Function at 0x40e300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x415566
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [esp + 0x28], 0
mov edi, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x240], edi
call fcn.00413970
lea ecx, [esp + 0xc]
mov byte [esp + 0x240], 2
call fcn.00413970
lea ecx, [esp + 0x1c]
mov byte [esp + 0x240], 3
call fcn.00413970
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], 4
call fcn.00413970
lea ecx, [esp + 0x20]
mov byte [esp + 0x240], 5
call fcn.00413970
lea ecx, [esp + 0x24]
mov byte [esp + 0x240], 6
call fcn.00413970
lea eax, [esp + 0x30]
push 0x104
mov bl, 7
push eax
push 0
mov byte [esp + 0x24c], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x10]
push ecx
push 0x41b170
push edx
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x5c
call sub.MFC42u.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x30]
push 0x41b030
push ecx
mov byte [esp + 0x24c], 8
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x244], 9
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x240], 8
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], bl
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0xc]
push str.LogAction.dat
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x244], 0xa
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
push str.Backup
lea edx, [esp + 0x18]
push ecx
push edx
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x244], 0xb
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], bl
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0xc]
push str.BackupFiles
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x244], 0xc
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], bl
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0xc]
push str.BackupRegs.reg
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x244], 0xd
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x24c]
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
push str.Folder
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40e537
mov esi, dword [esp + 0x248]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00413b2c
mov dword [esp + 0x28], edi
jmp 0x40e5c1
mov eax, dword [esp + 0x24c]
push str.File
push eax
call esi
add esp, 8
test eax, eax
jne 0x40e554
lea ecx, [esp + 0x1c]
push ecx
jmp 0x40e5af
mov edx, dword [esp + 0x24c]
push str.BakFile
push edx
call esi
add esp, 8
test eax, eax
jne 0x40e571
lea eax, [esp + 0x18]
push eax
jmp 0x40e5af
mov ecx, dword [esp + 0x24c]
push str.BakReg
push ecx
call esi
add esp, 8
test eax, eax
jne 0x40e58d
lea edx, [esp + 0x20]
jmp 0x40e5ae
mov eax, dword [esp + 0x24c]
push 0x41b778
push eax
call esi
add esp, 8
test eax, eax
jne 0x40e5aa
lea ecx, [esp + 0x24]
push ecx
jmp 0x40e5af
lea edx, [esp + 0x10]
push edx
mov esi, dword [esp + 0x24c]
mov ecx, esi
call fcn.00413b2c
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x24]
mov byte [esp + 0x240], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x240], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x240], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x240], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24c]
mov byte [esp + 0x240], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x238]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x238
ret 8