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
jmp 0x408b45
xor edi, edi
lea eax, [ebp - 0x44]
push eax
push edi
lea ebx, [edi + 0x1c]
push ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x38], edi
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x44], 0x1c
call fcn.00406490
lea ecx, [ebp - 0x68]
call fcn.00406c60
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x60], edi
call edx
test eax, eax
jne 0x408c19
test edi, edi
je 0x408ba4
mov ecx, ebx
call fcn.00407900
push edi
call fcn.004318cb
add esp, 4
call fcn.00432e51
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408bbe
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
push str.CW3MFCServer::ListenSocketFunction__An_error_occurred_posted_the_request_to_the_thread_pool__GetLastError:_d
push ecx
call fcn.00401f50
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call edx
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 2
jmp 0x408ae0
cmp dword [ebp - 0x40], 0
je 0x408ca5
cmp dword [ebp - 0x34], 0
je 0x408ca5
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [esi + 0x48]
mov eax, dword [edx + 8]
lea ecx, [esi + 0x48]
call eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0x11
call fcn.0043748a
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.00406600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret