Function at 0x53673c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x536744
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x537271
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x472da8]
call fcn.00472ea8
mov dword [ebp - 4], eax
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00472f48
xor ecx, ecx
mov edx, 0x537288
mov eax, dword [ebp - 4]
call fcn.0047308c
xor eax, eax
push ebp
push 0x5367d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x544dd8]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x5372c0
call fcn.00405368
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047360c
cmp dword [ebp - 8], 0
setne al
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 7], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5367de
mov eax, dword [ebp - 4]
call fcn.00472f18
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00472f48
xor ecx, ecx
mov edx, 0x537288
mov eax, dword [ebp - 4]
call fcn.0047308c
xor eax, eax
push ebp
push 0x536861
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp byte [eax + 7], 0
jne 0x53684a
mov ecx, 0x5372c0
mov edx, dword [0x544dd8]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
call fcn.00405368
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0047360c
cmp dword [ebp - 0x10], 0
jne 0x53684a
xor eax, eax
jmp 0x53684c
mov al, 1
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 7], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53686b
mov eax, dword [ebp - 4]
call fcn.00472f18
mov eax, dword [ebp - 4]
call fcn.004041d0
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov byte [eax + 0x20], 1
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov byte [eax + 4], 1
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov byte [eax + 5], 1
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov byte [eax + 6], 0
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov dword [eax + 0x10], 0x3c
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 8
mov edx, 0x5372cc
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov dword [eax + 0xc], 0x1f9a
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov dword [eax + 0x24], 0x1f9b
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov dword [eax + 0x28], 0x1f9b
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov dword [eax + 0x2c], 0x2383
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov byte [eax + 0x21], 0
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x38
mov edx, 0x5372e0
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x3c
call fcn.0040505c
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x40
mov edx, 0x537304
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x44
call fcn.0040505c
lea eax, [ebp - 0x18]
call fcn.00532a68
mov edx, dword [ebp - 0x18]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x18
call fcn.004050b0
lea eax, [ebp - 0x1c]
call fcn.0049eea8
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x1c
call fcn.004050b0
cmp byte [0x5442c4], 0
je 0x5369ac
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x18
mov edx, dword [0x5457b0]
mov edx, dword [edx]
mov edx, dword [edx + 0x364]
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 0x18], 0
jne 0x5369d3
lea eax, [ebp - 0x20]
call fcn.00532ad4
mov edx, dword [ebp - 0x20]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x18
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 0x18], 0
jne 0x5369f4
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x18
mov edx, 0x537310
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 0x1c], 0
jne 0x536a15
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x1c
mov edx, 0x537310
call fcn.004050b0
mov dl, 1
mov eax, dword [0x472da8]
call fcn.00472ea8
mov dword [ebp - 4], eax
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00472f48
mov edx, dword [0x545680]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00473860
test al, al
je 0x536dd3
mov edx, dword [0x545680]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004731b0
xor eax, eax
push ebp
push 0x536a89
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537320
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 0x20], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536a93
xor eax, eax
push ebp
push 0x536ac3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537338
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 4], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536acd
xor eax, eax
push ebp
push 0x536afd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x53734c
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536b07
xor eax, eax
push ebp
push 0x536b37
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537360
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 6], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536b41
xor eax, eax
push ebp
push 0x536b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537370
mov eax, dword [ebp - 4]
call fcn.00473698
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov dword [edx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536b7b
xor eax, eax
push ebp
push 0x536bb5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x24]
mov edx, 0x537380
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x24]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x30
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536bbf
xor eax, eax
push ebp
push 0x536bf9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x28]
mov edx, 0x537394
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x28]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 8
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536c03
xor eax, eax
push ebp
push 0x536c33
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5373a4
mov eax, dword [ebp - 4]
call fcn.00473698
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov dword [edx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536c3d
xor eax, eax
push ebp
push 0x536c6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5373b4
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 0x21], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536c77
xor eax, eax
push ebp
push 0x536cb1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x2c]
mov edx, 0x5373c4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x14
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536cbb
xor eax, eax
push ebp
push 0x536cf5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x30]
mov edx, 0x5373d4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x30]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x38
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536cff
xor eax, eax
push ebp
push 0x536d39
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x34]
mov edx, 0x5373e4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x34]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x3c
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536d43
xor eax, eax
push ebp
push 0x536d7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x38]
mov edx, 0x5373f4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x38]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x40
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536d87
xor eax, eax
push ebp
push 0x536dc1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x3c]
mov edx, 0x537408
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x44
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536dcb
mov eax, dword [ebp - 4]
call fcn.00472f18
mov eax, dword [ebp - 4]
call fcn.004041d0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp byte [eax + 0x20], 0
je 0x5371b2
mov dl, 1
mov eax, dword [0x472da8]
call fcn.00472ea8
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00472f48
mov edx, dword [0x545680]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00473860
test al, al
je 0x5371aa
mov edx, dword [0x545680]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004731b0
xor eax, eax
push ebp
push 0x536e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537320
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 0x20], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536e6a
xor eax, eax
push ebp
push 0x536e9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537338
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 4], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536ea4
xor eax, eax
push ebp
push 0x536ed4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x53734c
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536ede
xor eax, eax
push ebp
push 0x536f0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537360
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 6], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536f18
xor eax, eax
push ebp
push 0x536f48
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x537370
mov eax, dword [ebp - 4]
call fcn.00473698
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov dword [edx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536f52
xor eax, eax
push ebp
push 0x536f8c
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x40]
mov edx, 0x537394
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x40]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 8
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536f96
xor eax, eax
push ebp
push 0x536fd0
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x44]
mov edx, 0x537380
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x44]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x30
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x536fda
xor eax, eax
push ebp
push 0x53700a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5373a4
mov eax, dword [ebp - 4]
call fcn.00473698
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov dword [edx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537014
xor eax, eax
push ebp
push 0x537044
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5373b4
mov eax, dword [ebp - 4]
call fcn.004736d4
mov edx, dword [0x54514c]
mov edx, dword [edx]
mov byte [edx + 0x21], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53704e
xor eax, eax
push ebp
push 0x537088
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x48]
mov edx, 0x5373c4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x48]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x14
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537092
xor eax, eax
push ebp
push 0x5370cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x4c]
mov edx, 0x5373d4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x38
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5370d6
xor eax, eax
push ebp
push 0x537110
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x50]
mov edx, 0x5373e4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x50]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x3c
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53711a
xor eax, eax
push ebp
push 0x537154
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x54]
mov edx, 0x5373f4
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x54]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x40
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53715e
xor eax, eax
push ebp
push 0x537198
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x58]
mov edx, 0x537408
mov eax, dword [ebp - 4]
call fcn.0047360c
mov edx, dword [ebp - 0x58]
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x44
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5371a2
mov eax, dword [ebp - 4]
call fcn.00472f18
mov eax, dword [ebp - 4]
call fcn.004041d0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 8], 0
jne 0x5371d3
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 8
mov edx, 0x5372cc
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 0x38], 0
jne 0x5371f4
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x38
mov edx, 0x5372e0
call fcn.004050b0
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 0x3c], 0
jne 0x537210
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x3c
call fcn.0040505c
mov eax, dword [0x54514c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, 0x537304
call fcn.00405468
jne 0x537235
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x3c
call fcn.0040505c
mov eax, dword [0x54514c]
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
jne 0x537256
mov eax, dword [0x54514c]
mov eax, dword [eax]
add eax, 0x40
mov edx, 0x537304
call fcn.004050b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537278
lea eax, [ebp - 0x58]
mov edx, 0x15
call fcn.00405080
ret