Function at 0x423a3d
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, ecx
push edi
xor ebx, ebx
push str.psapi.dll
mov byte [esi], bl
mov byte [esi + 0x105], bl
mov dword [esi + 0x214], ebx
mov dword [esi + 0x218], ebx
mov byte [esi + 0x21c], bl
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x210], ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x20c], eax
jne 0x423afe
cmp dword [0x441ff4], ebx
je 0x423e26
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x423ab1
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x423e26
cmp eax, 3
jle 0x423e26
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x43e578], ebx
mov ebp, eax
jge 0x423ad3
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x423e18
push 3
push dword [0x43e578]
push 0x15
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push str.L3_Impersonation:_psapi.dll_was_not_found._no_impersonation._n
jmp 0x423e0b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push eax
call edi
push str.EnumProcessModules
mov dword [esi + 0x220], eax
push dword [esi + 0x20c]
call edi
push str.GetModuleBaseNameA
mov dword [esi + 0x224], eax
push dword [esi + 0x20c]
call edi
cmp dword [esi + 0x220], ebx
mov dword [esi + 0x228], eax
je 0x423da4
cmp dword [esi + 0x224], ebx
je 0x423da4
cmp eax, ebx
je 0x423da4
push str.userenv.dll
call ebp
cmp eax, ebx
mov dword [esi + 0x210], eax
jne 0x423be5
cmp dword [0x441ff4], ebx
je 0x423e26
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 2
je 0x423b98
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x423e26
cmp eax, 2
jle 0x423e26
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x43e578], ebx
mov ebp, eax
jge 0x423bba
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x423e18
push 2
push dword [0x43e578]
push 0x28
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push str.L3_Impersonation:_userenv.dll_was_not_found._no_impersonation._n
jmp 0x423e0b
push str.LoadUserProfileA
push eax
call edi
push str.UnloadUserProfile
mov dword [esi + 0x22c], eax
push dword [esi + 0x210]
call edi
push str.ExpandEnvironmentStringsForUserA
mov dword [esi + 0x230], eax
push dword [esi + 0x210]
call edi
push str.CreateEnvironmentBlock
mov dword [esi + 0x234], eax
push dword [esi + 0x210]
call edi
push str.DestroyEnvironmentBlock
mov dword [esi + 0x238], eax
push dword [esi + 0x210]
call edi
push str.CreateProcessAsUserA
push str.Advapi32.dll
mov dword [esi + 0x23c], eax
call ebp
push eax
call edi
cmp dword [esi + 0x22c], ebx
mov dword [esi + 0x240], eax
je 0x423d2b
cmp dword [esi + 0x230], ebx
je 0x423d2b
cmp dword [esi + 0x234], ebx
je 0x423d2b
cmp dword [esi + 0x238], ebx
je 0x423d2b
cmp dword [esi + 0x23c], ebx
je 0x423d2b
cmp eax, ebx
je 0x423d2b
cmp dword [0x441ff4], ebx
je 0x423e2d
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x423cc7
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x423e2d
cmp eax, 3
jle 0x423e2d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x43e578], ebx
mov ebp, eax
jge 0x423ce9
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x423d18
push 3
push dword [0x43e578]
push 0x3b
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push str.L3_Impersonation._n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x423e2d
cmp dword [0x441ff4], ebx
je 0x423e26
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x423d5a
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x423e26
cmp eax, 3
jle 0x423e26
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x43e578], ebx
mov ebp, eax
jge 0x423d7c
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x423e18
push 3
push dword [0x43e578]
push 0x37
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push str.L3_Impersonation:_proc_functions_are_not_available_in_userenv.dll_n
jmp 0x423e0b
cmp dword [0x441ff4], ebx
je 0x423e26
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 2
je 0x423dc7
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x423e26
cmp eax, 2
jle 0x423e26
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x43e578], ebx
mov ebp, eax
jge 0x423de9
mov eax, dword [0x441fa0]
mov dword [0x43e578], eax
call fcn.0041c4b1
test eax, eax
je 0x423e18
push 2
push dword [0x43e578]
push 0x20
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutilityimperson.cpp
call fcn.0041c4e1
push str.L3_Impersonation:_proc_functions_are_not_available_in_psapi.dll_n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 0x21c], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret