Function at 0x715d85a6
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
push 1
pop eax
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp + 0x10], esi
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], esi
stosd dword es:[edi], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov eax, 0x715d2240
jne 0x715d85e7
mov eax, 0x715d2234
mov ebx, dword [ebp + 8]
push eax
push dword [ebx]
push 0x715d2220
call fcn.715dd74c
mov eax, dword [ebx + 4]
add esp, 0xc
cmp eax, esi
je 0x715d863b
cmp byte [eax], 0
je 0x715d863b
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push 0x49
push eax
call esi
push eax
call fcn.715e1cce
test eax, eax
je 0x715d8902
push 0x4e
mov dword [ebp - 0x1c], 1
push dword [ebx + 4]
call esi
push eax
call fcn.715e1cce
test eax, eax
je 0x715d863b
and dword [ebp - 0x20], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, 0x400
push edi
push 0x40
call esi
push edi
push 0x40
mov dword [ebp - 8], eax
call esi
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
je 0x715d8908
xor esi, esi
cmp eax, esi
je 0x715d890a
cmp dword [ebp + 0xc], esi
je 0x715d87ee
mov eax, dword [ebx]
cmp byte [eax], 0x40
je 0x715d8922
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx]
push 0x715d221c
lea eax, [eax + ecx - 3]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x715d86f7
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp + 0x10], 0x715d2210
jne 0x715d86b0
mov dword [ebp + 0x10], 0x715d2200
push dword [ebx]
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push 0xffffffffffffffff
push edi
push edi
push esi
call fcn.715d8fd2
cmp eax, 0x80004005
push esi
jne 0x715d86ed
push 0x715d21e8
call fcn.715dd74c
pop ecx
mov dword [ebp - 4], edi
pop ecx
jmp 0x715d8922
push 0x715d21d4
jmp 0x715d87e2
push dword [ebx]
push 0x715d21c0
call fcn.715dd74c
pop ecx
xor esi, esi
pop ecx
push 8
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x715d891f
cmp dword [ebp + 0x10], esi
mov edi, 0x715d1cb0
je 0x715d8787
cmp dword [ebp - 0x20], esi
je 0x715d8750
push dword [ebp + 0x10]
push eax
call fcn.715d8514
mov dword [ebp - 4], eax
cmp eax, esi
mov eax, 0x715d21b4
jne 0x715d8743
mov eax, edi
push eax
push 0x715d2198
call fcn.715dd74c
pop ecx
pop ecx
cmp dword [ebp - 4], esi
je 0x715d8922
cmp dword [ebp - 0x1c], 0
je 0x715d8922
push dword [ebx + 8]
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call fcn.715d8545
mov dword [ebp - 4], eax
test eax, eax
mov eax, 0x715d21b4
jne 0x715d877f
mov eax, edi
push eax
push 0x715d2178
jmp 0x715d87e2
cmp dword [ebp - 0x1c], esi
je 0x715d87b1
push dword [ebx + 8]
push esi
push eax
call fcn.715d8545
mov dword [ebp - 4], eax
cmp eax, esi
mov eax, 0x715d21b4
jne 0x715d87a4
mov eax, edi
push eax
push 0x715d215c
call fcn.715dd74c
pop ecx
pop ecx
cmp dword [ebp - 4], esi
je 0x715d8922
cmp dword [ebp - 0x20], 0
je 0x715d8922
push 0
push dword [ebp - 0x14]
call fcn.715d8514
mov dword [ebp - 4], eax
test eax, eax
mov eax, 0x715d21b4
jne 0x715d87dc
mov eax, edi
push eax
push 0x715d213c
call fcn.715dd74c
pop ecx
pop ecx
jmp 0x715d8922
cmp dword [0x715e4a98], esi
jne 0x715d8813
call fcn.715d833f
test eax, eax
je 0x715d8813
mov dword [0x715e4a98], 0x31f
mov dword [0x715e4a94], 1
cmp dword [0x715e4a94], esi
jne 0x715d882f
mov eax, dword [ebx]
cmp byte [eax], 0x40
je 0x715d8922
mov eax, 0x715d1d24
xor esi, esi
jmp 0x715d8834
mov eax, 0x715d1eb8
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x2001f
push esi
push esi
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x715d891f
cmp dword [0x715e4a94], esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x715d8899
cmp dword [ebp + 0x14], esi
jne 0x715d8882
lea eax, [ebp - 0x12c]
push 0x715e4a98
push eax
push dword [ebp - 0xc]
call fcn.715d846e
jmp 0x715d8899
push dword [0x715e4a98]
lea eax, [ebp - 0x12c]
push 0x715d1eb4
push eax
call edi
add esp, 0xc
cmp dword [0x715e4a94], esi
je 0x715d8a0d
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x2001f
push esi
push esi
lea eax, [ebp - 0x12c]
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x715d891f
mov eax, dword [ebx]
cmp byte [eax], 0x40
jne 0x715d897e
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebx]
call esi
push eax
lea eax, [ebp - 0x12c]
push 1
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x715d8922
and dword [ebp - 4], 0
jmp 0x715d8922
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x44e
push dword [0x715e4534]
call fcn.715d6f11
mov dword [ebp - 4], esi
xor edi, edi
cmp dword [ebp - 0x14], edi
je 0x715d8932
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x18], edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x715d8942
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0xc], edi
je 0x715d894c
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], edi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x715d895c
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], edi
je 0x715d8966
push dword [ebp - 0x10]
call esi
push dword [ebx]
push 0x715d2124
call fcn.715dd74c
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x12c]
push eax
push 0x715d1eac
push dword [ebp - 0x18]
call fcn.715d84df
cmp dword [ebp - 0x20], esi
je 0x715d89b9
cmp dword [ebp + 0x10], esi
mov eax, 0x715d209c
jne 0x715d89a9
mov eax, 0x715d2088
push eax
push dword [ebx]
push 0x715d211c
push dword [ebp - 8]
call edi
add esp, 0x10
cmp dword [ebp - 0x1c], esi
je 0x715d89ec
mov eax, dword [ebx + 8]
cmp eax, esi
jne 0x715d89ca
mov eax, 0x715d1e40
push eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and al, 0xf4
add eax, 0x75
push eax
push 0x715d20b0
push dword [ebx]
push 0x715d2110
push dword [ebp - 0x10]
call edi
add esp, 0x18
cmp dword [ebp + 0x10], esi
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
je 0x715d8a02
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
jmp 0x715d8a5a
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
jmp 0x715d8a5a
push dword [ebp + 0x14]
lea eax, [ebp - 0x12c]
push eax
push 0x715d1e80
push dword [ebp - 0xc]
call fcn.715d84df
mov eax, dword [ebx + 8]
mov esi, 0x715d1e40
test eax, eax
jne 0x715d8a32
mov eax, esi
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x715d8a3b
mov ecx, esi
push eax
push ecx
push dword [ebx]
push 0x715d20e0
push dword [ebp - 8]
call edi
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
add esp, 0x14
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
xor esi, esi
lea eax, [ebp - 0x28]
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
cmp byte [esi], 0
je 0x715d8ac3
lea eax, [ebp - 0x12c]
push esi
push eax
push 0x715d20bc
call fcn.715dd74c
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
lea eax, [ebp - 0x12c]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x715d8902
cmp dword [0x715e4a94], eax
je 0x715d8ac3
push dword [ebp + 0x14]
lea eax, [ebp - 0x12c]
push eax
push 0x715d1eac
push edi
call fcn.715d84df
inc dword [ebp + 8]
add dword [ebp + 0x10], 4
cmp dword [ebp + 8], 2
jl 0x715d8a63
jmp 0x715d8922