Function at 0x4b2fb4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4b2fbc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b3791
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b2244
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x4583fc]
call fcn.004584fc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b370e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b36fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x450]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4b3032
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004585d8
jmp 0x4b303f
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.004585d8
mov cl, 1
mov edx, 0x4b37a8
mov eax, dword [ebp - 0xc]
call fcn.0045863c
test al, al
je 0x4b3472
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x340]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b37cc
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b37e0
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x398]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b37f8
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4e4]
mov edx, 0x4b380c
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4e8]
mov edx, 0x4b381c
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b382c
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34c]
call fcn.004794bc
add esp, 0xfffffff8
fstp qword [esp]
wait
mov edx, 0x4b3840
mov eax, dword [ebp - 0xc]
call fcn.00458904
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x474]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3850
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4ec]
mov edx, 0x4b386c
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4fc]
mov edx, 0x4b3888
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4f8]
mov edx, 0x4b389c
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b38b0
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x46c]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b38cc
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
mov ecx, dword [eax + 0x200]
mov edx, 0x4b38ec
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4dc]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b38fc
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3920
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3930
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x504]
mov edx, 0x4b394c
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3964
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b397c
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41c]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3998
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b39b8
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x368]
call fcn.0047d74c
mov ecx, eax
mov edx, 0x4b39e0
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b39f4
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3a14
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e4]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3a34
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x408]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3a58
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ec]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3a70
mov eax, dword [ebp - 0xc]
call fcn.004588e0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
call fcn.00433418
mov ecx, dword [ebp - 0x10]
mov edx, 0x4b3a90
mov eax, dword [ebp - 0xc]
call fcn.004587f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x458]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3aac
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x47c]
call fcn.0047d74c
mov ecx, eax
mov edx, 0x4b3acc
mov eax, dword [ebp - 0xc]
call fcn.0045889c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f0]
call fcn.00433418
mov ecx, dword [ebp - 0x14]
mov edx, 0x4b3ae4
mov eax, dword [ebp - 0xc]
call fcn.004587f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x448]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3b00
mov eax, dword [ebp - 0xc]
call fcn.004588e0
call fcn.004a1fd8
mov ecx, eax
mov edx, 0x4b3b24
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x450]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3b38
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 0xc]
call fcn.004585a8
jmp 0x4b3476
mov byte [ebp - 5], 1
mov cl, 1
mov edx, 0x4b3b5c
mov eax, dword [ebp - 0xc]
call fcn.0045863c
test al, al
je 0x4b34f6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4b34df
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004029a4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004087cc
push dword [ebp - 0x1c]
push 0x4b3b94
push 0x4b3ba0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403f5c
mov ecx, dword [ebp - 0x18]
mov edx, 0x4b3bb0
mov eax, dword [ebp - 0xc]
call fcn.004587f8
jmp 0x4b34ec
mov edx, 0x4b3bb0
mov eax, dword [ebp - 0xc]
call fcn.00458760
mov eax, dword [ebp - 0xc]
call fcn.004585a8
jmp 0x4b34fa
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x4b35a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x450]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
jne 0x4b352c
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004585d8
jmp 0x4b3539
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.004585d8
mov edx, 0x4b37a8
mov cl, 1
mov eax, dword [ebp - 0xc]
call fcn.0045863c
test al, al
je 0x4b3574
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x450]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3b38
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 0xc]
call fcn.004585a8
mov edx, 0x4b3b5c
mov cl, 1
mov eax, dword [ebp - 0xc]
call fcn.0045863c
test al, al
je 0x4b359c
mov edx, 0x4b3bb0
mov eax, dword [ebp - 0xc]
call fcn.00458760
mov eax, dword [ebp - 0xc]
call fcn.004585a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b35b0
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004585d8
xor eax, eax
push ebp
push 0x4b36d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4b37a8
mov cl, 1
mov eax, dword [ebp - 0xc]
call fcn.0045863c
test al, al
je 0x4b36c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3bc4
mov eax, dword [ebp - 0xc]
call fcn.004588e0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x438]
call fcn.00433418
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.004a2cf4
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b3be4
mov eax, dword [ebp - 0xc]
call fcn.004587f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x440]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3bf8
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
mov ecx, dword [eax + 0x200]
mov edx, 0x4b3c20
mov eax, dword [ebp - 0xc]
call fcn.0045889c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x494]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3c44
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x488]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov ecx, eax
mov edx, 0x4b3c64
mov eax, dword [ebp - 0xc]
call fcn.004588e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x484]
call fcn.0046bcf0
movzx ecx, ax
mov edx, 0x4b3c78
mov eax, dword [ebp - 0xc]
call fcn.0045889c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b36dc
cmp byte [ebp - 5], 0
je 0x4b36e7
call fcn.0040b084
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3704
mov eax, dword [ebp - 0xc]
call fcn.00402f38
ret