Function at 0x40cd21
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4552d5
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x46ae30]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x46ae30]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
push 0x46df14
push ecx
mov ebx, 0xf003f
push ebx
push ecx
push ecx
push ecx
push str.Software_nuragoGacela2LoginControl
mov edi, SysReAllocString
push edi
mov dword [0x46df08], 0x45febc
mov dword [0x46df0c], ecx
mov dword [0x46df10], ecx
call esi
lea eax, [esp + 0x14]
push eax
push 0x46df18
push 0
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push str.Software_nuragoGacela2LoginState
push edi
call esi
push 7
xor eax, eax
pop esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
mov edi, str.LastActivity
cmp word [str.LastActivity], ax
je 0x40cddb
push edi
call fcn.0043aa35
pop ecx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.0040b068
mov dword [esp + 0x88], ebx
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
mov edi, str.Software_nuragoGacela2Login
cmp word [str.Software_nuragoGacela2Login], ax
jne 0x40ce0e
mov eax, ebx
jmp 0x40ce15
push edi
call fcn.0043aa35
pop ecx
push eax
push edi
lea ecx, [esp + 0x38]
call fcn.0040b068
lea eax, [esp + 0x18]
push ebx
push eax
lea edx, [esp + 0x38]
call fcn.0040d727
pop ecx
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x38]
call fcn.00401385
or dword [esp + 0x88], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.00401385
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
cmp word [str.ShowDialog], ax
jne 0x40ce6e
mov eax, ebx
jmp 0x40ce79
push str.ShowDialog
call fcn.0043aa35
pop ecx
push eax
push str.ShowDialog
lea ecx, [esp + 0x38]
call fcn.0040b068
mov dword [esp + 0x88], edi
xor eax, eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp word [str.Software_nuragoGacela2LoginControl], ax
jne 0x40ceab
mov eax, ebx
jmp 0x40ceb6
push str.Software_nuragoGacela2LoginControl
call fcn.0043aa35
pop ecx
push eax
push str.Software_nuragoGacela2LoginControl
lea ecx, [esp + 0x20]
call fcn.0040b068
lea eax, [esp + 0x30]
push ebx
push eax
lea edx, [esp + 0x20]
call fcn.0040d727
pop ecx
pop ecx
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.00401385
or dword [esp + 0x88], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x38]
call fcn.00401385
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
cmp word [str.ShowAbout], ax
jne 0x40cf10
mov eax, ebx
jmp 0x40cf1b
push str.ShowAbout
call fcn.0043aa35
pop ecx
push eax
push str.ShowAbout
lea ecx, [esp + 0x38]
call fcn.0040b068
mov dword [esp + 0x88], 2
xor eax, eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp word [str.Software_nuragoGacela2LoginControl], ax
jne 0x40cf51
mov eax, ebx
jmp 0x40cf5c
push str.Software_nuragoGacela2LoginControl
call fcn.0043aa35
pop ecx
push eax
push str.Software_nuragoGacela2LoginControl
lea ecx, [esp + 0x20]
call fcn.0040b068
lea eax, [esp + 0x30]
push ebx
push eax
lea edx, [esp + 0x20]
call fcn.0040d727
pop ecx
pop ecx
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.00401385
or dword [esp + 0x88], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x38]
call fcn.00401385
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
cmp word [str.PrivacymodeActive], ax
jne 0x40cfb6
mov eax, ebx
jmp 0x40cfc1
push str.PrivacymodeActive
call fcn.0043aa35
pop ecx
push eax
push str.PrivacymodeActive
lea ecx, [esp + 0x38]
call fcn.0040b068
mov dword [esp + 0x88], 3
xor eax, eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp word [str.Software_nuragoGacela2LoginState], ax
jne 0x40cff7
mov eax, ebx
jmp 0x40d002
push str.Software_nuragoGacela2LoginState
call fcn.0043aa35
pop ecx
push eax
push str.Software_nuragoGacela2LoginState
lea ecx, [esp + 0x20]
call fcn.0040b068
lea eax, [esp + 0x30]
push ebx
push eax
lea edx, [esp + 0x20]
call fcn.0040d727
pop ecx
pop ecx
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.00401385
or dword [esp + 0x88], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x38]
call fcn.00401385
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
cmp word [str.PrivateModeStarted], ax
jne 0x40d05c
mov eax, ebx
jmp 0x40d067
push str.PrivateModeStarted
call fcn.0043aa35
pop ecx
push eax
push str.PrivateModeStarted
lea ecx, [esp + 0x38]
call fcn.0040b068
mov dword [esp + 0x88], 4
xor eax, eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp word [str.Software_nuragoGacela2LoginState], ax
jne 0x40d09d
mov eax, ebx
jmp 0x40d0a8
push str.Software_nuragoGacela2LoginState
call fcn.0043aa35
pop ecx
push eax
push str.Software_nuragoGacela2LoginState
lea ecx, [esp + 0x20]
call fcn.0040b068
lea eax, [esp + 0x30]
push ebx
push eax
lea edx, [esp + 0x20]
call fcn.0040d727
pop ecx
pop ecx
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.00401385
or dword [esp + 0x88], 0xffffffff
push ebx
push edi
lea ecx, [esp + 0x38]
call fcn.00401385
xor eax, eax
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], ax
cmp word [str.LoggedinPerson], ax
jne 0x40d102
mov eax, ebx
jmp 0x40d10d
push str.LoggedinPerson
call fcn.0043aa35
pop ecx
push eax
push str.LoggedinPerson
lea ecx, [esp + 0x68]
call fcn.0040b068
mov dword [esp + 0x88], 5
xor eax, eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], ax
cmp word [str.Software_nuragoGacela2LoginState], ax
jne 0x40d143
mov eax, ebx
jmp 0x40d14e
push str.Software_nuragoGacela2LoginState
call fcn.0043aa35
pop ecx
push eax
push str.Software_nuragoGacela2LoginState
lea ecx, [esp + 0x50]
call fcn.0040b068
lea eax, [esp + 0x60]
push 0x62
push eax
lea edx, [esp + 0x50]
call fcn.0040d727
pop ecx
pop ecx
push ebx
push edi
lea ecx, [esp + 0x50]
call fcn.00401385
push ebx
push edi
lea ecx, [esp + 0x68]
call fcn.00401385
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x40d24e
push ebx
push ebx
mov dword [0x46df24], eax
call esi
push ebx
push ebx
push ebx
push 0x40d477
push ebx
push ebx
mov dword [0x46df1c], eax
call esi
mov dword [0x46df20], eax
mov eax, 0x46df08
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00437d2f
mov esp, ebp
pop ebp
ret