Function at 0x479c9c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x47a08c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor ebx, ebx
mov dl, 1
mov eax, dword [0x429314]
call fcn.00429414
mov esi, eax
mov edx, 0x80000001
mov eax, esi
call fcn.004294b4
mov cl, 1
mov edx, 0x47a0a4
mov eax, esi
call fcn.00429518
mov edx, 0x47a0cc
mov eax, esi
call fcn.0042981c
test al, al
je 0x479d11
mov edx, 0x47a0cc
mov eax, esi
call fcn.00429728
mov edx, eax
mov eax, dword [edi + 0x364]
call fcn.00443b98
mov edx, 0x47a0dc
mov eax, esi
call fcn.0042981c
test al, al
je 0x479d3a
mov edx, 0x47a0dc
mov eax, esi
call fcn.00429728
mov edx, eax
mov eax, dword [edi + 0x368]
call fcn.00443b98
mov edx, 0x47a0ec
mov eax, esi
call fcn.0042981c
test al, al
je 0x479d63
mov edx, 0x47a0ec
mov eax, esi
call fcn.00429728
mov edx, eax
mov eax, dword [edi + 0x330]
call fcn.00443b98
mov edx, 0x47a0fc
mov eax, esi
call fcn.0042981c
test al, al
je 0x479d81
mov edx, 0x47a0fc
mov eax, esi
call fcn.004296ec
mov ebx, eax
lea edx, [ebp - 8]
mov eax, 1
call fcn.004029f4
mov eax, dword [ebp - 8]
mov edx, 0x47a10c
call fcn.004044cc
jne 0x479df6
call fcn.00402a58
mov eax, dword [0x47e380]
mov eax, dword [eax]
call fcn.0045037c
mov edx, dword [0x48045c]
sub eax, dword [edx + 0x48]
sub eax, 5
call fcn.00402d14
mov edx, eax
mov eax, dword [0x48045c]
call fcn.00431a48
mov eax, dword [0x47e380]
mov eax, dword [eax]
call fcn.00450350
mov edx, dword [0x48045c]
sub eax, dword [edx + 0x4c]
call fcn.00402d14
mov edx, eax
mov eax, dword [0x48045c]
call fcn.00431a6c
jmp 0x479f02
mov edx, 0x47a118
mov eax, esi
call fcn.0042981c
test al, al
je 0x479ebb
mov edx, 0x47a124
mov eax, esi
call fcn.0042981c
test al, al
je 0x479ebb
mov edx, 0x47a118
mov eax, esi
call fcn.004296ec
mov edx, eax
mov eax, dword [0x48045c]
call fcn.00431a6c
mov edx, 0x47a124
mov eax, esi
call fcn.004296ec
mov edx, eax
mov eax, dword [0x48045c]
call fcn.00431a48
mov eax, dword [0x48045c]
cmp dword [eax + 0x40], 0xffffffba
jl 0x479e73
mov eax, dword [0x47e380]
mov eax, dword [eax]
call fcn.0044f418
sub eax, 0x1e
mov edx, dword [0x48045c]
cmp eax, dword [edx + 0x40]
jge 0x479e82
mov edx, 0x226
mov eax, dword [0x48045c]
call fcn.00431a48
mov eax, dword [0x48045c]
cmp dword [eax + 0x44], 0xffffff74
jl 0x479eaa
mov eax, dword [0x47e380]
mov eax, dword [eax]
call fcn.0044f40c
sub eax, 0x1e
mov edx, dword [0x48045c]
cmp eax, dword [edx + 0x44]
jge 0x479f02
mov edx, 0x15e
mov eax, dword [0x48045c]
call fcn.00431a6c
jmp 0x479f02
mov byte [ebp - 1], 1
mov eax, dword [0x47e380]
mov eax, dword [eax]
call fcn.0045037c
mov edx, eax
mov eax, dword [0x48045c]
sub edx, dword [eax + 0x48]
sub edx, 5
mov eax, dword [0x48045c]
call fcn.00431a48
mov eax, dword [0x47e380]
mov eax, dword [eax]
call fcn.00450350
mov edx, eax
mov eax, dword [0x48045c]
sub edx, dword [eax + 0x4c]
mov eax, dword [0x48045c]
call fcn.00431a6c
mov eax, esi
call fcn.00429484
mov cl, 1
mov edx, 0x47a134
mov eax, esi
call fcn.00429518
cmp byte [ebp - 1], 0
jne 0x479f36
mov edx, 0x47a16c
mov eax, esi
call fcn.0042981c
mov edx, eax
mov eax, dword [edi + 0x334]
call fcn.00443b98
mov eax, esi
call fcn.00429484
mov eax, esi
call fcn.00403370
test bl, bl
jne 0x479f5e
mov dl, 1
mov eax, dword [edi + 0x308]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a41c
cmp bl, 1
jne 0x479f79
mov dl, 1
mov eax, dword [edi + 0x30c]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a424
cmp bl, 2
jne 0x479f94
mov dl, 1
mov eax, dword [edi + 0x310]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a42c
cmp bl, 3
jne 0x479faf
mov dl, 1
mov eax, dword [edi + 0x314]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a434
cmp bl, 4
jne 0x479fca
mov dl, 1
mov eax, dword [edi + 0x318]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a43c
cmp bl, 5
jne 0x479fe5
mov dl, 1
mov eax, dword [edi + 0x31c]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a444
cmp bl, 6
jne 0x47a000
mov dl, 1
mov eax, dword [edi + 0x320]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a44c
cmp bl, 7
jne 0x47a01b
mov dl, 1
mov eax, dword [edi + 0x324]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a454
cmp bl, 8
jne 0x47a036
mov dl, 1
mov eax, dword [edi + 0x328]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a45c
cmp bl, 9
jne 0x47a051
mov dl, 1
mov eax, dword [edi + 0x32c]
call fcn.00443b98
xor edx, edx
mov eax, edi
call fcn.0047a464
xor edx, edx
mov eax, edi
call fcn.00479c10
mov eax, dword [edi + 0x364]
mov al, byte [eax + 0x38]
mov byte [0x480476], al
mov eax, dword [edi + 0x368]
mov al, byte [eax + 0x38]
mov byte [0x480475], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a093
lea eax, [ebp - 8]
call fcn.004040c0
ret