Function at 0x401e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cx, word [esp + 0x9a]
mov word [esp + 0x98], 0x37a1
mov dword [esp + 0x84], 0x705f921a
mov dl, byte [eax]
mov dword [esp + 0x80], 1
cmp dl, 0xb8
mov word [esp + 0x52], cx
mov byte [esp + 0x51], dl
je 0x40213a
jmp 0x40211f
lea eax, [esp + 0x54]
lea ecx, str._es_app
mov edx, 0x18
mov si, 0x37cf
mov di, 0x3815
mov ebx, eax
sub di, word [esp + 0x98]
mov dword [esp + 0x70], ebx
sub si, word [esp + 0x98]
mov bx, word [esp + 0x52]
imul bx, bx, 0x4ba4
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x70]
mov word [esp + 0x9a], bx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x18
mov word [esp + 0x4a], si
mov word [esp + 0x48], di
mov dword [esp + 0x44], edx
call fcn.004048e0
mov si, word [esp + 0x48]
mov word [esp + 0x54], si
mov word [esp + 0x5a], 0x74
mov si, word [esp + 0x98]
xor si, 0x37c4
mov di, word [esp + 0x4a]
mov word [esp + 0x62], di
mov word [esp + 0x64], si
mov word [esp + 0x66], 0x78
mov word [esp + 0x68], 0x65
mov eax, esp
mov ecx, dword [esp + 0x4c]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call eax
sub esp, 4
mov si, word [esp + 0x52]
xor si, 0xffff
mov word [esp + 0x9a], si
mov dword [esp + 0x6c], 1
cmp eax, 0
je 0x402002
mov eax, dword [esp + 0x6c]
mov cx, word [esp + 0x52]
mov word [esp + 0x9a], cx
mov dword [esp + 0x80], eax
jmp 0x40213a
lea eax, str.tttt32
mov ecx, dword [esp + 0x84]
add ecx, 0x8fa06de6
mov dword [esp], eax
mov dword [esp + 0x40], ecx
call fcn.00401760
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x3c], eax
mov ax, word [esp + 0x98]
xor ax, 0x5ba3
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x78], ecx
mov word [esp + 0x7e], ax
mov ax, word [esp + 0x7e]
mov dword [esp + 0x94], 0
mov dword [esp + 0x90], 0
mov dl, byte [esp + 0x51]
xor dl, 0xff
mov byte [esp + 0x8f], dl
cmp ax, 0x220a
ja 0x40204d
jmp 0x40211f
lea eax, [0x426a04]
mov byte [0x426a0b], 0x45
mov ecx, dword [esp + 0x84]
xor ecx, 0x705f921a
mov edx, esp
mov dword [edx], 0x426a04
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
call edx
sub esp, 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x6c], ecx
cmp eax, 0
je 0x4020cf
jmp 0x401f6d
xor eax, eax
mov ecx, 0x705f921a
sub ecx, dword [esp + 0x84]
mov edx, esp
mov dword [edx], 0
mov edx, dword [sym.imp.USER32.dll_TranslateMessage]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
call edx
sub esp, 4
xor ecx, ecx
mov edx, esp
mov esi, dword [esp + 0x2c]
mov dword [edx + 0x10], esi
mov dword [edx + 0xc], esi
mov dword [edx + 8], esi
mov dword [edx + 4], 0
mov dword [edx], 0
mov edx, dword [sym.imp.ADVAPI32.dll_RegLoadAppKeyW]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
call edx
sub esp, 0x14
mov ecx, dword [esp + 0x78]
add ecx, 1
mov dword [esp + 0x74], ecx
mov dword [esp + 0x6c], 0
cmp ecx, 0x3ff
mov dword [esp + 0x20], eax
je 0x401f6d
jmp 0x401fb5
lea eax, [0x426a04]
xor ecx, ecx
mov edx, 1
mov esi, esp
mov dword [esi + 8], 1
mov dword [esi + 4], 0
mov dword [esi], 0x426a04
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
call esi
sub esp, 0xc
mov dword [esp + 0x6c], 0
cmp eax, 0
je 0x401f8a
jmp 0x401f6d
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov cl, byte [eax]
mov dword [esp + 0x80], 1
cmp cl, 0x6a
jne 0x401e95
mov eax, dword [esp + 0x80]
lea esp, [ebp - 0xc]
pop edi
pop ebx
pop esi
pop ebp
ret