Function at 0x10004ab2
Capabilities:
Get session user name
Impersonate user

Disassembly:
push 0x2f4
mov eax, 0x100ee3ab
call fcn.100deb00
xor edi, edi
xor eax, eax
mov dword [ebp - 0x2a0], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.100ab9a0
add esp, 0xc
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x2b8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.10005438
xor ebx, ebx
inc ebx
push ebx
sub esp, 0x20
mov dword [ebp - 0x2b4], esp
mov ecx, esp
mov dword [ebp - 4], edi
push str.SYSTEM
mov dword [ebp - 0x2a0], ebx
call fcn.10005438
lea eax, [ebp - 0x238]
push eax
call fcn.10084560
add esp, 0x28
cmp eax, edi
je 0x10004beb
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x258]
call fcn.10005438
push ebx
sub esp, 0x20
mov dword [ebp - 0x2b4], esp
mov ecx, esp
mov dword [ebp - 4], ebx
push str.LOCAL_SERVICE
mov dword [ebp - 0x2a0], 3
call fcn.10005438
lea eax, [ebp - 0x258]
push eax
call fcn.10084560
add esp, 0x28
cmp eax, edi
je 0x10004beb
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x278]
call fcn.10005438
push ebx
sub esp, 0x20
mov dword [ebp - 0x2b4], esp
mov ecx, esp
mov dword [ebp - 4], 2
push str.NETWORK_SERVICE
mov dword [ebp - 0x2a0], 7
call fcn.10005438
lea eax, [ebp - 0x278]
push eax
call fcn.10084560
add esp, 0x28
mov byte [ebp - 0x299], 0
cmp eax, edi
jne 0x10004bf1
mov byte [ebp - 0x299], bl
mov dword [ebp - 4], ebx
test byte [ebp - 0x2a0], 4
je 0x10004c1c
and dword [ebp - 0x2a0], 0xfffffffb
push edi
push ebx
lea ecx, [ebp - 0x278]
call fcn.100031be
lea ecx, [ebp - 0x278]
call fcn.10002740
mov dword [ebp - 4], edi
test byte [ebp - 0x2a0], 2
je 0x10004c47
and dword [ebp - 0x2a0], 0xfffffffd
push edi
push ebx
lea ecx, [ebp - 0x258]
call fcn.100031be
lea ecx, [ebp - 0x258]
call fcn.10002740
or esi, 0xffffffff
mov dword [ebp - 4], esi
test byte [ebp - 0x2a0], bl
je 0x10004c6d
push edi
push ebx
lea ecx, [ebp - 0x238]
call fcn.100031be
lea ecx, [ebp - 0x238]
call fcn.10002740
cmp byte [ebp - 0x299], 0
je 0x10004ef2
lea eax, [ebp - 0x2c8]
push eax
call fcn.10004a29
pop ecx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 4], 3
call fcn.10004f30
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 4
call fcn.100023ff
jmp 0x10004cf8
lea ebx, [ebp - 0x2b0]
call fcn.100051ea
cmp dword [eax + 8], 0
je 0x10004db0
lea eax, [ebp - 0x300]
push eax
mov ecx, ebx
call fcn.1000500f
lea ecx, [ebp - 0x300]
call fcn.10002d87
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.100023ff
lea ecx, [ebp - 0x2b0]
push ecx
mov ebx, eax
mov byte [ebp - 4], 5
call fcn.100050db
mov bl, al
neg bl
lea ecx, [ebp - 0x2d4]
sbb bl, bl
mov byte [ebp - 4], 4
call fcn.10002d87
inc bl
jne 0x10004cb8
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10004e4e
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2a4], 0
push 3
lea eax, [ebp - 0x298]
push esi
push eax
call fcn.1008b390
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.10082ce0
push eax
push 0x1012b3fc
push dword [0x101466d8]
call fcn.100815d0
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 4
call fcn.100031be
lea ecx, [ebp - 0x298]
call fcn.10002740
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 3
call fcn.10002d87
mov dword [ebp - 4], esi
jmp 0x10004e3b
lea ebx, [ebp - 0x2b0]
call fcn.100051ea
lea ecx, [ebp - 0x2a4]
push ecx
push dword [eax]
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x10004d23
push 3
lea eax, [ebp - 0x238]
push esi
push eax
call fcn.1008b390
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 6
call fcn.100051ea
mov ecx, esi
mov edi, eax
call fcn.10082ce0
push eax
push dword [edi]
push 0x1012b3b8
push dword [0x101466d8]
call fcn.100815d0
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
call fcn.100031be
lea ecx, [ebp - 0x238]
call fcn.10002740
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.10002d87
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c8]
push eax
call fcn.10004efd
xor eax, eax
jmp 0x10004ef7
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x2f0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2f4], 0x20
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2f0], 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x10004e9d
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2a4], 0
jmp 0x10004d99
lea eax, [ebp - 0x2f4]
push eax
push dword [ebp - 0x2a4]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x10004eea
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x2a4], edi
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 3
call fcn.10002d87
lea eax, [ebp - 0x2c8]
push eax
mov dword [ebp - 4], esi
call fcn.10004efd
mov eax, edi
jmp 0x10004ef7
mov edi, dword [ebp - 0x2d8]
jmp 0x10004ec8
mov eax, 0x80000001
call fcn.100deb60
ret