Function at 0x513468
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5137ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x458670]
call fcn.00458770
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5137b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00458810
mov cl, 1
mov edx, 0x5137e4
mov eax, dword [ebp - 4]
call fcn.00458954
test al, al
je 0x5136be
mov ecx, dword [0x536080]
mov cl, byte [ecx]
mov edx, 0x513824
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535fb0]
mov cl, byte [ecx]
mov edx, 0x513838
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535fdc]
mov cl, byte [ecx]
mov edx, 0x51384c
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535c90]
mov cl, byte [ecx]
mov edx, 0x513860
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535fc4]
mov ecx, dword [ecx]
mov edx, 0x513878
mov eax, dword [ebp - 4]
call fcn.00458f68
mov ecx, dword [0x535f0c]
mov ecx, dword [ecx]
mov edx, 0x513888
mov eax, dword [ebp - 4]
call fcn.00458f68
mov ecx, dword [0x535f3c]
mov ecx, dword [ecx]
mov edx, 0x513898
mov eax, dword [ebp - 4]
call fcn.00458f68
mov cl, byte [0x535aa0]
mov edx, 0x5138a8
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535c0c]
mov cl, byte [ecx]
mov edx, 0x5138c0
mov eax, dword [ebp - 4]
call fcn.00459050
mov cl, byte [0x535ac0]
mov edx, 0x5138d4
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535b44]
mov cl, byte [ecx]
mov edx, 0x5138e8
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x536314]
mov cl, byte [ecx]
mov edx, 0x513904
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535bac]
mov cl, byte [ecx]
mov edx, 0x513918
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x53615c]
mov cl, byte [ecx]
mov edx, 0x513934
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535bb8]
mov cl, byte [ecx]
mov edx, 0x51394c
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535f20]
mov cl, byte [ecx]
mov edx, 0x513960
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535eac]
mov ecx, dword [ecx]
mov edx, 0x513970
mov eax, dword [ebp - 4]
call fcn.0045900c
mov ecx, dword [0x535e44]
mov ecx, dword [ecx]
mov edx, 0x51398c
mov eax, dword [ebp - 4]
call fcn.00458f68
mov ecx, dword [0x535c5c]
mov cl, byte [ecx]
mov edx, 0x5139a0
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535c38]
mov cl, byte [ecx]
mov edx, 0x5139bc
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535b58]
mov ecx, dword [ecx]
mov edx, 0x5139d8
mov eax, dword [ebp - 4]
call fcn.0045900c
mov ecx, dword [0x5361dc]
mov cl, byte [ecx]
mov edx, 0x5139f0
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x536018]
mov ecx, dword [ecx]
mov edx, 0x513a0c
mov eax, dword [ebp - 4]
call fcn.0045900c
mov ecx, dword [0x5361fc]
mov cl, byte [ecx]
mov edx, 0x513a24
mov eax, dword [ebp - 4]
call fcn.00459050
mov eax, dword [ebp - 4]
call fcn.004587e0
mov cl, 1
mov edx, 0x513a40
mov eax, dword [ebp - 4]
call fcn.00458954
test al, al
je 0x513793
mov edx, 0x513a78
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x5136f3
mov edx, 0x513a78
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x513a94
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x513711
mov edx, 0x513a94
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x513ab0
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x51372f
mov edx, 0x513ab0
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x513acc
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x51374d
mov edx, 0x513acc
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x513ae8
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x51376b
mov edx, 0x513ae8
mov eax, dword [ebp - 4]
call fcn.00458cd8
cmp byte [0x535aa0], 0
je 0x513793
lea edx, [ebp - 8]
mov eax, dword [0x536040]
mov eax, dword [eax]
call fcn.00450c28
mov ecx, dword [ebp - 8]
mov edx, 0x513ae8
mov eax, dword [ebp - 4]
call fcn.00458f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5137b8
mov eax, dword [ebp - 4]
call fcn.004587e0
mov eax, dword [ebp - 4]
call fcn.004030bc
ret