Function at 0x4046f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x41655f
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x41c028]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41c028]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xb8]
xor ebx, ebx
mov dword [esp + 0x28], ebx
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xbc]
mov word [esp + 0x8c], cx
mov ecx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xa0], 7
mov dword [esp + 0x9c], ebx
lea esi, [ecx + 2]
mov edi, edi
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x404770
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x8c]
call fcn.00403050
mov dword [esp + 0xb0], ebx
mov eax, dword [esp + 0x9c]
lea esi, [eax - 1]
cmp eax, esi
ja 0x4047ad
call fcn.00415096
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x8c]
mov edi, 8
cmp dword [esp + 0xa0], edi
jae 0x4047c9
lea ecx, [esp + 0x8c]
mov edx, 0x5c
cmp dx, word [ecx + esi*2]
jne 0x40481b
lea ecx, [eax - 1]
lea eax, [esp + 0x88]
push eax
xor edx, edx
lea esi, [esp + 0x38]
call fcn.00402e80
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x90]
mov byte [esp + 0xb8], 1
call fcn.00402eb0
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x4c], edi
jb 0x40481b
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00409895
add esp, 4
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x30], 0x5c
call fcn.00404b40
mov edi, eax
lea eax, [esp + 0x88]
cmp edi, 0xffffffff
je 0x404860
push eax
mov ecx, edi
xor edx, edx
lea esi, [esp + 0x54]
call fcn.00402e80
mov byte [esp + 0xb0], 2
mov dword [esp + 0x28], 1
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x74], cx
mov esi, 7
push ebx
lea ecx, [esp + 0x74]
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
call fcn.00402eb0
mov dword [esp + 0xb0], 4
test byte [esp + 0x28], 1
je 0x4048bb
cmp dword [esp + 0x68], 8
jb 0x4048ac
mov edx, dword [esp + 0x54]
push edx
call fcn.00409895
add esp, 4
xor eax, eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], ax
cmp dword [esp + 0x84], 8
mov eax, dword [esp + 0x70]
jae 0x4048cd
lea eax, [esp + 0x70]
mov edx, dword [esp + 0x30]
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x404994
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10000
push ebx
push ebx
push eax
call fcn.004148f0
mov ebp, eax
push esi
mov edi, edx
add ebp, 0xad0000
adc edi, 0x15
push edi
push ebp
push 0xae
push str..RegMisc.cpp
push str._S__d_nRet0x_016llX_dwErrNo0x_08X_n
call fcn.004019b0
mov esi, 8
add esp, 0x18
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x84], esi
jb 0x40494e
mov eax, dword [esp + 0x70]
push eax
call fcn.00409895
add esp, 4
xor ecx, ecx
mov dword [esp + 0xb0], 0xffffffff
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], cx
cmp dword [esp + 0xa0], esi
jb 0x404b02
mov edx, dword [esp + 0x8c]
push edx
call fcn.00409895
add esp, 4
jmp 0x404b02
cmp edi, 0xffffffff
jne 0x4049f9
mov esi, 8
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x84], esi
jb 0x4049bb
mov eax, dword [esp + 0x70]
push eax
call fcn.00409895
add esp, 4
xor ecx, ecx
mov dword [esp + 0xb0], 0xffffffff
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], cx
cmp dword [esp + 0xa0], esi
jb 0x404afe
mov edx, dword [esp + 0x8c]
push edx
jmp 0x404af6
lea eax, [esp + 0x88]
lea edx, [edi + 1]
push eax
or ecx, 0xffffffff
lea esi, [esp + 0x38]
call fcn.00402e80
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x90]
mov byte [esp + 0xb8], 5
call fcn.00402eb0
mov esi, 8
mov byte [esp + 0xb0], 4
cmp dword [esp + 0x4c], esi
jb 0x404a47
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00409895
add esp, 4
mov eax, dword [esp + 0x8c]
xor edx, edx
mov edi, 7
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
cmp dword [esp + 0xa0], esi
jae 0x404a72
lea eax, [esp + 0x8c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.004046f0
mov ebp, eax
movzx ecx, dx
xor eax, eax
add esp, 8
or eax, ecx
mov dword [esp + 0x20], edx
je 0x404aa8
push edx
push ebp
push 0xba
push str..RegMisc.cpp
push str._S__d_nRet0x_016llX_n
call fcn.004019b0
add esp, 0x14
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x84], esi
jb 0x404ac5
mov ecx, dword [esp + 0x70]
push ecx
call fcn.00409895
add esp, 4
mov dword [esp + 0xb0], 0xffffffff
xor edx, edx
mov word [esp + 0x70], dx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], edi
cmp dword [esp + 0xa0], esi
jb 0x404afe
mov eax, dword [esp + 0x8c]
push eax
call fcn.00409895
add esp, 4
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x404b11
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, ebp
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00409551
add esp, 0xa0
ret