Function at 0x4b0bb0
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi + 0x20], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov byte [esi + 0xac], 1
jne 0x4b0bea
push str.KERNEL32.DLL
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x4b0bea
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_KERNEL32.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b0cb0
cmp dword [esi + 0xb0], 0
jne 0x4b0c26
push str.WTSGetActiveConsoleSessionId
push eax
call edi
mov dword [esi + 0xb0], eax
test eax, eax
jne 0x4b0c26
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_WTSGetActiveConsoleSessionId__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xc0], 0
jne 0x4b0c54
mov eax, dword [esi + 0x20]
push str.ProcessIdToSessionId
push eax
call edi
mov dword [esi + 0xc0], eax
test eax, eax
jne 0x4b0c54
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_ProcessIdToSessionId__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xc4], 0
jne 0x4b0c82
mov ecx, dword [esi + 0x20]
push str.GetProcessId
push ecx
call edi
mov dword [esi + 0xc4], eax
test eax, eax
jne 0x4b0c82
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_GetProcessId__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xc8], 0
jne 0x4b0cb0
mov edx, dword [esi + 0x20]
push str.GetExitCodeProcess
push edx
call edi
mov dword [esi + 0xc8], eax
test eax, eax
jne 0x4b0cb0
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_GetExitCodeProcess__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0x38], 0
jne 0x4b0cd4
push str.USERENV.DLL
call ebx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4b0cd4
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_USERENV.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4b0d34
cmp dword [esi + 0xcc], 0
jne 0x4b0d06
push str.CreateEnvironmentBlock
push eax
call edi
mov dword [esi + 0xcc], eax
test eax, eax
jne 0x4b0d06
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_CreateEnvironmentBlock__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xd0], 0
jne 0x4b0d34
mov eax, dword [esi + 0x38]
push str.DestroyEnvironmentBlock
push eax
call edi
mov dword [esi + 0xd0], eax
test eax, eax
jne 0x4b0d34
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_DestroyEnvironmentBlock__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0x3c], 0
jne 0x4b0d58
push str.NTDLL.DLL
call ebx
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x4b0d58
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_NTDLL.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4b0d8a
cmp dword [esi + 0xd4], 0
jne 0x4b0d8a
push str.ZwQueryInformationProcess
push eax
call edi
mov dword [esi + 0xd4], eax
test eax, eax
jne 0x4b0d8a
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_ZwQueryInformationProcess__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0x40], 0
jne 0x4b0dae
push str.WININET.DLL
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x4b0dae
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_WININET.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4b0de0
cmp dword [esi + 0xd8], 0
jne 0x4b0de0
push str.DeleteUrlCacheEntryW
push eax
call edi
mov dword [esi + 0xd8], eax
test eax, eax
jne 0x4b0de0
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_DeleteUrlCacheEntry__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0x2c], 0
jne 0x4b0e04
push str.ADVAPI32.DLL
call ebx
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x4b0e04
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_ADVAPI32.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4b0e36
cmp dword [esi + 0xdc], 0
jne 0x4b0e36
push str.CreateProcessWithLogonW
push eax
call edi
mov dword [esi + 0xdc], eax
test eax, eax
jne 0x4b0e36
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_CreateProcessWithLogonW__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0x58], 0
jne 0x4b0e5a
push str.NETAPI32.DLL
call ebx
mov dword [esi + 0x58], eax
test eax, eax
jne 0x4b0e5a
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_NETAPI32.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x58]
test eax, eax
je 0x4b0eba
cmp dword [esi + 0xe0], 0
jne 0x4b0e8c
push str.NetWkstaGetInfo
push eax
call edi
mov dword [esi + 0xe0], eax
test eax, eax
jne 0x4b0e8c
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_NetWkstaGetInfo__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xe4], 0
jne 0x4b0eba
mov ecx, dword [esi + 0x58]
push str.NetApiBufferFree
push ecx
call edi
mov dword [esi + 0xe4], eax
test eax, eax
jne 0x4b0eba
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_NetApiBufferFree__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0x5c], 0
jne 0x4b0ede
push str.WTSAPI32.DLL
call ebx
mov dword [esi + 0x5c], eax
test eax, eax
jne 0x4b0ede
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_WTSAPI32.DLL
call fcn.004a7cf0
add esp, 8
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x4b0f70
cmp dword [esi + 0xb4], 0
jne 0x4b0f14
push str.WTSEnumerateSessionsW
push eax
call edi
mov dword [esi + 0xb4], eax
test eax, eax
jne 0x4b0f14
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_WTSEnumerateSessions__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xb8], 0
jne 0x4b0f42
mov edx, dword [esi + 0x5c]
push str.WTSFreeMemory
push edx
call edi
mov dword [esi + 0xb8], eax
test eax, eax
jne 0x4b0f42
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_WTSFreeMemory__
call fcn.004a7cf0
add esp, 8
cmp dword [esi + 0xbc], 0
jne 0x4b0f70
mov eax, dword [esi + 0x5c]
push str.WTSQueryUserToken
push eax
call edi
mov dword [esi + 0xbc], eax
test eax, eax
jne 0x4b0f70
call ebp
push eax
push str.CLibEx::LoadLibrary_LaunchApp___:_WTSQueryUserToken__
call fcn.004a7cf0
add esp, 8
pop edi
pop ebp
pop ebx
ret