Function at 0x13150c50
Capabilities:
Delete file
Delete registry key
Delete registry value
Persist via winlogon helper dll registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
mov dword [esp + 0x14], edx
mov byte [esp + 0x13], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, 0x131fc4a0
mov edi, eax
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x13150c85
sub esi, eax
lea eax, [esi - 1]
test eax, eax
je 0x13150cbd
cmp byte [eax + 0x131fc4a0], 0x5c
je 0x13150ca5
sub eax, 1
jne 0x13150c95
jmp 0x13150cbd
sub esi, eax
lea eax, [eax + 0x131fc4a1]
inc esi
push esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1319b500
add esp, 0xc
mov esi, 0xa
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.13150b90
sub esi, 1
jne 0x13150cc2
push 0x131fb930
push 0x13c26ab8
lea eax, [esp + 0x220]
push str._s_s
push eax
call fcn.13141a40
add esp, 0x10
mov ecx, 0x131da780
mov eax, 0x131fcaa4
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x13150d20
test dl, dl
je 0x13150d1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x13150d20
add eax, 2
add ecx, 2
test dl, dl
jne 0x13150d00
xor eax, eax
jmp 0x13150d25
sbb eax, eax
or eax, 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x13150d68
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
call edi
test eax, eax
jne 0x13150d62
push 0x131fc238
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
mov ecx, 0x131da79c
mov eax, 0x131fcaa4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x13150d92
test dl, dl
je 0x13150d8e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x13150d92
add eax, 2
add ecx, 2
test dl, dl
jne 0x13150d72
xor eax, eax
jmp 0x13150d97
sbb eax, eax
or eax, 1
test eax, eax
jne 0x13150dc8
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push closesocket
call edi
test eax, eax
jne 0x13150dc2
push str.shell
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
mov ecx, 0x131da798
mov eax, 0x131fcaa4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x13150df2
test dl, dl
je 0x13150dee
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x13150df2
add eax, 2
add ecx, 2
test dl, dl
jne 0x13150dd2
xor eax, eax
jmp 0x13150df7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x13150e28
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push closesocket
call edi
test eax, eax
jne 0x13150e22
push str.Load
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push 0x13bfd748
push closesocket
call edi
test eax, eax
jne 0x13150e4f
push str.ASCR
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push 0x13bfd748
push closesocket
call edi
test eax, eax
jne 0x13150e7c
push str.ACAM
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push 0x13bfd748
push closesocket
call edi
test eax, eax
jne 0x13150ea9
push 0x131fc7d8
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push 0x13bfd748
push closesocket
call edi
test eax, eax
jne 0x13150ed6
push 0x131fe3f8
push dword [esp + 0x10]
call esi
push dword [esp + 0xc]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x218]
push eax
call esi
push 0x131fbed0
call esi
push 0x131fdb20
call esi
xor edx, edx
mov ecx, 0x13c24fa0
call fcn.13150b90
push 0x13bfd338
call esi
call fcn.13150af0
push 0x13bfd748
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push dword [0x131fe870]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 1
jne 0x13150f4c
push 1
push 0
push 0x131da42a
push dword [esp + 0x20]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]