Function at 0x435bf0
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
mov dword [esp + 4], 0
jne 0x435c0a
mov eax, 0xffffff9d
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x14]
push edi
xor eax, eax
test ebp, ebp
mov ecx, 0x38
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebx + 0x98], 0xffffffff
je 0x436729
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x436729
mov eax, dword [esp + 0x20]
test eax, eax
je 0x436729
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push str.advapi32.dll
call edi
test eax, eax
mov dword [ebx + 0x90], eax
jne 0x435c7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_load_AdvApi32.dll._Error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffffe
jmp 0x436707
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LogonUserA
push eax
call esi
test eax, eax
mov dword [ebx], eax
jne 0x435cad
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LogonUserA_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.ImpersonateLoggedOnUser
push eax
call esi
test eax, eax
mov dword [ebx + 0x24], eax
jne 0x435ce0
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_ImpersonateLoggedOnUser_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.CreateProcessAsUserA
push ecx
call esi
test eax, eax
mov dword [ebx + 0x28], eax
jne 0x435d13
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_CreateProcessAsUser_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.RevertToSelf
push edx
call esi
test eax, eax
mov dword [ebx + 0x2c], eax
jne 0x435d46
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_RevertToSelf_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.GetTokenInformation
push eax
call esi
test eax, eax
mov dword [ebx + 0x38], eax
jne 0x435d79
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetTokenInformation_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.GetLengthSid
push ecx
call esi
test eax, eax
mov dword [ebx + 0x3c], eax
jne 0x435dac
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetLengthSid_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.CopySid
push edx
call esi
test eax, eax
mov dword [ebx + 0x40], eax
jne 0x435ddf
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_CopySid_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.EqualSid
push eax
call esi
test eax, eax
mov dword [ebx + 0x44], eax
jne 0x435e12
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_EqualSid_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.IsValidSid
push ecx
call esi
test eax, eax
mov dword [ebx + 0x48], eax
jne 0x435e45
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_IsValidSid_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.InitializeSecurityDescriptor
push edx
call esi
test eax, eax
mov dword [ebx + 0x50], eax
jne 0x435e78
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_InitializeSecurityDescriptor_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.GetSecurityDescriptorDacl
push eax
call esi
test eax, eax
mov dword [ebx + 0x54], eax
jne 0x435eab
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetSecurityDescriptorDacl_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.GetAclInformation
push ecx
call esi
test eax, eax
mov dword [ebx + 0x5c], eax
jne 0x435ede
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetAclInformation_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.InitializeAcl
push edx
call esi
test eax, eax
mov dword [ebx + 0x60], eax
jne 0x435f11
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_InitializeAcl_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.GetAce
push eax
call esi
test eax, eax
mov dword [ebx + 0x64], eax
jne 0x435f44
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetAce_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.AddAce
push ecx
call esi
test eax, eax
mov dword [ebx + 0x68], eax
jne 0x435f77
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_AddAce_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.SetSecurityDescriptorDacl
push edx
call esi
test eax, eax
mov dword [ebx + 0x58], eax
jne 0x435faa
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_SetSecurityDescriptorDacl_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.AddAccessAllowedAce
push eax
call esi
test eax, eax
mov dword [ebx + 0x70], eax
jne 0x435fdd
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_AddAccessAllowedAce_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.LookupAccountNameA
push ecx
call esi
test eax, eax
mov dword [ebx + 0x74], eax
jne 0x436010
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LookupAccountName_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.LsaOpenPolicy
push edx
call esi
test eax, eax
mov dword [ebx + 0x78], eax
jne 0x436043
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LsaOpenPolicy_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.LsaEnumerateAccountRights
push eax
call esi
test eax, eax
mov dword [ebx + 0x7c], eax
jne 0x436076
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LsaEnumerateAccountRights_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x90]
push str.LsaAddAccountRights
push ecx
call esi
test eax, eax
mov dword [ebx + 0x80], eax
jne 0x4360ac
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LsaAddAccountRights_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x90]
push str.LsaFreeMemory
push edx
call esi
test eax, eax
mov dword [ebx + 0x84], eax
jne 0x4360e2
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LsaFreeMemory_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x90]
push str.LsaClose
push eax
call esi
test eax, eax
mov dword [ebx + 0x88], eax
jne 0x436118
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LsaClose_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
push str.userenv.dll
call edi
test eax, eax
mov dword [ebx + 0x94], eax
jne 0x436147
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_load_userEnv.dll._Error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffffe
jmp 0x436707
push str.LoadUserProfileA
push eax
call esi
test eax, eax
mov dword [ebx + 4], eax
jne 0x436174
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_LoadUserProfileA_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x94]
push str.UnloadUserProfile
push ecx
call esi
test eax, eax
mov dword [ebx + 8], eax
jne 0x4361a7
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_UnloadUserProfile_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x94]
push str.CreateEnvironmentBlock
push edx
call esi
test eax, eax
mov dword [ebx + 0xc], eax
jne 0x4361da
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_CreateEnvironmentBlock_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x94]
push str.DestroyEnvironmentBlock
push eax
call esi
test eax, eax
mov dword [ebx + 0x10], eax
jne 0x43620d
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_DestroyEnvironmentBlock_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
push str.user32.dll
call edi
test eax, eax
mov dword [ebx + 0x8c], eax
jne 0x43623c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_load_user32.dll._Error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffffe
jmp 0x436707
push str.GetProcessWindowStation
push eax
call esi
test eax, eax
mov dword [ebx + 0x14], eax
jne 0x436269
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetProcessWindowStation_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x8c]
push str.OpenWindowStationA
push ecx
call esi
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x43629c
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_OpenWindowStation_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x8c]
push str.SetProcessWindowStation
push edx
call esi
test eax, eax
mov dword [ebx + 0x1c], eax
jne 0x4362cf
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_SetProcessWindowStation_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x8c]
push str.OpenDesktopA
push eax
call esi
test eax, eax
mov dword [ebx + 0x20], eax
jne 0x436302
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_OpenDesktop_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x8c]
push str.CloseWindowStation
push ecx
call esi
test eax, eax
mov dword [ebx + 0x30], eax
jne 0x436335
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_CloseWindowStation_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edx, dword [ebx + 0x8c]
push str.CloseDesktop
push edx
call esi
test eax, eax
mov dword [ebx + 0x34], eax
jne 0x436368
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_CloseDesktop_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov eax, dword [ebx + 0x8c]
push str.GetUserObjectSecurity
push eax
call esi
test eax, eax
mov dword [ebx + 0x4c], eax
jne 0x43639b
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_GetUserObjectSecurity_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov ecx, dword [ebx + 0x8c]
push str.SetUserObjectSecurity
push ecx
call esi
test eax, eax
mov dword [ebx + 0x6c], eax
jne 0x4363ce
mov dword [esp + 0x10], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonateUser:_Failed_to_locate_the_SetUserObjectSecurity_function._This_function_may_not_be_supported_on_this_OS._Error___d.
call fcn.004349b0
jmp 0x436707
mov edi, dword [esp + 0x24]
push edi
push ebp
push ebx
call fcn.00435970
push 0x40
push ebp
mov esi, eax
call fcn.004590c0
add esp, 0x14
test eax, eax
je 0x436403
cmp byte [edi], 0
jne 0x436403
mov edx, dword [esp + 0x20]
lea eax, [ebx + 0x98]
push eax
push 0
push esi
push edx
push 0
jmp 0x43644c
push 0x40
push ebp
call fcn.004590c0
add esp, 8
test eax, eax
jne 0x43643c
push 0x5c
push ebp
call fcn.004590c0
add esp, 8
test eax, eax
jne 0x43643c
cmp byte [edi], 0
jne 0x43643c
lea eax, [ebx + 0x98]
push eax
mov eax, dword [esp + 0x24]
push 0
push esi
push eax
push 0x469b8c
jmp 0x43644c
mov ecx, dword [esp + 0x20]
lea eax, [ebx + 0x98]
push eax
push 0
push esi
push ecx
push edi
push ebp
call dword [ebx]
test eax, eax
jne 0x436497
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x52e
jne 0x43647b
push ebp
push str.impersonateUser:_Logon_failure:_unknown_user_name___s__or_bad_password.
call fcn.004349b0
add esp, 8
mov dword [esp + 0x10], 0xffffffff
jmp 0x43670a
push eax
push ebp
push str.impersonateUser:_LogonUser__s__failed_with_error___d.
call fcn.004349b0
add esp, 0xc
mov dword [esp + 0x10], 0xffffffff
jmp 0x43670a
mov edx, dword [ebx + 0x98]
lea esi, [ebx + 0xb0]
push esi
push edx
mov dword [esi], 0x20
mov dword [ebx + 0xb8], ebp
mov dword [ebx + 0xb4], 1
call dword [ebx + 4]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x4364d0
mov dword [ebx + 0xd0], esi
jmp 0x4364e1
call edi
push eax
push ebp
push str.impersonateUser:_Failed_to_load_profile_for__s._Error___d._Proceeding_with_command.
call fcn.004349b0
add esp, 0xc
mov eax, dword [ebx + 0x98]
push 0
push eax
lea ecx, [ebx + 0xac]
push ecx
call dword [ebx + 0xc]
test eax, eax
jne 0x436509
call edi
push eax
push ebp
push str.impersonateUser:_Failed_to_load_environment_block_for__s._Error___d._Proceeding_with_command.
call fcn.004349b0
add esp, 0xc
call dword [ebx + 0x14]
test eax, eax
mov dword [ebx + 0xa4], eax
jne 0x436530
call edi
push eax
push str.impersonateUser:_GetProcessWindowStation___failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffffc
jmp 0x436707
push 0x60000
push 0
push str.winsta0
call dword [ebx + 0x18]
test eax, eax
mov dword [ebx + 0xa0], eax
jne 0x436563
call edi
push eax
push str.impersonateUser:_OpenWindowStation_winsta0__failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffffb
jmp 0x436707
push eax
call dword [ebx + 0x1c]
test eax, eax
jne 0x436585
call edi
push eax
push str.impersonateUser:_SetProcessWindowStation_hwinsta__failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffffa
jmp 0x436707
push 0x60081
push 0
push 0
push str.default
call dword [ebx + 0x20]
mov edx, dword [ebx + 0xa4]
push edx
mov dword [ebx + 0x9c], eax
call dword [ebx + 0x1c]
test eax, eax
jne 0x4365c4
call edi
push eax
push str.impersonateUser:_SetProcessWindowStation_hwinstaSave__failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffff9
jmp 0x436707
mov eax, dword [ebx + 0x9c]
test eax, eax
jne 0x4365e8
call edi
push eax
push str.impersonateUser:_OpenDesktop___failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffff8
jmp 0x436707
mov eax, dword [ebx + 0x98]
lea esi, [ebx + 0xa8]
push esi
call fcn.00434a90
add esp, 4
test eax, eax
jne 0x43661b
call edi
push eax
push str.impersonateUser:_GetLogonSID___failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffff7
jmp 0x436707
mov eax, dword [esi]
mov ecx, dword [ebx + 0xa0]
push eax
push ecx
mov ecx, ebx
call fcn.004351b0
add esp, 8
test eax, eax
jne 0x436681
call edi
cmp eax, 0x718
jne 0x436669
mov edx, dword [ebx + 0xa0]
push str.window_station
push edx
mov ecx, ebx
call fcn.00434c80
mov eax, dword [esi]
mov ecx, dword [ebx + 0xa0]
push eax
push ecx
mov ecx, ebx
call fcn.004351b0
add esp, 0x10
test eax, eax
jne 0x436681
call edi
push eax
push str.impersonateUser:_AddAceToWindowStation___failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffff6
jmp 0x436707
mov edx, dword [esi]
mov eax, dword [ebx + 0x9c]
push edx
push eax
mov ecx, ebx
call fcn.004354e0
add esp, 8
test eax, eax
jne 0x4366e4
call edi
cmp eax, 0x718
jne 0x4366cd
mov ecx, dword [ebx + 0x9c]
push str.desktop
push ecx
mov ecx, ebx
call fcn.00434c80
mov edx, dword [esi]
mov eax, dword [ebx + 0x9c]
push edx
push eax
mov ecx, ebx
call fcn.004354e0
add esp, 0x10
test eax, eax
jne 0x4366e4
call edi
push eax
push str.impersonateUser:_AddAceToDesktop___failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffff5
jmp 0x436707
mov ecx, dword [ebx + 0x98]
push ecx
call dword [ebx + 0x24]
test eax, eax
jne 0x43670a
call edi
push eax
push str.impersonateUser:_ImpersonateLoggedOnUser___failed_with_error___d.
call fcn.004349b0
mov dword [esp + 0x18], 0xfffffff4
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
mov dword [ebx + 0xd4], esi
je 0x436721
push ebx
call fcn.00435790
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop ebp
mov eax, 0xffffff9e
pop ebx
pop ecx
ret