Function at 0x5152bc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, 0x51f0d8
xor eax, eax
push ebp
push 0x515639
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x515614
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00463d60
mov cl, 1
mov edx, 0x515650
mov eax, dword [ebx]
call fcn.00463dc4
mov ecx, 2
mov edx, 0x515684
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.00463d30
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov cl, 1
mov edx, 0x515698
mov eax, dword [ebx]
call fcn.00463dc4
xor ecx, ecx
mov edx, 0x5156dc
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.00463d30
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov cl, 1
mov edx, 0x5156f0
mov eax, dword [ebx]
call fcn.00463dc4
mov ecx, 1
mov edx, 0x515728
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.00463d30
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 0
mov cl, 1
mov edx, 0x515744
mov eax, dword [ebx]
call fcn.00463dc4
lea edx, [ebp - 4]
mov eax, dword [0x51d97c]
mov eax, dword [eax]
call fcn.00460bf4
mov ecx, dword [ebp - 4]
mov edx, 0x515780
mov eax, dword [ebx]
call fcn.00463f80
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 0
mov cl, 1
mov edx, 0x51578c
mov eax, dword [ebx]
call fcn.00463dc4
lea edx, [ebp - 8]
mov eax, dword [0x51d97c]
mov eax, dword [eax]
call fcn.00460bf4
mov ecx, dword [ebp - 8]
mov edx, 0x5157ec
mov eax, dword [ebx]
call fcn.00463f80
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 0
mov cl, 1
mov edx, 0x515800
mov eax, dword [ebx]
call fcn.00463dc4
lea edx, [ebp - 0xc]
mov eax, dword [0x51d97c]
mov eax, dword [eax]
call fcn.00460bf4
mov ecx, dword [ebp - 0xc]
mov edx, 0x5157ec
mov eax, dword [ebx]
call fcn.00463f80
mov eax, dword [ebx]
call fcn.004038e4
mov dl, 1
mov eax, dword [0x463bc0]
call fcn.00463cc0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00463d60
mov eax, dword [ebx]
mov byte [eax + 0xc], 0
mov cl, 1
mov edx, 0x515860
mov eax, dword [ebx]
call fcn.00463dc4
mov ecx, 1
mov edx, 0x5158a4
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5158c0
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5158d8
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5158f8
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515914
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515928
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515940
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515960
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515980
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515990
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5159a8
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5159c4
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5159dc
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x5159f0
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515a00
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515a14
mov eax, dword [ebx]
call fcn.00464024
mov ecx, 1
mov edx, 0x515a2c
mov eax, dword [ebx]
call fcn.00464024
mov eax, dword [ebx]
call fcn.004038e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51561e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515640
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404718
ret