Function at 0x103f5d9
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c0
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x6b4], 0
and dword [ebp - 0x6b0], 0
push ebx
push esi
push edi
mov dword [ebp - 0x6c0], eax
mov eax, dword [0x1075004]
mov ebx, 0x1075004
cmp eax, ebx
je 0x103f634
test byte [eax + 0x1c], 4
je 0x103f634
cmp byte [eax + 0x19], 5
jb 0x103f634
push 0x1002dc0
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push 0x2c
pop edi
push edi
call fcn.0105c184
mov esi, eax
test esi, esi
jne 0x103f672
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f66a
test byte [eax + 0x1c], 4
je 0x103f66a
cmp byte [eax + 0x19], 2
jb 0x103f66a
push 0x1002dc0
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push 8
pop eax
jmp 0x103fa43
push edi
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1078040
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi], edi
mov eax, dword [0x107809c]
mov dword [esi + 0x24], eax
mov eax, dword [0x107808c]
mov dword [esi + 0x14], eax
mov eax, dword [0x107807c]
mov dword [esi + 4], eax
mov eax, dword [0x1078080]
xor edi, edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov eax, dword [0x1078088]
cmp eax, edi
je 0x103f6fd
push eax
call fcn.0105c8ee
mov dword [esi + 0x10], eax
cmp eax, edi
jne 0x103f6fd
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push 0x1002dc0
push 0x30
jmp 0x103f84c
mov eax, dword [0x1078090]
cmp eax, edi
je 0x103f74a
push eax
call fcn.0105c8ee
mov dword [esi + 0x18], eax
cmp eax, edi
jne 0x103f74a
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push 0x1002dc0
push 0x31
jmp 0x103f84c
mov eax, dword [0x1078094]
cmp eax, edi
je 0x103f797
push eax
call fcn.0105c8ee
mov dword [esi + 0x1c], eax
cmp eax, edi
jne 0x103f797
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push 0x1002dc0
push 0x32
jmp 0x103f84c
push 0x2001f
push edi
push 0x1001bb0
push 0x80000002
call fcn.0105fce9
mov dword [ebp - 0x6b4], eax
cmp eax, edi
jne 0x103f800
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6b0], eax
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
jmp 0x103f9e1
push edi
push 1
push 0x1001768
push 0x1001b9c
push eax
call fcn.01069504
mov dword [esi + 0x20], eax
cmp eax, edi
jne 0x103f85c
mov dword [ebp - 0x6b0], 8
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push 0x1002dc0
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
jmp 0x103f9e1
cmp dword [ebp + 0xc], edi
je 0x103f9d9
cmp dword [0x1078080], 2
jne 0x103f9d9
mov eax, dword [0x10780a0]
cmp eax, edi
jne 0x103f981
xor eax, eax
push 0x400
mov word [ebp - 0x6ac], ax
lea eax, [ebp - 0x6aa]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x2a0
mov word [ebp - 0x2a8], ax
lea eax, [ebp - 0x2a6]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x151
lea eax, [ebp - 0x2a8]
push eax
push 0x201
lea eax, [ebp - 0x6ac]
push eax
push dword [0x1078094]
call dword [sym.imp.credui.dll_CredUIParseUserNameW]
mov dword [ebp - 0x6b0], eax
cmp eax, edi
je 0x103f919
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x35
jmp 0x103f9c3
lea eax, [ebp - 0x6bc]
push eax
push edi
push 2
push dword [esi + 0x20]
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x6ac]
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x103f976
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6b0], eax
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x36
jmp 0x103f9c3
mov eax, dword [ebp - 0x6bc]
mov dword [0x10780a0], eax
lea ecx, [ebp - 0x6b8]
push ecx
push 3
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x103f9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6b0], eax
mov eax, dword [0x1075004]
cmp eax, ebx
je 0x103f9e1
test byte [eax + 0x1c], 4
je 0x103f9e1
cmp byte [eax + 0x19], 2
jb 0x103f9e1
push dword [ebp - 0x6b0]
push 0x1002dc0
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
jmp 0x103f9e1
mov eax, dword [ebp - 0x6b8]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x6c0]
mov dword [eax], esi
push 0x1078040
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x6b4], edi
je 0x103fa2d
push dword [ebp - 0x6b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x103fa2d
mov ecx, dword [0x1075004]
cmp ecx, ebx
je 0x103fa2d
test byte [ecx + 0x1c], 4
je 0x103fa2d
cmp byte [ecx + 0x19], 2
jb 0x103fa2d
push eax
push 0x1002dc0
push 0x38
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101463a
cmp dword [ebp - 0x6b0], edi
je 0x103fa3d
push 1
push esi
call fcn.0103f048
mov eax, dword [ebp - 0x6b0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret 8