Function at 0x61f548
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61f865
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x310]
mov eax, 0x61f880
call fcn.004322a8
mov edx, dword [ebp - 0x310]
lea eax, [ebp - 0xc]
mov ecx, 0x61f89c
call fcn.0040b1fc
lea eax, [ebp - 0x314]
mov ecx, dword [0x63a90c]
mov edx, dword [ebp - 0xc]
call fcn.0040b1fc
mov eax, dword [ebp - 0x314]
mov dl, 1
call fcn.0042752c
test al, al
je 0x61f5fb
lea eax, [ebp - 0x318]
mov ecx, dword [0x63a90c]
mov edx, dword [ebp - 0xc]
call fcn.0040b1fc
mov eax, dword [ebp - 0x318]
call fcn.00427880
lea eax, [ebp - 0x31c]
mov ecx, dword [0x63a910]
mov edx, dword [ebp - 0xc]
call fcn.0040b1fc
mov eax, dword [ebp - 0x31c]
mov dl, 1
call fcn.0042752c
test al, al
je 0x61f63f
lea eax, [ebp - 0x320]
mov ecx, dword [0x63a910]
mov edx, dword [ebp - 0xc]
call fcn.0040b1fc
mov eax, dword [ebp - 0x320]
call fcn.00427880
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
mov edx, 0x61f8ac
mov eax, dword [ebp - 0xc]
call fcn.00503a38
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x61f6b4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x61f66b
cmp edx, dword [ecx - 4]
jb 0x61f670
call fcn.004081f4
mov edx, dword [ecx + edx*4]
call fcn.0040a8b8
xor eax, eax
push ebp
push 0x61f698
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00427880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61f6b1
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x61f6c9
mov eax, dword [ebp - 0x28]
mov eax, dword [eax - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jl 0x61f659
lea eax, [ebp - 0x18]
mov edx, dword [0x41216c]
call fcn.0040d5d8
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x61f8ac
mov eax, dword [ebp - 0xc]
call fcn.00503a08
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x61f756
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x61f70b
cmp edx, dword [ecx - 4]
jb 0x61f710
call fcn.004081f4
mov edx, dword [ecx + edx*4]
call fcn.0040a8b8
xor eax, eax
push ebp
push 0x61f73a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.00502f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61f753
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x61f76b
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax - 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jl 0x61f6f9
lea eax, [ebp - 0x20]
mov edx, dword [0x41216c]
call fcn.0040d5d8
mov dl, 1
mov eax, dword [0x504ca0]
call fcn.00505fec
mov dword [ebp - 8], eax
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.005060d4
xor ecx, ecx
mov edx, 0x61f8c4
mov eax, dword [ebp - 8]
call fcn.00506230
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0050671c
mov eax, dword [ebp - 8]
call fcn.005060a4
mov eax, dword [ebp - 8]
call fcn.004085e8
push 0x32
call sub.kernel32.dll_Sleep
mov dl, 1
mov eax, dword [0x504ca0]
call fcn.00505fec
mov dword [ebp - 8], eax
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.005060d4
xor ecx, ecx
mov edx, 0x61f8c4
mov eax, dword [ebp - 8]
call fcn.00506230
mov edx, dword [0x63a908]
mov eax, dword [ebp - 8]
call fcn.0050671c
mov eax, dword [ebp - 8]
call fcn.005060a4
mov eax, dword [ebp - 8]
call fcn.004085e8
call fcn.0040a1b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f86c
lea eax, [ebp - 0x320]
mov edx, 5
call fcn.0040a4e0
lea eax, [ebp - 0x20]
mov edx, dword [0x41216c]
call fcn.0040d5d8
lea eax, [ebp - 0x18]
mov edx, dword [0x41216c]
call fcn.0040d5d8
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a4e0
pop eax
jmp eax