Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x54
push 0
push 0x4a6b80
call fcn.00414e60
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4a6b84], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4a6b80], eax
call fcn.0040537e
call fcn.00426f50
call fcn.004263f2
call fcn.004262a0
call fcn.00425340
call fcn.00423dfa
call fcn.00423510
call fcn.00422c36
call fcn.00422369
call fcn.00421b75
call fcn.0042170b
call fcn.00421569
call fcn.00420f00
call fcn.00420753
call fcn.0041fcc0
call fcn.0041f4ec
call fcn.0041f4b9
call fcn.0041ded3
call fcn.0041dd8e
call fcn.0041c440
call fcn.0041b7d4
call fcn.0041ac73
call fcn.0041ab6a
call fcn.0041a93c
mov eax, 0x200
push eax
lea eax, [0x4a6bb8]
push eax
xor eax, eax
push eax
push 7
push 0x10
call fcn.00420da0
call fcn.0041bc56
mov ebp, 0x487668
push ebp
push 0
call fcn.0042195a
mov ebp, 0x487eb5
push ebp
push 1
call fcn.0042195a
mov ebp, 0x4886ff
push ebp
push 2
call fcn.0042195a
mov ebp, 0x488e4a
push ebp
push 3
call fcn.0042195a
mov ebp, 0x4895de
push ebp
push 4
call fcn.0042195a
call fcn.0041c230
call fcn.0041bc56
mov ebp, 0x497474
push ebp
push 5
call fcn.0042195a
mov ebp, 0x49a069
push ebp
push 6
call fcn.0042195a
mov ebp, 0x49b01d
push ebp
push 7
call fcn.0042195a
call fcn.0041c230
call fcn.0041bc56
mov ebp, 0x49c055
push ebp
push 8
call fcn.0042195a
mov ebp, 0x49ea94
push ebp
push 9
call fcn.0042195a
mov ebp, 0x49facc
push ebp
push 0xa
call fcn.0042195a
call fcn.0041bc56
call fcn.0041c230
mov ebp, 0x4a0a80
push ebp
push 0xb
call fcn.0042195a
mov ebp, 0x4a1ab8
push ebp
push 0xc
call fcn.0042195a
mov ebp, 0x4a2a6c
push ebp
push 0xd
call fcn.0042195a
call fcn.0041c230
mov ebp, 0x4a3fad
push ebp
push 0xe
call fcn.0042195a
mov eax, str.Advapi32.dll
push eax
push 0xffffffff
call fcn.0041b8a2
mov dword [0x4a6b98], eax
cmp dword [0x4a6b98], 0
je 0x40127a
mov eax, str.RegDeleteKeyExW
push eax
push dword [0x4a6b98]
call fcn.0041b848
mov dword [0x4a6b9c], eax
mov eax, str.RegSetValueExW
push eax
push dword [0x4a6b98]
call fcn.0041b848
mov dword [0x4a6b8c], eax
mov eax, str.RegDeleteTreeW
push eax
push dword [0x4a6b98]
call fcn.0041b848
mov dword [0x4a6b94], eax
mov eax, str.RegEnumKeyExW
push eax
push dword [0x4a6b98]
call fcn.0041b848
mov dword [0x4a6b88], eax
mov eax, str.ExpandEnvironmentStringsW
push eax
push dword [0x4a6b98]
call fcn.0041b848
mov dword [0x4a6b90], eax
push 8
push 0x487634
lea eax, [0x4a6bbc]
push eax
push 4
call fcn.00422388
push 7
push 0x487650
lea eax, [0x4a6bc4]
push eax
push 0x28
call fcn.00422388
push 7
push 0x487648
lea eax, [0x4a6bcc]
push eax
push 8
call fcn.00422388
call fcn.0041c230
push dword [0x4a6bbc]
call fcn.00403d58
push 0
call fcn.004030c0
push 0x230
push 0x3e8
push 0
push 0
call fcn.00402390
and eax, eax
je 0x4014d2
push 2
push 0
call fcn.00404123
push 0
call fcn.00402e9c
push 1
push 0
push 0
call fcn.0041df70
call fcn.0041e64c
mov dword [0x4a6ba8], eax
mov dword [0x4a6bb0], 0
jmp 0x401349
push dword [0x4a6bc4]
call fcn.0042257f
mov ebx, eax
dec ebx
cmp ebx, dword [0x4a6bb0]
jl 0x401407
push dword [0x4a6bb0]
push dword [0x4a6bc4]
call fcn.004225e2
mov dword [0x4a6bac], eax
push dword [0x4a6ba8]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4013fa
call fcn.0042082e
push eax
mov ebp, dword [0x4a6bc8]
mov ebx, dword [ebp + 0x20]
cmp ebx, dword [esp]
jne 0x4013f9
call fcn.00420837
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4013f8
mov ebp, dword [0x4a6bc8]
cmp dword [ebp + 0x28], 0
je 0x4013d8
mov ebp, dword [0x4a6bc8]
mov dword [ebp + 0x28], 0
push dword [ebp + 0x18]
call fcn.00421b89
cdq
push edx
push eax
push dword [ebp + 0x20]
call fcn.0041d8ac
jmp 0x4013f8
mov ebp, dword [0x4a6bc8]
mov dword [ebp + 0x28], 1
push dword [ebp + 0x1c]
call fcn.00421b89
cdq
push edx
push eax
push dword [ebp + 0x20]
call fcn.0041d8ac
pop eax
pop eax
pop eax
inc dword [0x4a6bb0]
jno 0x401349
push dword [0x4a6ba8]
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401426
mov dword [0x4a6ba4], 1
jmp 0x4014a6
mov ebx, 0x201
cmp ebx, dword [esp]
jne 0x401451
push 0
push 2
push 0xa1
push 0
call fcn.0041e6d0
push eax
call sub.USER32.dll_SendMessageW
jmp 0x4014a6
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4014a6
call fcn.0042082e
push eax
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401472
call fcn.004026e8
jmp 0x4014a5
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401485
push 0
call fcn.00402e9c
jmp 0x4014a5
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401496
call fcn.00403c3c
jmp 0x4014a5
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4014a5
call fcn.00402884
pop eax
pop eax
cmp dword [0x4a6ba4], 0
je 0x401333
push 0
call fcn.004044bf
cmp dword [0x4a6bb4], 0
je 0x4014d2
push dword [0x4a6bb4]
call sub.GDI32.dll_DeleteObject
push 0
call 0x4014f1
call fcn.00426f30
push dword [0x4a6b80]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0041abf6
call fcn.0041b7c8
call fcn.0041c3ea
call sub.ole32.dll_OleUninitialize
call fcn.0041deb0
call fcn.0041f4e0
call fcn.0041f943
call fcn.0041fcb0
call fcn.00420715
call fcn.00421558
call fcn.00421b69
call fcn.00422c29
call fcn.00405910
call fcn.004263e6
call fcn.0042647d
call fcn.00426290
ret