Generated by JEB on 2019/08/01

PE: C:\Windows\System32\runas.exe Base=0x140000000 SHA-256=018394B4655446EC0895601AC25879C80428C72FAB4361792ED69C5FA6C97C34
PDB: runas.pdb GUID={8A2280C0-F455-0DF7-8D07D25AD0722528} Age=1

189 located named symbols:
0x140001E14: "void __cdecl RunasPrintHelp(void)" ?RunasPrintHelp@@YAXXZ
0x1400065D0: "struct HINSTANCE__ * __ptr64 __ptr64 hMod" ?hMod@@3PEAUHINSTANCE__@@EA
0x140002DA4: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400043D8: "__cdecl _imp_NetApiBufferAllocate" __imp_NetApiBufferAllocate
0x140003090: "__cdecl FindPESection" _FindPESection
0x140004280: "__cdecl _imp_GetCurrentDirectoryW" __imp_GetCurrentDirectoryW
0x1400013E0: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x140004AF8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140004378: "__cdecl _imp___getmainargs" __imp___getmainargs
0x140006010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1400042B8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140004140: "__cdecl _imp_SaferCreateLevel" __imp_SaferCreateLevel
0x140001EDC: WinMain
0x1400033C0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1400042E8: SHELL32_NULL_THUNK_DATA
0x1400041C0: "__cdecl _imp_CertFreeCertificateContext" __imp_CertFreeCertificateContext
0x140004398: "__cdecl _imp_wcstoul" __imp_wcstoul
0x1400042E0: "__cdecl _imp_CommandLineToArgvW" __imp_CommandLineToArgvW
0x1400065C0: "__cdecl commode" _commode
0x140004490: "0x%lX (" ??_C@_1BA@JEMKHOLI@?$AA0?$AAx?$AA?$CF?$AAl?$AAX?$AA?5?$AA?$CI?$AA?$AA@
0x140004390: "__cdecl _imp_wcschr" __imp_wcschr
0x140004120: "__cdecl _imp_CredFree" __imp_CredFree
0x140004230: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x140002F60: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140004418: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1400065CC: "__cdecl fmode" _fmode
0x140004248: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x140002FBE: "__cdecl XcptFilter" _XcptFilter
0x140004420: "__cdecl _xc_a" __xc_a
0x140004218: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x1400042C0: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x140003396: memcpy
0x140004320: credui_NULL_THUNK_DATA
0x140004338: "__cdecl _imp__acmdln" __imp__acmdln
0x140001AC4: "int __cdecl CreateProcessRestricted(unsigned long,unsigned short const * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,struct _STARTUPINFOW * __ptr64,struct _PROCESS_INFORMATION * __ptr64)" ?CreateProcessRestricted@@YAHKPEBGPEAG1PEAU_STARTUPINFOW@@PEAU_PROCESS_INFORMATION@@@Z
0x1400043C8: "__cdecl _imp_memset" __imp_memset
0x14000324F: "__cdecl initterm" _initterm
0x14000168C: "unsigned long __cdecl GetCredentials(unsigned long,unsigned short * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long)" ?GetCredentials@@YAKKPEAGK0K0K0K@Z
0x140006600: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140004220: "__cdecl _imp_Sleep" __imp_Sleep
0x140004450: "__cdecl _xi_z" __xi_z
0x140004210: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140004268: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x140002D62: "__cdecl _C_specific_handler" __C_specific_handler
0x1400042A8: "__cdecl _imp_lstrlenW" __imp_lstrlenW
0x140004290: "__cdecl _imp_HeapFree" __imp_HeapFree
0x140004150: "__cdecl _imp_CredGetSessionTypes" __imp_CredGetSessionTypes
0x1400065D8: "void * __ptr64 __ptr64 g_hStdout" ?g_hStdout@@3PEAXEA
0x1400044B0: "int (*)[9] rgArgCompat" ?rgArgCompat@@3PAY08HA
0x14000329C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140004168: "__cdecl _imp_CreateProcessWithLogonW" __imp_CreateProcessWithLogonW
0x140003073: "__cdecl amsg_exit" _amsg_exit
0x140004368: "__cdecl _imp_exit" __imp_exit
0x1400041A8: "__cdecl _imp_CertOpenSystemStoreW" __imp_CertOpenSystemStoreW
0x140004298: "__cdecl _imp_lstrcmpiW" __imp_lstrcmpiW
0x140004200: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1400065F0: "__cdecl _native_startup_lock" __native_startup_lock
0x1400042F0: "__cdecl _imp_GetUserNameExW" __imp_GetUserNameExW
0x140002FA0: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140003300: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1400043B0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140001500: "long __cdecl LocalizedWPrintf(unsigned int)" ?LocalizedWPrintf@@YAJI@Z
0x1400043F8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400041A0: "__cdecl _imp_CertCloseStore" __imp_CertCloseStore
0x1400042D8: KERNEL32_NULL_THUNK_DATA
0x140004240: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1400041B8: "__cdecl _imp_CertGetNameStringW" __imp_CertGetNameStringW
0x140003278: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140004328: "__cdecl _imp__commode" __imp__commode
0x140004350: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x140004ABC: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x1400041B0: "__cdecl _imp_CertFindCertificateInStore" __imp_CertFindCertificateInStore
0x140004278: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140003140: "__cdecl ValidateImageBase" _ValidateImageBase
0x140004178: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x140001008: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x1400018E8: "unsigned long __cdecl SaveCredentials(unsigned short * __ptr64,unsigned long,unsigned short * __ptr64,unsigned short * __ptr64)" ?SaveCredentials@@YAKPEAGK00@Z
0x140004148: "__cdecl _imp_CredMarshalCredentialW" __imp_CredMarshalCredentialW
0x140004480: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1400041E8: "__cdecl _imp_GetEnvironmentStringsW" __imp_GetEnvironmentStringsW
0x140004228: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x1400065C8: "__cdecl newmode" _newmode
0x1400043B8: "__cdecl _imp__initterm" __imp__initterm
0x140004128: "__cdecl _imp_SaferComputeTokenFromLevel" __imp_SaferComputeTokenFromLevel
0x140004370: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140004B0C: "__cdecl _IMPORT_DESCRIPTOR_credui" __IMPORT_DESCRIPTOR_credui
0x140003080: "__cdecl setargv" _setargv
0x140004288: "__cdecl _imp_SetLastError" __imp_SetLastError
0x1400042A0: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x1400041E0: "__cdecl _imp_SetThreadPreferredUILanguages" __imp_SetThreadPreferredUILanguages
0x1400041C8: CRYPT32_NULL_THUNK_DATA
0x1400065E0: "__cdecl _onexitend" __onexitend
0x140004360: "__cdecl _imp__exit" __imp__exit
0x140004410: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140001480: "long __cdecl StringCbPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCbPrintfW@@YAJPEAG_KPEBGZZ
0x1400041F8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140004308: USER32_NULL_THUNK_DATA
0x1400043E8: netutils_NULL_THUNK_DATA
0x1400043A8: "__cdecl _imp__resetstkoflw" __imp__resetstkoflw
0x140004438: "__cdecl _xi_a" __xi_a
0x1400042C8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x140003080: "__cdecl matherr" _matherr
0x1400043E0: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x140004310: "__cdecl _imp_SspiIsPromptingNeeded" __imp_SspiIsPromptingNeeded
0x1400042B0: "__cdecl _imp_WriteConsoleW" __imp_WriteConsoleW
0x1400028AC: NetpGetDomainNameExExEx
0x1400042F8: SspiCli_NULL_THUNK_DATA
0x140004190: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x140002D80: "__cdecl _security_check_cookie" __security_check_cookie
0x140004430: "__cdecl _xc_z" __xc_z
0x140004138: "__cdecl _imp_CreateProcessAsUserW" __imp_CreateProcessAsUserW
0x140004348: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140004B5C: "__cdecl _IMPORT_DESCRIPTOR_netutils" __IMPORT_DESCRIPTOR_netutils
0x1400042D0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140004258: "__cdecl _imp_GetStdHandle" __imp_GetStdHandle
0x1400041D8: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1400033E0: "__cdecl _chkstk" __chkstk
0x140004484: "MY" ??_C@_15ELPOAHMG@?$AAM?$AAY?$AA?$AA@
0x140004250: "__cdecl _imp_GetExitCodeThread" __imp_GetExitCodeThread
0x140001638: "int __cdecl WriteMsg(unsigned long,unsigned long,unsigned short * __ptr64 * __ptr64,...)" ?WriteMsg@@YAHKKPEAPEAGZZ
0x140001090: "int __cdecl CreduiGetCertificateDisplayName(struct _CERT_CONTEXT const * __ptr64,unsigned short * __ptr64,unsigned long,unsigned short * __ptr64)" ?CreduiGetCertificateDisplayName@@YAHPEBU_CERT_CONTEXT@@PEAGK1@Z
0x140004188: "__cdecl _imp_LsaClose" __imp_LsaClose
0x140004458: "__cdecl _guard_fids_table" __guard_fids_table
0x1400043D0: msvcrt_NULL_THUNK_DATA
0x140004010: "__cdecl load_config_used" _load_config_used
0x1400044A0: ") " ??_C@_15BCDOKMG@?$AA?$CJ?$AA?6?$AA?$AA@
0x140004118: "__cdecl _imp_CredUnmarshalCredentialW" __imp_CredUnmarshalCredentialW
0x140004B48: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x140004B20: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140004380: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x140004300: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x140004400: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140004270: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1400065C4: "__cdecl dowildcard" _dowildcard
0x1400043F0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140004318: "__cdecl _imp_CredUICmdLinePromptForCredentialsW" __imp_CredUICmdLinePromptForCredentialsW
0x140003260: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140002FCC: RtlpImageNtHeader
0x140004260: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140004180: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x140004388: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140004408: ntdll_NULL_THUNK_DATA
0x140004340: "__cdecl _imp_memcpy" __imp_memcpy
0x140004B70: "__cdecl _IMPORT_DESCRIPTOR_SspiCli" __IMPORT_DESCRIPTOR_SspiCli
0x1400043C0: "__cdecl _imp__ismbblead" __imp__ismbblead
0x1400012DC: "unsigned short * __ptr64 __cdecl GetAccountDomainName(void)" ?GetAccountDomainName@@YAPEAGXZ
0x140006008: "__cdecl _security_cookie" __security_cookie
0x1400033E0: "__cdecl alloca_probe" _alloca_probe
0x1400041F0: "__cdecl _imp_GetExitCodeProcess" __imp_GetExitCodeProcess
0x140004170: "__cdecl _imp_CredWriteW" __imp_CredWriteW
0x140004238: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1400041D0: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140006000: "__cdecl _defaultmatherr" __defaultmatherr
0x1400065E8: "__cdecl _onexitbegin" __onexitbegin
0x140004158: "__cdecl _imp_SaferGetPolicyInformation" __imp_SaferGetPolicyInformation
0x1400043A0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x140004208: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140002B00: WinMainCRTStartup
0x140004AD0: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140003174: "__cdecl _security_init_cookie" __security_init_cookie
0x140004160: "__cdecl _imp_SaferCloseLevel" __imp_SaferCloseLevel
0x140004358: "__cdecl _imp__cexit" __imp__cexit
0x1400011FC: "int __cdecl CreduiGetCertDisplayNameFromMarshaledName(unsigned short * __ptr64,unsigned short * __ptr64,unsigned long,int)" ?CreduiGetCertDisplayNameFromMarshaledName@@YAHPEAG0KH@Z
0x140003028: "__cdecl get_image_app_type" _get_image_app_type
0x140004AE4: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140004198: ADVAPI32_NULL_THUNK_DATA
0x140002DE0: "__cdecl _report_gsfailure" __report_gsfailure
0x1400065F8: "__cdecl _native_startup_state" __native_startup_state
0x140004130: "__cdecl _imp_SaferGetLevelInformation" __imp_SaferGetLevelInformation
0x140001BC8: "unsigned long __cdecl ShowTrustLevels(void)" ?ShowTrustLevels@@YAKXZ
0x140004B34: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x140004330: "__cdecl _imp__fmode" __imp__fmode
0x1400030E0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1400015A8: "void __cdecl DisplayMsg(unsigned long,unsigned long,...)" ?DisplayMsg@@YAXKKZZ
0x1400033A2: memset
0x140004B84: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]