Function at 0x402f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4448f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
mov eax, dword [0x453250]
push ebp
push esi
push edi
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xd8], edx
mov eax, dword [str.HKEY_CLASSES_ROOT]
mov ecx, dword [0x45227c]
mov dword [esp + 0x34], eax
mov eax, dword [0x452280]
mov dword [esp + 0x38], ecx
mov ecx, dword [0x452284]
mov dword [esp + 0x3c], eax
mov ax, word [0x452288]
mov dword [esp + 0x40], ecx
mov ecx, 5
mov esi, str.HKEY_CURRENT_CONFIG
lea edi, [esp + 0x4a]
mov word [esp + 0x44], ax
mov dword [esp + 0x46], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.HKEY_CURRENT_USER]
mov eax, dword [0x452254]
mov dword [esp + 0x60], ecx
mov ecx, dword [0x452258]
mov dword [esp + 0x68], ecx
mov cx, word [0x452260]
mov word [esp + 0x70], cx
mov ecx, dword [0x452240]
mov dword [esp + 0x64], eax
mov eax, dword [0x45225c]
mov dword [esp + 0x7a], ecx
mov ecx, dword [0x452248]
mov dword [esp + 0x6c], eax
mov eax, dword [str.HKEY_LOCAL_MACHINE]
mov dword [esp + 0x82], ecx
mov cl, byte [0x45224e]
mov dword [esp + 0x76], eax
mov eax, dword [0x452244]
mov byte [esp + 0x88], cl
mov ecx, dword [str.HKEY_USERS]
mov dword [esp + 0x7e], eax
mov ax, word [0x45224c]
mov dword [esp + 0x8c], ecx
mov cx, word [0x452238]
mov word [esp + 0x86], ax
mov word [esp + 0x94], cx
xor eax, eax
xor ecx, ecx
mov word [esp + 0x89], ax
mov dword [esp + 0x97], ecx
mov byte [esp + 0x8b], al
mov eax, dword [0x452234]
mov dword [esp + 0x9b], ecx
mov dword [esp + 0x90], eax
mov al, byte [0x45223a]
mov word [esp + 0x9f], cx
mov byte [esp + 0xa1], cl
mov ecx, 5
mov esi, str.HKEY_PERFORMANCE_DATA
lea edi, [esp + 0xa2]
mov word [esp + 0x5e], dx
mov dword [esp + 0x72], edx
mov byte [esp + 0x96], al
mov eax, dword [str.HKEY_DYN_DATA]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x45220c]
mov byte [esp + 0xd8], 1
movsw word es:[edi], word [esi]
mov dword [esp + 0xb8], eax
mov eax, dword [0x452210]
mov dword [esp + 0xbc], ecx
mov cx, word [0x452214]
mov dword [esp + 0xc0], eax
xor eax, eax
mov word [esp + 0xc4], cx
mov dword [esp + 0xc6], eax
mov ebp, dword [esp + 0xe0]
mov dword [esp + 0xca], eax
cmp ebp, edx
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x1c], 0x80000005
mov dword [esp + 0x20], 0x80000001
mov dword [esp + 0x24], 0x80000002
mov dword [esp + 0x28], 0x80000003
mov dword [esp + 0x2c], 0x80000004
mov dword [esp + 0x30], 0x80000006
jne 0x40319b
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], al
call fcn.0043bf22
lea ecx, [esp + 0xc]
mov dword [esp + 0xd8], 0xffffffff
call fcn.0043bf22
xor eax, eax
jmp 0x403295
mov al, byte [ebp]
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
mov esi, ebp
test al, al
je 0x4031ba
cmp al, 0x5c
je 0x4031ba
push esi
call ebx
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x4031ab
lea ecx, [esp + 0x10]
call fcn.0043bead
mov edi, esi
sub edi, ebp
test edi, edi
jle 0x4031ee
push edi
lea ecx, [esp + 0x14]
call fcn.0043c306
inc edi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
or ebp, 0xffffffff
lea ecx, [esp + 0x10]
push ebp
call fcn.0043c355
jmp 0x4031f1
or ebp, 0xffffffff
push esi
call ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0043c05f
xor esi, esi
lea edi, [esp + 0x38]
pop ebx
mov ecx, dword [esp + 0xc]
push edi
push ecx
call fcn.0042cd86
add esp, 8
test eax, eax
je 0x403222
inc esi
add edi, 0x16
cmp esi, 7
jb 0x403205
jmp 0x40323f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + esi*4 + 0x18]
lea edx, [esp + 0x14]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403264
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 0
call fcn.0043bf22
lea ecx, [esp + 0xc]
mov dword [esp + 0xd8], ebp
call fcn.0043bf22
xor eax, eax
jmp 0x403295
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 0
call fcn.0043bf22
lea ecx, [esp + 0xc]
mov dword [esp + 0xd8], ebp
call fcn.0043bf22
mov eax, 1
mov ecx, dword [esp + 0xd0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xd0
ret