Function at 0x4109b1
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x42e0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThread]
mov dword [0x4365e0], eax
call fcn.0040e2af
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 0x20019
push ebx
push 0x402528
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x41e9c5
lea eax, [ebp - 0x19]
mov byte [0x42e57c], 1
mov edx, 0x43a7e0
mov dword [0x42e574], eax
call fcn.00411f5b
dec eax
neg eax
sbb al, al
and byte [0x42e57c], al
call fcn.00411f1a
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004087ca
cmp dword [ebp - 0x20], 1
je 0x41e9f5
mov edi, 0xff
test eax, eax
je 0x41ea58
push ebx
push 0x440a30
call fcn.00417fb1
pop ecx
pop ecx
mov ecx, dword [0x436758]
test eax, eax
jne 0x41ea1c
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x410ac5
mov esi, ebx
mov edx, dword [ebp + esi*4 - 0x14]
test edx, edx
jne 0x410ae0
inc esi
cmp esi, 3
jl 0x410a90
call fcn.0040e310
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
push 0x43c9f0
push eax
mov dword [0x4325a0], eax
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCPInfo]
call fcn.0040e2af
mov ecx, dword [0x436758]
test ecx, ecx
je 0x41ea52
push ebx
call fcn.00411e70
test eax, eax
je 0x410acd
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll_exit]
push dword [0x436778]
xor ecx, ecx
inc ecx
call fcn.0040c570
cmp eax, 1
je 0x41ea41
cmp eax, 0xffffffff
je 0x41ea32
mov edx, eax
xor ecx, ecx
call fcn.0040e470
test eax, eax
je 0x410a98
mov dword [ebp - 0x18], eax
jmp 0x410a98
or byte [ebx - 0x7d7487af], cl
loopne 0x41ea0b
add byte [eax], al
or eax, 0x200
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x78]
mov dword [edx + 0xee0], eax
and al, 0xe
add byte [eax], al
mov al, 1
jmp 0x41eb14
mov edx, dword [ecx]
movzx eax, byte [edx]
test eax, eax
je 0x41ea30
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x34], 0
jne 0x41ea52
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
movzx eax, byte [edx]
or byte [ebx + 0xf118b08], cl
mov dh, 2
test eax, eax
jne 0x41ea49
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x34], 0
je 0x41ea52
mov dword [ebp - 8], 0
jmp 0x41ea59
mov dword [ebp - 8], 1
add byte [edx + 0x4588f845], cl
dec dword [edi]
mov dh, 0x4d
inc dword [ebp - 0x74ef8b37]
push ebp
or byte [ebx + 0x51088b02], cl
mov al, byte [ebp - 8]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x41ea77
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.004199f0
add esp, 4
mov edx, dword [ebp + 8]
add edx, 0x20
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call fcn.00419b90
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x41eaa9
xor al, al
jmp 0x41eb14
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41eac1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call fcn.004199a0
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp dword [edx + 0x34], 0
je 0x41ead2
mov byte [ebp - 2], 1
jmp 0x41ead6
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ecx, dword [ecx]
add ecx, 0xe0
mov edx, dword [edx + 0x2c]
call fcn.00417a6f
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ecx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
adc eax, dword [ecx + 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x24], eax
mov al, 1
mov esp, ebp
pop ebp
ret