Function at 0x512330
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0xb48
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xb44], eax
mov edx, dword [esp + 0xb5c]
mov eax, dword [esp + 0xb54]
mov ecx, dword [esp + 0xb58]
push ebx
mov ebx, dword [esp + 0xb6c]
push ebp
mov ebp, dword [esp + 0xb74]
push esi
mov esi, dword [esp + 0xb58]
push edi
mov edi, dword [esp + 0xb60]
push 0x103
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb74]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0xb78]
lea edx, [esp + 0x2d]
push 0
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov byte [esp + 0x34], 0
call fcn.005dfd60
lea eax, [esp + 0x34]
push 0x104
push eax
call fcn.004ebf90
add esp, 0x14
cmp byte [esp + 0x28], 0
je 0x5123ec
test ebp, ebp
je 0x5123ec
push 2
lea ecx, [esp + 0x2c]
push ecx
push ebp
call fcn.005e1e30
add esp, 0xc
cmp byte [ebp + 1], 0
je 0x5123e8
mov byte [ebp + 2], 0
mov byte [ebp + 2], 0
mov ebp, 0x104
test ebx, ebx
je 0x512424
lea edx, [esp + 0x10]
push edx
push ebx
push 0x64d910
push 0x64d8f4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
mov byte [ebx], 0
call fcn.004d5770
cmp byte [ebx], 0
je 0x512424
push ebx
call fcn.004e2520
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x5124ba
lea eax, [esp + 0x10]
push eax
push esi
push 0x64d8e4
push 0x64d8b8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
je 0x5124ba
push esi
lea ecx, [esp + 0x130]
push ecx
call ebx
lea edx, [esp + 0x12c]
push 0x20
push edx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x51248c
mov byte [eax], 0
lea eax, [esp + 0x12c]
push eax
call fcn.004e0670
add esp, 4
cmp dword [esp + 0xb80], 0
jne 0x51249e
push esi
call fcn.004e2520
jmp 0x5124b7
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x5124b1
mov byte [esi], al
jmp 0x5124ba
push esi
call fcn.004e24e0
add esp, 4
test edi, edi
je 0x512536
lea ecx, [esp + 0x10]
push ecx
push edi
push 0x64d8a8
push 0x64d8b8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
mov byte [edi], 0
call fcn.004d5770
cmp byte [edi], 0
jne 0x512502
push esi
push edi
call ebx
push edi
call fcn.004e24e0
add esp, 4
push 0x64d898
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [edi], 0
je 0x512536
mov ebx, dword [esp + 0xb80]
test ebx, ebx
jne 0x512518
push edi
call fcn.004e2520
add esp, 4
jmp 0x51253d
push 0
push edi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x51252b
mov byte [edi], al
jmp 0x51253d
push edi
call fcn.004e24e0
add esp, 4
jmp 0x51253d
mov ebx, dword [esp + 0xb80]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x5125a3
lea edx, [esp + 0x10]
push edx
push esi
push 0x631c54
push 0x612808
push connect
mov dword [esp + 0x24], ebp
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
jne 0x51257b
push esi
push 0x1a
call fcn.00511eb0
add esp, 8
cmp byte [esi], 0
je 0x5125a3
test ebx, ebx
jne 0x512587
push esi
call fcn.004e2520
jmp 0x5125a0
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x51259a
mov byte [esi], al
jmp 0x5125a3
push esi
call fcn.004e24e0
add esp, 4
mov esi, dword [esp + 0x24]
test esi, esi
je 0x512609
lea eax, [esp + 0x10]
push eax
push esi
push 0x648a18
push 0x612808
push connect
mov dword [esp + 0x24], ebp
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
jne 0x5125e1
push esi
push 6
call fcn.00511eb0
add esp, 8
cmp byte [esi], 0
je 0x512609
test ebx, ebx
jne 0x5125ed
push esi
call fcn.004e2520
jmp 0x512606
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x512600
mov byte [esi], al
jmp 0x512609
push esi
call fcn.004e24e0
add esp, 4
mov esi, dword [esp + 0x14]
test esi, esi
je 0x51266f
lea ecx, [esp + 0x10]
push ecx
push esi
push 0x648cbc
push 0x612808
push connect
mov dword [esp + 0x24], ebp
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
jne 0x512647
push esi
push 0x10
call fcn.00511eb0
add esp, 8
cmp byte [esi], 0
je 0x51266f
test ebx, ebx
jne 0x512653
push esi
call fcn.004e2520
jmp 0x51266c
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x512666
mov byte [esi], al
jmp 0x51266f
push esi
call fcn.004e24e0
add esp, 4
mov esi, dword [esp + 0x18]
test esi, esi
je 0x5126d5
lea edx, [esp + 0x10]
push edx
push esi
push 0x631eb0
push 0x612808
push connect
mov dword [esp + 0x24], ebp
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
jne 0x5126ad
push esi
push 2
call fcn.00511eb0
add esp, 8
cmp byte [esi], 0
je 0x5126d5
test ebx, ebx
jne 0x5126b9
push esi
call fcn.004e2520
jmp 0x5126d2
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x5126cc
mov byte [esi], al
jmp 0x5126d5
push esi
call fcn.004e24e0
add esp, 4
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x51277a
lea eax, [esp + 0x10]
push eax
push esi
push 0x648578
push 0x612808
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
je 0x512714
push esi
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x51274d
push esi
push 0x648578
mov byte [esi], 0
call fcn.004ece10
add esp, 8
cmp byte [esi], 0
je 0x51277a
push esi
call fcn.004ec720
add esp, 4
cmp eax, 1
jne 0x51274d
push esi
push 0x648578
push 0x612808
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
cmp byte [esi], 0
je 0x51277a
test ebx, ebx
jne 0x51275e
push esi
call fcn.004e2520
jmp 0x512777
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x512771
mov byte [esi], al
jmp 0x51277a
push esi
call fcn.004e24e0
add esp, 4
mov ecx, dword [esp + 0xb54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0xb48
ret