Function at 0x401ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x416758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x41c9bc
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x41c57c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401f98
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c97c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c95c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov eax, 0xfffffff8
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x20
ret
mov eax, dword [esp + 0x14]
push ecx
cmp eax, 2
mov ecx, esp
jne 0x401fd1
mov dword [esp + 0x1c], esp
push 0x41c92c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
jmp 0x402186
mov dword [esp + 0x1c], esp
push 0x41c910
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c8dc
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push 0x41c5e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ecx
test eax, eax
mov ecx, esp
je 0x40208c
mov dword [esp + 0x1c], esp
push 0x41c8b4
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c5e0
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c894
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov eax, 0xfffffff7
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x20
ret
mov dword [esp + 0x1c], esp
push 0x41c864
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov edx, dword [esp + 8]
push 0
push edx
push 0x41c5e0
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
test eax, eax
je 0x402152
mov ecx, dword [0x41ca98]
mov dword [esp + 0xc], ecx
push eax
lea edx, [esp + 0x10]
push 0x41c848
push edx
mov dword [esp + 0x30], 0
call fcn.0040daed
add esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c828
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c804
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040e317
mov eax, 0xfffffff6
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x20
ret
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c7e0
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c7bc
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov ecx, dword [esp + 0x1c]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret