Function at 0x45dcbf
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x57b33f
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push esi
push edi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.kernel32.dll
call fcn.00415a69
and dword [esp + 0x11c], 0
or ebx, 0xffffffff
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 1
cmp dword [eax + 0x18], 8
jb 0x45dd38
mov eax, dword [eax + 4]
jmp 0x45dd3b
add eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call edi
mov dword [0x68bc94], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.user32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 2
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 3
cmp dword [eax + 0x18], 8
jb 0x45dda4
mov eax, dword [eax + 4]
jmp 0x45dda7
add eax, 4
push eax
call edi
mov dword [0x68bc98], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.wtsapi32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 4
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 5
cmp dword [eax + 0x18], 8
jb 0x45de0a
mov eax, dword [eax + 4]
jmp 0x45de0d
add eax, 4
push eax
call edi
mov dword [0x68bc9c], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.msimg32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 6
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 7
cmp dword [eax + 0x18], 8
jb 0x45de70
mov eax, dword [eax + 4]
jmp 0x45de73
add eax, 4
push eax
call edi
mov dword [0x68bca0], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
call fcn.00463055
cmp eax, 0xa
jl 0x45deff
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.dwmapi.dll
call fcn.00415a69
mov dword [esp + 0x11c], 8
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 9
cmp dword [eax + 0x18], 8
jb 0x45dee0
mov eax, dword [eax + 4]
jmp 0x45dee3
add eax, 4
push eax
call edi
mov dword [0x68bca4], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.advapi32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0xa
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0xb
cmp dword [eax + 0x18], 8
jb 0x45df46
mov eax, dword [eax + 4]
jmp 0x45df49
add eax, 4
push eax
call edi
mov dword [0x68bca8], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.userenv.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0xc
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0xd
cmp dword [eax + 0x18], 8
jb 0x45dfac
mov eax, dword [eax + 4]
jmp 0x45dfaf
add eax, 4
push eax
call edi
mov dword [0x68bcac], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Secur32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0xe
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0xf
cmp dword [eax + 0x18], 8
jb 0x45e012
mov eax, dword [eax + 4]
jmp 0x45e015
add eax, 4
push eax
call edi
mov dword [0x68bcb0], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Netapi32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x10
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x11
cmp dword [eax + 0x18], 8
jb 0x45e078
mov eax, dword [eax + 4]
jmp 0x45e07b
add eax, 4
push eax
call edi
mov dword [0x68bcb4], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Wintrust.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x12
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x13
cmp dword [eax + 0x18], 8
jb 0x45e0de
mov eax, dword [eax + 4]
jmp 0x45e0e1
add eax, 4
push eax
call edi
mov dword [0x68bcb8], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Psapi.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x14
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x15
cmp dword [eax + 0x18], 8
jb 0x45e144
mov eax, dword [eax + 4]
jmp 0x45e147
add eax, 4
push eax
call edi
mov dword [0x68bcbc], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Iphlpapi.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x16
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x17
cmp dword [eax + 0x18], 8
jb 0x45e1aa
mov eax, dword [eax + 4]
jmp 0x45e1ad
add eax, 4
push eax
call edi
mov dword [0x68bcc0], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.winsta.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x18
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x19
cmp dword [eax + 0x18], 8
jb 0x45e210
mov eax, dword [eax + 4]
jmp 0x45e213
add eax, 4
push eax
call edi
mov dword [0x68bcc4], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.uxtheme.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x1a
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x1b
cmp dword [eax + 0x18], 8
jb 0x45e276
mov eax, dword [eax + 4]
jmp 0x45e279
add eax, 4
push eax
call edi
mov dword [0x68bcc8], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Shell32.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x1c
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x1d
cmp dword [eax + 0x18], 8
jb 0x45e2dc
mov eax, dword [eax + 4]
jmp 0x45e2df
add eax, 4
push eax
call edi
mov dword [0x68bccc], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SHFolder.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x1e
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x1f
cmp dword [eax + 0x18], 8
jb 0x45e342
mov eax, dword [eax + 4]
jmp 0x45e345
add eax, 4
push eax
call edi
mov dword [0x68bcd0], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x62382c
call fcn.00415a69
mov dword [esp + 0x11c], 0x20
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x21
cmp dword [eax + 0x18], 8
jb 0x45e3a8
mov eax, dword [eax + 4]
jmp 0x45e3ab
add eax, 4
push eax
call edi
mov dword [0x68bcd4], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.jsproxy.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x22
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x23
cmp dword [eax + 0x18], 8
jb 0x45e40e
mov eax, dword [eax + 4]
jmp 0x45e411
add eax, 4
push eax
call edi
mov dword [0x68bcd8], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.gdiplus.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x24
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x25
cmp dword [eax + 0x18], 8
jb 0x45e474
mov eax, dword [eax + 4]
jmp 0x45e477
add eax, 4
push eax
call edi
mov dword [0x68bcdc], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Magnification.dll
call fcn.00415a69
mov dword [esp + 0x11c], 0x26
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x30]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x27
cmp dword [eax + 0x18], 8
jb 0x45e4da
mov eax, dword [eax + 4]
jmp 0x45e4dd
add eax, 4
push eax
call edi
mov dword [0x68bce0], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.0041382c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x45e5b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00415abb
mov dword [esp + 0x11c], 0x28
mov dword [esp + 0x11c], ebx
lea esi, [esp + 0x4c]
call fcn.0045f0bc
add esp, 0x1c
mov dword [esp + 0x100], 0x29
cmp dword [eax + 0x18], 8
jb 0x45e549
mov eax, dword [eax + 4]
jmp 0x45e54c
add eax, 4
push eax
call edi
mov dword [0x68bce4], eax
mov dword [esp + 0x100], ebx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.0041382c
cmp dword [0x68bce4], 0
jne 0x45e5b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
push str.LateBinding.Init:_rich_edit_DLL_could_not_be_loaded__error__1_
lea eax, [esp + 0x50]
push eax
call fcn.00409f00
mov dword [esp + 0x100], 0x2a
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
call fcn.0040a170
push eax
call fcn.0045f1a9
mov dword [esp + 0x100], ebx
lea eax, [esp + 0x4c]
push eax
call fcn.00402184
mov eax, dword [0x68bc94]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x45e776
push str.WTSGetActiveConsoleSessionId
push eax
call esi
push str.IsWow64Process
push dword [0x68bc94]
mov dword [0x68bd14], eax
call esi
push str.ProcessIdToSessionId
push dword [0x68bc94]
mov dword [0x68bd08], eax
call esi
push str.SetThreadExecutionState
push dword [0x68bc94]
mov dword [0x68bd6c], eax
call esi
push str.RegisterWaitForSingleObject
push dword [0x68bc94]
mov dword [0x68bd00], eax
call esi
push str.UnregisterWait
push dword [0x68bc94]
mov dword [0x68bde8], eax
call esi
push str.GetUserGeoID
push dword [0x68bc94]
mov dword [0x68bdec], eax
call esi
push str.GetGeoInfoW
push dword [0x68bc94]
mov dword [0x68be04], eax
call esi
push str.GetLocaleInfoW
push dword [0x68bc94]
mov dword [0x68be08], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [0x68bc94]
mov dword [0x68be10], eax
call esi
push str.GetUserDefaultUILanguage
push dword [0x68bc94]
mov dword [0x68be14], eax
call esi
push str.UnregisterWaitEx
push dword [0x68bc94]
mov dword [0x68be18], eax
call esi
push str.QueryFullProcessImageNameW
push dword [0x68bc94]
mov dword [0x68be58], eax
call esi
push str.GetProcessImageFileNameW
push dword [0x68bc94]
mov dword [0x68be64], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [0x68bc94]
mov dword [0x68be68], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [0x68bc94]
mov dword [0x68be6c], eax
call esi
push str.GetComputerNameW
push dword [0x68bc94]
mov dword [0x68be70], eax
call esi
push str.GetProcessId
push dword [0x68bc94]
mov dword [0x68be74], eax
call esi
push str.CreateToolhelp32Snapshot
push dword [0x68bc94]
mov dword [0x68be78], eax
call esi
push str.Process32First
push dword [0x68bc94]
mov dword [0x68bea0], eax
call esi
mov dword [0x68bea4], eax
push str.Process32Next
push dword [0x68bc94]
call esi
push str.TzSpecificLocalTimeToSystemTime
push dword [0x68bc94]
mov dword [0x68bea8], eax
call esi
push str.SetProcessUserModeExceptionPolicy
push dword [0x68bc94]
mov dword [0x68beac], eax
call esi
push str.GetProcessUserModeExceptionPolicy
push dword [0x68bc94]
mov dword [0x68beb0], eax
call esi
mov dword [0x68beb4], eax
mov eax, dword [0x68bc98]
test eax, eax
je 0x45e952
push str.SetMenuInfo
push eax
call esi
push str.GetAccCursorInfo
push dword [0x68bc98]
mov dword [0x68bd0c], eax
call esi
push str.ChangeWindowMessageFilter
push dword [0x68bc98]
mov dword [0x68bd10], eax
call esi
push str.MonitorFromRect
push dword [0x68bc98]
mov dword [0x68bd18], eax
call esi
push str.MonitorFromWindow
push dword [0x68bc98]
mov dword [0x68bd28], eax
call esi
push str.MonitorFromPoint
push dword [0x68bc98]
mov dword [0x68bd2c], eax
call esi
push str.GetMonitorInfoA
push dword [0x68bc98]
mov dword [0x68bd30], eax
call esi
push str.GetMonitorInfoW
push dword [0x68bc98]
mov dword [0x68bd34], eax
call esi
push str.EnumDisplayMonitors
push dword [0x68bc98]
mov dword [0x68bd38], eax
call esi
push str.EnumDisplayDevicesA
push dword [0x68bc98]
mov dword [0x68bd3c], eax
call esi
push 0x623bf8
push dword [0x68bc98]
mov dword [0x68bd40], eax
call esi
push str.UpdateLayeredWindow
push dword [0x68bc98]
mov dword [0x68bd44], eax
call esi
push str.LockWorkStation
push dword [0x68bc98]
mov dword [0x68bd48], eax
call esi
push str.FlashWindowEx
push dword [0x68bc98]
mov dword [0x68bd74], eax
call esi
push str.GetLastInputInfo
push dword [0x68bc98]
mov dword [0x68bdf0], eax
call esi
push str.GetLayeredWindowAttributes
push dword [0x68bc98]
mov dword [0x68bdf4], eax
call esi
push str.SwitchToThisWindow
push dword [0x68bc98]
mov dword [0x68be00], eax
call esi
push str.AddClipboardFormatListener
push dword [0x68bc98]
mov dword [0x68be24], eax
call esi
push str.RemoveClipboardFormatListener
push dword [0x68bc98]
mov dword [0x68beb8], eax
call esi
push str.GetUpdatedClipboardFormats
push dword [0x68bc98]
mov dword [0x68bebc], eax
call esi
mov dword [0x68bec0], eax
push str.RegisterPowerSettingNotification
push dword [0x68bc98]
call esi
push str.UnregisterPowerSettingNotification
push dword [0x68bc98]
mov dword [0x68be1c], eax
call esi
push str.GetGuiResources
push dword [0x68bc98]
mov dword [0x68be20], eax
call esi
push str.InSendMessageEx
push dword [0x68bc98]
mov dword [0x68be7c], eax
call esi
push str.SetMirrorRendering
push dword [0x68bc98]
mov dword [0x68be80], eax
call esi
push str.SetMagnificationLensCtxInformation
push dword [0x68bc98]
mov dword [0x68be84], eax
call esi
mov dword [0x68be88], eax
mov eax, dword [0x68bc9c]
test eax, eax
je 0x45e9ea
push str.WTSRegisterSessionNotification
push eax
call esi
push str.WTSUnRegisterSessionNotification
push dword [0x68bc9c]
mov dword [0x68bce8], eax
call esi
push str.WTSQuerySessionInformationW
push dword [0x68bc9c]
mov dword [0x68bcec], eax
call esi
push str.WTSFreeMemory
push dword [0x68bc9c]
mov dword [0x68bcf0], eax
call esi
push str.WTSEnumerateProcessesW
push dword [0x68bc9c]
mov dword [0x68bcf4], eax
call esi
push str.WTSQueryUserToken
push dword [0x68bc9c]
mov dword [0x68bcf8], eax
call esi
push str.WTSEnumerateSessionsW
push dword [0x68bc9c]
mov dword [0x68bcfc], eax
call esi
push str.WTSCloseServer
push dword [0x68bc9c]
mov dword [0x68be50], eax
call esi
mov dword [0x68be54], eax
mov eax, dword [0x68bca0]
test eax, eax
je 0x45ea24
push str.AlphaBlend
push eax
call esi
push str.GradientFill
push dword [0x68bca0]
mov dword [0x68bd1c], eax
call esi
push str.TransparentBlt
push dword [0x68bca0]
mov dword [0x68bd20], eax
call esi
mov dword [0x68bd24], eax
mov eax, dword [0x68bca4]
test eax, eax
je 0x45ea4c
push str.DwmIsCompositionEnabled
push eax
call esi
push str.DwmEnableComposition
push dword [0x68bca4]
mov dword [0x68bd4c], eax
call esi
mov dword [0x68bd50], eax
mov eax, dword [0x68bca8]
test eax, eax
je 0x45ec4c
push 0x623e78
push eax
call esi
push str.RegOpenCurrentUser
push dword [0x68bca8]
mov dword [0x68bd54], eax
call esi
push str.CreateProcessWithTokenW
push dword [0x68bca8]
mov dword [0x68bd58], eax
call esi
push str.CreateProcessWithLogonW
push dword [0x68bca8]
mov dword [0x68bd5c], eax
call esi
push str.LookupPrivilegeValueW
push dword [0x68bca8]
mov dword [0x68bd60], eax
call esi
push str.LookupPrivilegeNameW
push dword [0x68bca8]
mov dword [0x68bd70], eax
call esi
push str.GetTokenInformation
push dword [0x68bca8]
mov dword [0x68bd78], eax
call esi
push str.AdjustTokenPrivileges
push dword [0x68bca8]
mov dword [0x68bd7c], eax
call esi
push str.OpenProcessToken
push dword [0x68bca8]
mov dword [0x68bd80], eax
call esi
push str.OpenThreadToken
push dword [0x68bca8]
mov dword [0x68bd84], eax
call esi
push str.DuplicateTokenEx
push dword [0x68bca8]
mov dword [0x68bd88], eax
call esi
push str.SetTokenInformation
push dword [0x68bca8]
mov dword [0x68bd8c], eax
call esi
push str.LogonUserW
push dword [0x68bca8]
mov dword [0x68bd90], eax
call esi
push str.InitializeSid
push dword [0x68bca8]
mov dword [0x68bd64], eax
call esi
push str.GetSidSubAuthorityCount
push dword [0x68bca8]
mov dword [0x68bdc8], eax
call esi
push str.GetSidLengthRequired
push dword [0x68bca8]
mov dword [0x68bdc0], eax
call esi
push str.GetSidSubAuthority
push dword [0x68bca8]
mov dword [0x68bdc4], eax
call esi
push str.QueryServiceStatusEx
push dword [0x68bca8]
mov dword [0x68bdcc], eax
call esi
push str.ChangeServiceConfigW
push dword [0x68bca8]
mov dword [0x68be28], eax
call esi
push str.ChangeServiceConfig2W
push dword [0x68bca8]
mov dword [0x68be2c], eax
call esi
mov dword [0x68be30], eax
push str.QueryServiceConfigW
push dword [0x68bca8]
call esi
push str.DeleteService
push dword [0x68bca8]
mov dword [0x68be34], eax
call esi
push str.OpenServiceW
push dword [0x68bca8]
mov dword [0x68be38], eax
call esi
push str.CreateServiceW
push dword [0x68bca8]
mov dword [0x68be3c], eax
call esi
push str.EnumServicesStatusW
push dword [0x68bca8]
mov dword [0x68be40], eax
call esi
push str.OpenSCManagerW
push dword [0x68bca8]
mov dword [0x68be44], eax
call esi
push str.InitiateSystemShutdownW
push dword [0x68bca8]
mov dword [0x68be48], eax
call esi
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
push dword [0x68bca8]
mov dword [0x68be4c], eax
call esi
mov dword [0x68be98], eax
mov eax, dword [0x68bcac]
test eax, eax
je 0x45ecbc
push str.CreateEnvironmentBlock
push eax
call esi
push str.DestroyEnvironmentBlock
push dword [0x68bcac]
mov dword [0x68bd94], eax
call esi
push str.ExpandEnvironmentStringsForUserW
push dword [0x68bcac]
mov dword [0x68bd9c], eax
call esi
push str.LoadUserProfileW
push dword [0x68bcac]
mov dword [0x68bd98], eax
call esi
push str.UnloadUserProfile
push dword [0x68bcac]
mov dword [0x68bda0], eax
call esi
push str.GetUserProfileDirectoryW
push dword [0x68bcac]
mov dword [0x68bda4], eax
call esi
mov dword [0x68bd68], eax
mov eax, dword [0x68bcb0]
test eax, eax
je 0x45ecd2
push str.GetUserNameExW
push eax
call esi
mov dword [0x68bda8], eax
mov eax, dword [0x68bcb4]
test eax, eax
je 0x45ed30
push str.NetUserGetInfo
push eax
call esi
push str.NetApiBufferFree
push dword [0x68bcb4]
mov dword [0x68bdac], eax
call esi
push str.NetServerEnum
push dword [0x68bcb4]
mov dword [0x68bdb0], eax
call esi
push str.NetShareEnum
push dword [0x68bcb4]
mov dword [0x68bdb4], eax
call esi
push str.NetUserModalsGet
push dword [0x68bcb4]
mov dword [0x68bdb8], eax
call esi
mov dword [0x68bdbc], eax
mov eax, dword [0x68bcb8]
test eax, eax
je 0x45ed46
push str.WinVerifyTrust
push eax
call esi
mov dword [0x68bdd0], eax
mov eax, dword [0x68bcbc]
test eax, eax
je 0x45ed80
push str.EnumProcesses
push eax
call esi
push str.GetModuleBaseNameW
push dword [0x68bcbc]
mov dword [0x68bdd4], eax
call esi
push str.GetModuleFileNameExW
push dword [0x68bcbc]
mov dword [0x68bdd8], eax
call esi
mov dword [0x68be0c], eax
mov eax, dword [0x68bcc0]
test eax, eax
je 0x45eda8
push str.FlushIpNetTable
push eax
call esi
push str.IpRenewAddress
push dword [0x68bcc0]
mov dword [0x68bddc], eax
call esi
mov dword [0x68bde0], eax
mov eax, dword [0x68bcc4]
test eax, eax
je 0x45edbe
push str.WinStationConnectW
push eax
call esi
mov dword [0x68bd04], eax
mov eax, dword [0x68bcc8]
test eax, eax
je 0x45ede6
push str.IsThemeActive
push eax
call esi
push str.SetWindowTheme
push dword [0x68bcc8]
mov dword [0x68bde4], eax
call esi
mov dword [0x68be94], eax
call fcn.00463055
cmp eax, 7
mov eax, dword [0x68bccc]
jl 0x45edf9
test eax, eax
jne 0x45ee02
mov eax, dword [0x68bcd0]
test eax, eax
je 0x45ee0f
push str.SHGetFolderPathW
push eax
call esi
mov dword [0x68bdf8], eax
mov eax, dword [0x68bccc]
test eax, eax
je 0x45ee37
push 0x294
push eax
call esi
push str.SHGetSpecialFolderPathW
push dword [0x68bccc]
mov dword [0x68bdfc], eax
call esi
mov dword [0x68be9c], eax
mov eax, dword [0x68bcd4]
test eax, eax
je 0x45ee5f
push str.GetLayout
push eax
call esi
push str.SetLayout
push dword [0x68bcd4]
mov dword [0x68be5c], eax
call esi
mov dword [0x68be60], eax
mov eax, dword [0x68bcd8]
test eax, eax
je 0x45ee99
push str.InternetInitializeAutoProxyDll
push eax
call esi
push str.InternetGetProxyInfo
push dword [0x68bcd8]
mov dword [0x68bec4], eax
call esi
push str.InternetDeInitializeAutoProxyDll
push dword [0x68bcd8]
mov dword [0x68bec8], eax
call esi
mov dword [0x68becc], eax
mov eax, dword [0x68bcdc]
test eax, eax
je 0x45ef31
push str.GdiplusStartup
push eax
call esi
push str.GdiplusShutdown
push dword [0x68bcdc]
mov dword [0x68bed0], eax
call esi
push str.GdipCreateBitmapFromFile
push dword [0x68bcdc]
mov dword [0x68bed4], eax
call esi
push str.GdipCreateHBITMAPFromBitmap
push dword [0x68bcdc]
mov dword [0x68bed8], eax
call esi
push str.GdipSaveImageToFile
push dword [0x68bcdc]
mov dword [0x68bedc], eax
call esi
push str.GdipCreateBitmapFromHBITMAP
push dword [0x68bcdc]
mov dword [0x68bee0], eax
call esi
push str.GdipGetImageEncodersSize
push dword [0x68bcdc]
mov dword [0x68bee4], eax
call esi
push str.GdipGetImageEncoders
push dword [0x68bcdc]
mov dword [0x68bee8], eax
call esi
mov dword [0x68beec], eax
mov eax, dword [0x68bce0]
test eax, eax
je 0x45ef59
push str.MagInitialize
push eax
call esi
push str.MagUninitialize
push dword [0x68bce0]
mov dword [0x68be8c], eax
call esi
mov dword [0x68be90], eax
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret