Function at 0x4d317c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8a
push 0
push 0
dec ecx
jne 0x4d3184
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d3af1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x438e2c]
call fcn.00438f98
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d3ac4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
call fcn.00444fe0
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4d3aa6
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444948
cmp al, 1
jne 0x4d3a9e
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00439074
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x418]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x418]
mov edx, 0x4d3b08
call fcn.00404844
jne 0x4d32a3
mov cl, 1
mov edx, 0x4d3b18
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d327e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x41c]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x41c]
mov edx, 0x4d3b50
call fcn.00404844
jne 0x4d340e
xor ecx, ecx
mov edx, 0x4d3b64
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d3321
push 0x401
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
lea ecx, [ebp - 0x411]
mov eax, dword [ebp - 8]
call fcn.004397a8
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x411]
cmp byte [eax], 0x2e
jne 0x4d336c
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
add edi, 0xb
sub edi, eax
jl 0x4d3379
inc edi
lea ebx, [ebp + eax - 0x411]
cmp byte [ebx], 0
je 0x4d3366
lea eax, [ebp - 0x420]
mov dl, byte [ebx]
call fcn.00404620
mov edx, dword [ebp - 0x420]
lea eax, [ebp - 0x10]
call fcn.00404700
inc ebx
dec edi
jne 0x4d3346
jmp 0x4d3379
inc dword [ebp - 0xc]
inc eax
cmp dword [ebp - 0xc], 0x402
jne 0x4d332c
mov edx, 0x80000000
mov eax, dword [ebp - 8]
call fcn.00439074
lea eax, [ebp - 0x424]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4d3bc0
call fcn.00404744
mov edx, dword [ebp - 0x424]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d33e9
push 0x4d3bc0
push dword [ebp - 0x10]
push 0x4d3bcc
lea eax, [ebp - 0x428]
mov edx, 3
call fcn.004047b8
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
call fcn.00439990
test al, al
je 0x4d33e9
mov edx, 0x4d3be0
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x42c]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x42c]
mov edx, 0x4d3bf4
call fcn.00404844
jne 0x4d34d7
xor ecx, ecx
mov edx, 0x4d3c04
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d34b2
lea ecx, [ebp - 0x434]
mov edx, 0x4d3c50
mov eax, dword [ebp - 8]
call fcn.0043971c
push dword [ebp - 0x434]
push 0x4d3bc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
push dword [eax + 0x24]
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.004047b8
mov eax, dword [ebp - 0x430]
call fcn.00409250
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00439074
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x438]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x438]
mov edx, 0x4d3c60
call fcn.00404844
jne 0x4d3578
mov cl, 1
mov edx, 0x4d3c70
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d3553
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x43c]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x43c]
mov edx, 0x4d3c98
call fcn.00404844
jne 0x4d360c
mov cl, 1
mov edx, 0x4d3ca8
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d35e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x440]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x440]
mov edx, 0x4d3cd0
call fcn.00404844
jne 0x4d3740
mov cl, 1
mov edx, 0x4d3ce0
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d367f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov cl, 1
mov edx, 0x4d3d08
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d36b3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov cl, 1
mov edx, 0x4d3d48
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d36e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov cl, 1
mov edx, 0x4d3d74
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d371b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x444]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x444]
mov edx, 0x4d3db4
call fcn.00404844
jne 0x4d380c
mov cl, 1
mov edx, 0x4d3dc4
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d37b3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov cl, 1
mov edx, 0x4d3dec
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d37e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x448]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x448]
mov edx, 0x4d3e28
call fcn.00404844
jne 0x4d38d8
mov cl, 1
mov edx, 0x4d3e3c
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d387f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov cl, 1
mov edx, 0x4d3e60
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d38b3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov edx, 0x80000000
mov eax, dword [ebp - 8]
call fcn.00439074
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x44c]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44c]
mov edx, 0x4d3e98
call fcn.00404844
jne 0x4d3979
mov cl, 1
mov edx, 0x4d3eac
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d3954
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x450]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x450]
mov edx, 0x4d3ee8
call fcn.00404844
jne 0x4d3a0d
mov cl, 1
mov edx, 0x4d3ef8
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d39e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x454]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x454]
mov edx, 0x4d3f34
call fcn.00404844
jne 0x4d3a9e
mov cl, 1
mov edx, 0x4d3f44
mov eax, dword [ebp - 8]
call fcn.004391b8
test al, al
je 0x4d3a7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 8]
call fcn.004392dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov eax, dword [eax + 0x22c]
mov edx, esi
call fcn.00445010
call fcn.00444910
call fcn.00403e74
jmp 0x4d3acb
inc esi
dec ebx
jne 0x4d31df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3acb
mov eax, dword [ebp - 8]
call fcn.00439044
mov eax, dword [ebp - 8]
call fcn.004035e8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3af8
lea eax, [ebp - 0x454]
mov edx, 0x10
call fcn.0040445c
lea eax, [ebp - 0x10]
call fcn.00404438
ret