Function at 0x41a630
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042d0
xor eax, eax
push ebp
push 0x41a973
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x41a98c
call fcn.0040422c
jne 0x41a71a
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x41a9a0
mov edx, 0x41a9b8
mov eax, 0x80000002
call fcn.00409354
mov eax, dword [ebp - 0x10]
call fcn.004042e0
mov edx, eax
lea eax, [ebp - 0x118]
call fcn.00403200
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x18]
call fcn.00404068
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x41aa04
call fcn.0040412c
push 0x41aa10
push dword [ebp - 0x10]
push 0x41aa28
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 0x10]
call fcn.0040f13c
push dword [ebp - 0x11c]
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004041a0
jmp 0x41a938
mov eax, dword [ebp - 4]
mov edx, 0x41aa34
call fcn.0040422c
jne 0x41a7b1
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x41aa4c
mov edx, 0x41a9b8
mov eax, 0x80000001
call fcn.00409354
mov eax, dword [ebp - 0x10]
call fcn.004042e0
mov edx, eax
lea eax, [ebp - 0x118]
call fcn.00403200
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x120]
call fcn.00404068
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x10]
mov ecx, 0x41aa04
call fcn.0040412c
push 0x41aa10
push dword [ebp - 0x10]
push 0x41aa28
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x10]
call fcn.0040f13c
push dword [ebp - 0x124]
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004041a0
jmp 0x41a938
mov eax, dword [ebp - 8]
mov edx, 0x41aa5c
call fcn.00403e58
mov dl, 1
mov eax, dword [0x407610]
call fcn.004076e4
mov edi, eax
mov dl, 1
mov eax, dword [0x407468]
call fcn.004074d0
mov esi, eax
jmp 0x41a923
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x41aa28
call fcn.004043c8
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404340
mov eax, dword [ebp - 0x10]
call fcn.00408758
mov edx, eax
mov eax, edi
call fcn.00407784
mov edx, dword [ebp - 4]
mov eax, 0x41aa28
call fcn.004043c8
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.00404380
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x41aa28
call fcn.004043c8
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404340
mov edx, dword [ebp - 4]
mov eax, 0x41aa28
call fcn.004043c8
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.00404380
lea eax, [ebp - 0x128]
mov ecx, 0x41aa04
mov edx, dword [ebp - 0xc]
call fcn.0040412c
mov edx, dword [ebp - 0x128]
xor ecx, ecx
mov eax, edi
call fcn.0040789c
test al, al
je 0x41a923
mov eax, esi
call fcn.0040751c
mov edx, esi
mov eax, edi
call fcn.00407ca0
mov eax, dword [esi + 8]
dec eax
test eax, eax
jl 0x41a91c
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 8]
push dword [eax]
lea ecx, [ebp - 0x12c]
mov edx, ebx
mov eax, esi
call fcn.004075bc
push dword [ebp - 0x12c]
push 0x41aa28
lea ecx, [ebp - 0x134]
mov edx, ebx
mov eax, esi
call fcn.004075bc
mov edx, dword [ebp - 0x134]
lea ecx, [ebp - 0x130]
mov eax, edi
call fcn.00407e04
push dword [ebp - 0x130]
push 0x41aa28
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0x41aa28
mov eax, dword [ebp - 8]
mov edx, 8
call fcn.004041a0
inc ebx
dec dword [ebp - 0x14]
jne 0x41a8b2
mov eax, edi
call fcn.00407754
mov edx, dword [ebp - 4]
mov eax, 0x41aa28
call fcn.004043c8
test eax, eax
jg 0x41a7df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a97a
lea eax, [ebp - 0x134]
mov edx, 7
call fcn.00403e28
lea eax, [ebp - 0x18]
call fcn.00403e04
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403e28
lea eax, [ebp - 4]
call fcn.00403e04
ret