Function at 0x180022ef0
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, qword [rsp + 0x38]
mov r14, r8
imul r13d, ecx, 0x5ee
mov r15d, ecx
mov qword [rsp + 0x30], rdx
mov esi, ecx
cmp ecx, r13d
ja 0x180023352
mov r12, qword [rbp - 0x59]
lea r8, [0x180000000]
xor edi, edi
lea r11d, [rdi + 0x6c]
lea r9d, [rdi + 0x5f]
lea r10d, [rdi + 0x2e]
lea ecx, [rdi + 0x77]
nop dword [rax + rax]
cmp esi, 0x4dd
ja 0x180023286
je 0x18002302e
mov eax, esi
sub eax, 3
je 0x18002301e
sub eax, 0x81
je 0x180022ff1
sub eax, 0x40
je 0x180022fdc
sub eax, 0xdd
je 0x180022fc6
cmp eax, 0x19e
jne 0x180023340
mov edx, 0xb2
mov dword [rbp + 5], 0x6c0064
mov r8d, 0x16
mov dword [rbp + 9], 0x6c
lea rcx, [rbp - 9]
call fcn.18005f890
mov qword [rbp - 0x51], rax
jmp 0x180023322
mov word [rbp - 3], r9w
mov dword [rbp - 1], 0x320033
mov word [rbp + 3], r10w
jmp 0x180023340
mov ebx, dword [r14]
mov rbx, qword [r8 + rbx*8 + 0x1166b0]
mov qword [rsp + 0x38], rbx
jmp 0x180023340
mov dword [rsp + 0x28], 0x11a
lea r9, [rbp - 0x71]
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x75]
mov dword [rbp - 0x69], edi
lea rcx, [rbp - 0x79]
call fcn.18002b2c0
mov r12, rax
jmp 0x180023322
mov word [rbp - 9], cx
mov dword [rbp - 7], 0x320073
jmp 0x180023340
xor r9d, r9d
mov rdx, r14
xor ecx, ecx
lea r8d, [r9 + 1]
call fcn.180023510
test al, al
jne 0x180023322
nop word [rax + rax]
lea r8, [0x180000000]
cmp edi, 0xfc
ja case.0x180023079.14
mov eax, edi
movzx eax, byte [r8 + rax + 0x233fc]
mov ecx, dword [r8 + rax*4 + 0x233c0]
add rcx, r8
jmp rcx
mov r8d, 2
lea rdx, [0x18007aad8]
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [str.int__]
lea r8, [0x180000000]
mov dword [rbp - 0x18], eax
movzx eax, word [0x18007b6b0]
mov word [rbp - 0x14], ax
jmp case.0x180023079.14
mov eax, dword [str.s__x]
mov dword [rbp - 0x3d], eax
movzx eax, word [0x18007b6b8]
mov word [rbp - 0x39], ax
jmp case.0x180023079.14
lea rcx, [rbp - 0x49]
mov word [rbp - 0xd], 0x2e
dec rcx
mov byte [rbp - 0x49], 0
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800230e0
movzx eax, word [0x1800797f0]
mov word [rcx], ax
movzx eax, word [0x18007b6bc]
mov word [rbp - 0x48], ax
movzx eax, byte [0x18007b6be]
mov byte [rbp - 0x46], al
jmp case.0x180023079.14
mov r8d, 2
lea rdx, [0x1800799e0]
lea rcx, [rbp - 0x1f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [0x180000000]
jmp case.0x180023079.14
mov r8d, 1
lea rdx, [0x18007b6c0]
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x18007b6c4]
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea r8, [0x180000000]
jmp case.0x180023079.14
mov dword [rbp - 0x29], 0x3a7325
mov eax, 0x74
mov dword [rbp - 0x26], 0x6f4e20
mov word [rbp - 0x23], ax
jmp case.0x180023079.14
mov eax, 0x78
mov word [rbp - 0x35], ax
mov eax, 0x20
mov word [rbp - 0x34], ax
movzx eax, word [0x18007b6c4]
mov word [rbp - 0x33], ax
movzx eax, word [0x18007b6cc]
mov word [rbp - 0x31], ax
movzx eax, byte [0x18007b6ce]
mov byte [rbp - 0x2f], al
jmp case.0x180023079.14
mov eax, 0x27
mov word [rbp - 0x46], ax
mov eax, 0x69
mov dword [rbp - 0x45], 0x662074
mov word [rbp - 0x42], ax
mov eax, 0x25
mov dword [rbp - 0x41], 0x20646e
mov word [rbp - 0x3e], ax
jmp case.0x180023079.14
movzx eax, word [0x18007b6d0]
mov dword [rbp - 0x1e], 0x6e6977
mov word [rbp - 0x1b], ax
movzx eax, byte [0x18007b6d2]
mov byte [rbp - 0x19], al
jmp case.0x180023079.14
lea rax, [rbp - 0x29]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x180023211
mov ecx, dword [0x18007b6d4]
mov dword [rax], ecx
jmp case.0x180023079.14
mov eax, 0x73
mov word [rbp - 0x13], ax
mov dword [rbp - 0x12], 0x252820
jmp case.0x180023079.14
movzx eax, word [0x18007b6d8]
mov word [rbp - 0xf], ax
movzx eax, byte [0x18007b6da]
mov byte [rbp - 0xd], al
jmp case.0x180023079.14
movsd xmm0, qword [str.RightCorner]
mov eax, dword [0x18007b6e8]
movsd qword [rbp + 0xf], xmm0
mov dword [rbp + 0x17], eax
mov dword [rbp - 0x61], 5
add edi, 0x12
lea eax, [rdi + 0x99]
cmp eax, 0x1a7
jb 0x180023050
xor edi, edi
jmp 0x180023329
cmp esi, 0x67b
je 0x180023317
cmp esi, 0x47ac
je 0x1800232e8
cmp esi, 0x6a6c
je 0x180023352
cmp esi, 0x8ed4
je 0x1800232d1
cmp esi, 0xd5fc
jne 0x180023340
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x38]
mov byte [r14 + 0x18], 3
jmp 0x180023355
mov eax, dword [rbp - 0x79]
mov dword [r14 + 0xc], eax
mov eax, dword [rbp - 0x75]
mov dword [r14 + 0x10], eax
mov eax, dword [rbp - 0x71]
mov dword [r14 + 0x14], eax
jmp 0x180023340
test r12, r12
je 0x1800233a7
xor r9d, r9d
mov r8, r14
mov edx, 0x100
xor ecx, ecx
call fcn.180037890
mov eax, dword [rbp - 0x79]
imul eax, dword [rbp - 0x75]
mov qword [r14], r12
imul eax, dword [rbp - 0x71]
mov dword [r14 + 8], eax
jmp 0x180023322
mov rcx, qword [r14]
mov edx, 2
call qword [rbp - 0x51]
lea r8, [0x180000000]
mov rdx, qword [rsp + 0x30]
mov r11d, 0x6c
lea r10d, [r11 - 0x3e]
lea r9d, [r11 - 0xd]
lea ecx, [r11 + 0xb]
imul eax, r15d, 0x8a
add esi, eax
cmp esi, r13d
jbe 0x180022f60
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180076c30
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, dword [rbp - 0x61]
lea rax, [rbp - 0x59]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, [rbp + 0xf]
mov qword [rbp - 0x59], rcx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
jmp 0x180023352
lea rcx, str.remove_OnModuleUnload
call fcn.180076310
mov dword [rsp + 0x38], edi
mov rax, qword [rsp + 0x38]
jmp 0x180023355