Function at 0x6152bc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x6152c4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6155e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
xor edx, edx
call fcn.00481c70
mov eax, dword [0x6b2568]
call fcn.004d26b0
lea edx, [ebp - 8]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c8]
call fcn.004a753c
mov eax, dword [ebp - 8]
mov edx, 0x6155fc
call fcn.00408384
je 0x61538f
mov eax, dword [0x6aabbc]
cmp dword [eax], 0xffffffff
jne 0x61534e
mov eax, dword [0x6ab19c]
mov eax, dword [eax]
xor edx, edx
call fcn.00625c80
mov edx, eax
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x5e0]
mov ecx, dword [eax]
call dword [ecx + 0xf0]
jmp 0x615373
mov eax, dword [0x6aabbc]
mov eax, dword [eax]
xor edx, edx
call fcn.00625c80
mov edx, eax
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x5e0]
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063a2c8
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0063a9ac
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0062f3f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x6153c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
jne 0x6153fa
xor eax, eax
push ebp
push 0x6153f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x615620
mov edx, 0x615638
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6153fa
lea edx, [ebp - 0xc]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x444]
call fcn.004a753c
mov edx, dword [ebp - 0xc]
mov eax, dword [0x6aaa7c]
call fcn.00408384
jne 0x61551f
lea edx, [ebp - 0x10]
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov eax, dword [eax + 0x5bc]
call fcn.004a753c
mov eax, dword [ebp - 0x10]
mov edx, 0x6156a4
call fcn.00408384
jne 0x61551f
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov edx, 0x6156b8
call fcn.004a7574
xor eax, eax
push ebp
push 0x61548e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x615620
mov edx, 0x615638
mov eax, 0x80000002
call fcn.00627864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x615582
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov edx, 0x61577c
call fcn.004a7574
mov eax, 0x6157b0
call fcn.00626d98
test al, al
jne 0x61554c
mov eax, 0x6157dc
call fcn.00626d98
test al, al
jne 0x615582
xor eax, eax
push ebp
push 0x615578
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x615620
mov edx, 0x615638
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x615582
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
mov eax, dword [eax + 0x38c]
mov edx, 0x6157f4
call fcn.004a7574
mov eax, dword [0x6aafd8]
mov eax, dword [eax]
call fcn.004d26b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6155e7
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00407c94
lea eax, [ebp - 0x30]
mov edx, dword [0x4012a8]
mov ecx, 2
call fcn.00408b38
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00407c94
ret