Function at 0x404a90
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], str.Crypt32.dll
call sym._LoadLibraryA_4
sub esp, 4
test eax, eax
je 0x404c03
mov dword [esp + 4], str.CryptStringToBinaryA
mov dword [esp], eax
mov ebx, eax
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f378], eax
je 0x404c93
mov dword [esp + 4], str.CryptBinaryToStringA
mov dword [esp], ebx
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f374], eax
je 0x404ca4
mov dword [esp], str.User32.dll
call sym._LoadLibraryA_4
sub esp, 4
test eax, eax
je 0x404c14
mov dword [esp + 4], str.GetIconInfoExA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f370], eax
je 0x404c60
mov dword [esp], str.advapi32.dll
call sym._LoadLibraryA_4
sub esp, 4
test eax, eax
je 0x404c25
mov dword [esp + 4], str.RegDeleteKeyExA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f36c], eax
je 0x404cb5
mov dword [esp], str.Kernel32.dll
call sym._LoadLibraryA_4
sub esp, 4
test eax, eax
mov ebx, eax
je 0x404c36
mov dword [esp + 4], str.OpenFileById
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f368], eax
je 0x404cc6
mov dword [esp + 4], str.GetFinalPathNameByHandleA
mov dword [esp], ebx
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f364], eax
je 0x404c71
mov dword [esp + 4], str.GetProcessHandleCount
mov dword [esp], ebx
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
je 0x404c82
mov dword [esp], str.Wtsapi32.dll
call sym._LoadLibraryA_4
sub esp, 4
test eax, eax
je 0x404c44
mov dword [esp + 4], str.WTSQueryUserToken
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
test eax, eax
mov dword [0x44f360], eax
je 0x404c52
add esp, 0x18
pop ebx
ret
mov dword [esp], str.Unable_to_load_Crypt32.dll_r_n
call dbg.logEvent
jmp 0x404aed
mov dword [esp], str.Unable_to_load_User32.dll_r_n
call dbg.logEvent
jmp 0x404b24
mov dword [esp], str.Unable_to_load_advapi32.dll_r_n
call dbg.logEvent
jmp 0x404b5b
mov dword [esp], str.Unable_to_load_Kernel32.dll_r_n
call dbg.logEvent
jmp 0x404bcf
mov dword [esp], str.Unable_to_load_Wtsapi32.dll_r_n
call dbg.logEvent
jmp 0x404bfe
mov dword [esp], str.Unable_to_find_function_WTSQueryUserToken_in_Wtsapi32.dll__XP___r_n
call dbg.logEvent
jmp 0x404bfe
mov dword [esp], str.Unable_to_find_function_GetIconInfoExA_in_user32.dll_r_n
call dbg.logEvent
jmp 0x404b24
mov dword [esp], str.Unable_to_find_function_GetFinalPathNameByHandleA_in_Kernel32.dll__XP___r_n
call dbg.logEvent
jmp 0x404bb4
mov dword [esp], str.Unable_to_find_function_GetProcessHandleCount_in_Kernel32.dll_r_n
call dbg.logEvent
jmp 0x404bcf
mov dword [esp], str.Unable_to_find_function_CryptStringToBinaryA_in_Crypt32.dll_r_n
call dbg.logEvent
jmp 0x404acd
mov dword [esp], str.Unable_to_find_function_CryptBinaryToStringA_in_Crypt32.dll_r_n
call dbg.logEvent
jmp 0x404aed
mov dword [esp], str.Unable_to_find_function_RegDeleteKeyExA_in_advapi32.dll__32_bit_XP___r_n
call dbg.logEvent
jmp 0x404b5b
mov dword [esp], str.Unable_to_find_function_OpenFileById_in_Kernel32.dll__XP___r_n
call dbg.logEvent
jmp 0x404b94