Function at 0x715d531f
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov al, byte [0x715d1e40]
push ebx
push esi
push edi
push 0x7f
mov byte [ebp - 0x420], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x41f]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ebx, ebx
push 0x715d1e24
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
stosb byte es:[edi], al
call fcn.715dd74c
pop ecx
lea eax, [ebp - 4]
pop ecx
push 0x715d18c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x18]
mov esi, 0x100
lea eax, [ebp - 0x11c]
push 1
push dword [ebp + 0x10]
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.715d5223
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
lea eax, [ebp - 0x11c]
push eax
push 0x715d1e10
call fcn.715dd74c
pop ecx
lea eax, [ebp - 0x11c]
pop ecx
push ebx
push 0x715d1dfc
push eax
push dword [ebp + 8]
call fcn.715d5e85
test eax, eax
je 0x715d540c
cmp word [0x715e4520], bx
je 0x715d540c
push ebx
push ebx
call sym.ADVPACK.dll_IsNTAdmin
test eax, eax
jne 0x715d540c
mov esi, dword [0x715e4522]
or byte [0x715e4522], 2
push ebx
push 0x10
push ebx
push ebx
push 0x48e
mov edi, 0x80004004
push dword [0x715e4534]
call fcn.715d6f11
mov word [0x715e4522], si
jmp 0x715d5a48
mov eax, dword [ebp + 0x18]
and eax, 1
mov dword [ebp - 0x1c], eax
je 0x715d544b
test byte [ebp + 0x18], 0x10
jne 0x715d544b
mov eax, dword [0x715e4530]
push esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715d6a1a
cmp eax, 2
jne 0x715d544b
mov edi, 0x800704c7
jmp 0x715d5a48
test byte [ebp + 0x19], 2
jne 0x715d5460
mov ax, word [0x715e4520]
push eax
call fcn.715d8c66
mov dword [ebp - 8], eax
push ebx
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push 0x715d1878
push eax
push dword [ebp + 8]
call fcn.715d5a82
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
push ebx
lea eax, [ebp - 0x11c]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.715d7a50
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715da050
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
mov eax, dword [ebp + 0x18]
and eax, 0x10
mov dword [ebp - 0x10], eax
jne 0x715d54d6
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715dd4f7
mov ecx, 0x80
xor eax, eax
test byte [ebp + 0x18], 0x40
lea edi, [ebp - 0x420]
rep stosd dword es:[edi], eax
je 0x715d55d6
push ebx
lea eax, [ebp - 0x524]
push 0x104
push eax
lea eax, [ebp - 0x11c]
push 0x715d15dc
push eax
mov byte [ebp - 0x524], bl
push dword [ebp + 8]
call fcn.715d5f40
cmp byte [ebp - 0x524], bl
je 0x715d55d6
lea eax, [ebp - 0x220]
push 0x715d15a8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.715e1804
lea eax, [ebp - 0x220]
push 0x715d1df0
push eax
call fcn.715e1804
lea eax, [ebp - 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x220]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x715d55d6
push ebx
push ebx
push ebx
lea eax, [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 0x420]
xor edi, edi
push eax
lea esi, [ebp - 0x420]
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0xc], 0x1ff
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x715d55cd
mov eax, dword [ebp + 0xc]
inc dword [ebp + 0x14]
push ebx
push ebx
lea edi, [edi + eax + 1]
lea esi, [esi + eax + 1]
mov eax, 0x1ff
push ebx
sub eax, edi
push ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 0x14]
jmp 0x715d559a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x420], bl
jne 0x715d5607
push ebx
lea eax, [ebp - 0x420]
push 0x200
push eax
lea eax, [ebp - 0x11c]
push 0x715d1de4
push eax
push dword [ebp + 8]
call fcn.715d5f40
cmp byte [ebp - 0x420], bl
je 0x715d5616
call fcn.715e10db
test eax, eax
jne 0x715d5616
mov byte [ebp - 0x420], bl
test byte [ebp + 0x18], 8
jne 0x715d5625
cmp dword [ebp - 0x10], ebx
je 0x715d56ac
cmp dword [ebp - 0x10], ebx
je 0x715d563e
push dword [ebp + 0x18]
lea eax, [ebp - 0x11c]
push ebx
push ebx
push eax
push dword [ebp + 8]
call fcn.715d80dc
push dword [ebp + 0x18]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x11c]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.715da7b2
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
cmp dword [ebp - 0x10], ebx
je 0x715d56ac
mov ax, word [0x715e4520]
push eax
push dword [ebp - 8]
call fcn.715d8ca2
push dword [ebp + 0x18]
mov esi, eax
lea eax, [ebp - 0x11c]
push 1
push esi
push eax
push dword [ebp + 8]
call fcn.715d80dc
cmp esi, ebx
je 0x715d5698
mov edi, 0xbc2
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715d82a6
jmp 0x715d5a48
cmp word [0x715e4520], 1
je 0x715d56ca
push dword [ebp + 0x18]
lea eax, [ebp - 0x11c]
push ebx
push ebx
push eax
push dword [ebp + 8]
call fcn.715d80dc
cmp byte [ebp - 0x420], bl
je 0x715d5744
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.715e1804
lea eax, [ebp - 0x220]
push ebx
push eax
call dword [0x715f1244]
mov edi, eax
push edi
push 0x715d1db0
call fcn.715dd74c
pop ecx
pop ecx
call fcn.715e1155
cmp edi, ebx
je 0x715d5739
cmp edi, 2
je 0x715d573e
test edi, 0x80000000
jne 0x715d5a48
cmp edi, ebx
jle 0x715d5a48
jmp 0x715d5863
cmp edi, 2
jne 0x715d5744
mov byte [ebp - 0x420], bl
lea eax, [ebp - 0x11c]
push eax
push 0x715d1d98
call fcn.715dd74c
pop ecx
lea eax, [ebp - 0x11c]
pop ecx
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.715d7794
mov edi, eax
lea eax, [ebp - 0x11c]
push edi
push eax
push 0x715d1d70
call fcn.715dd74c
add esp, 0xc
cmp edi, ebx
jl 0x715d5a48
mov ax, word [0x715e4520]
push eax
push dword [ebp - 8]
call fcn.715d8ca2
mov esi, eax
mov eax, dword [ebp + 0x18]
and eax, 4
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x14], eax
je 0x715d5817
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x715d57b5
cmp byte [eax], bl
je 0x715d57b5
push eax
jmp 0x715d57d9
push ebx
lea eax, [ebp - 4]
push 4
push eax
lea eax, [ebp - 0x11c]
push 0x715d18b8
push eax
push dword [ebp + 8]
call fcn.715d5f40
test eax, eax
jge 0x715d57e3
push 0x715d18c4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [ebp - 4]
cmp al, bl
je 0x715d5808
cmp al, 0x41
je 0x715d57ff
cmp al, 0x4e
je 0x715d57fa
cmp al, 0x61
je 0x715d57ff
cmp al, 0x6e
jne 0x715d5817
mov dword [ebp + 0xc], ebx
jmp 0x715d5817
mov dword [ebp + 0xc], 1
jmp 0x715d5817
lea eax, [ebp - 4]
push 0x715d18c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop edi
cmp word [0x715e4520], di
je 0x715d5874
cmp dword [ebp + 0xc], ebx
jne 0x715d5830
cmp esi, ebx
jne 0x715d5830
xor eax, eax
jmp 0x715d5832
mov eax, edi
push dword [ebp + 0x18]
push edi
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715d80dc
test eax, eax
jne 0x715d5874
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x715d585f
call esi
mov edi, eax
jmp 0x715d5a48
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x715d5a48
cmp dword [ebp + 0xc], ebx
jne 0x715d5881
cmp esi, ebx
jne 0x715d5881
xor eax, eax
jmp 0x715d5883
mov eax, edi
push eax
lea eax, [ebp - 0x11c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push 0x715d1890
push eax
push dword [ebp + 8]
call fcn.715d5a82
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715dc270
mov edi, eax
cmp edi, ebx
jl 0x715d5a48
test byte [ebp + 0x19], 4
mov esi, 0xbc2
jne 0x715d58d0
cmp edi, esi
jne 0x715d58d3
mov dword [ebp - 8], ebx
mov ax, word [0x715e4520]
push eax
push dword [ebp - 8]
call fcn.715d8ca2
mov dword [ebp + 0x10], eax
push ebx
lea eax, [ebp - 0x11c]
push 0x715d1d68
push eax
push dword [ebp + 8]
call fcn.715d5e85
test eax, eax
je 0x715d5905
mov dword [ebp + 0x10], 1
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x715d590e
mov edi, esi
cmp byte [ebp - 4], 0x69
je 0x715d591a
cmp byte [ebp - 4], 0x49
jne 0x715d591d
mov dword [ebp + 0xc], eax
cmp word [0x715e4520], 1
je 0x715d59c7
call fcn.715e1b83
test eax, eax
je 0x715d59c7
test byte [ebp + 0x18], 2
je 0x715d597c
cmp dword [ebp + 0xc], ebx
jne 0x715d597c
cmp dword [ebp + 0x10], ebx
jne 0x715d597c
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x715e4522]
and eax, 1
push eax
push 0x7530
lea eax, [ebp - 0x220]
push ebx
push eax
push 0x715d1d58
call fcn.715d8fd2
jmp 0x715d59c7
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x715d1d24
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x715d59c7
mov esi, 0x715d1d58
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push 0x715d1d1c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715d82a6
cmp dword [ebp - 0x1c], ebx
je 0x715d59ea
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715d6b49
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.715d831a
cmp dword [ebp + 0xc], ebx
je 0x715d5a48
cmp dword [ebp + 0x14], ebx
je 0x715d5a48
cmp byte [ebp - 3], 0x73
je 0x715d5a27
cmp byte [ebp - 3], 0x53
je 0x715d5a27
push 4
push 0x40
push ebx
push ebx
push 0x3ec
push dword [0x715e4534]
call fcn.715d6f11
jmp 0x715d5a2a
push 6
pop eax
cmp eax, 6
jne 0x715d5a48
cmp word [0x715e4520], bx
jne 0x715d5a43
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x715d5a48
call fcn.715d6513
test byte [ebp + 0x18], 1
je 0x715d5a56
mov eax, dword [ebp - 0x18]
mov dword [0x715e4530], eax
cmp byte [ebp - 0x420], bl
je 0x715d5a63
call fcn.715e1155
call fcn.715d530c
push edi
push dword [ebp + 8]
push 0x715d1cf0
call fcn.715dd74c
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18