Function at 0x715d5b5b
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
push 0x715d1eec
call fcn.715dd74c
pop ecx
pop ecx
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x715d5bb6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x715d5ba2
call esi
jmp 0x715d5bae
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 8], eax
jmp 0x715d5e68
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
call fcn.715d60e4
test eax, eax
jl 0x715d5e53
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [ebp - 4], ebx
je 0x715d5e53
test byte [ebp + 0x14], 4
je 0x715d5d75
mov ax, word [0x715e4520]
push eax
push ebx
call fcn.715d8ca2
test eax, eax
jne 0x715d5c0b
cmp dword [ebp + 0x18], ebx
je 0x715d5d75
cmp dword [0x715e4024], 0x3dd
jne 0x715d5c2a
call fcn.715d833f
test eax, eax
je 0x715d5c2a
mov dword [0x715e4a90], 1
cmp dword [0x715e4a90], ebx
mov eax, 0x715d1d24
je 0x715d5c3c
mov eax, 0x715d1eb8
lea ecx, [ebp - 0x10]
push ebx
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x715d5dc9
cmp dword [0x715e4a90], ebx
je 0x715d5d1b
mov eax, dword [0x715e4024]
cmp eax, 0x3dd
jne 0x715d5c8c
lea eax, [ebp - 0x218]
push 0x715e4024
push eax
push dword [ebp - 0x10]
call fcn.715d846e
jmp 0x715d5ca2
push eax
lea eax, [ebp - 0x218]
push 0x715d1eb4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
lea eax, [ebp - 0x218]
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x715d5d63
mov eax, dword [0x715e4a8c]
inc dword [0x715e4a8c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x715d1eac
push dword [ebp - 0x14]
call fcn.715d84df
push dword [ebp - 4]
call edi
inc eax
push eax
lea eax, [ebp - 0x218]
push dword [ebp - 4]
push 1
push ebx
push eax
push dword [ebp - 0x14]
call esi
push dword [ebp - 4]
push 0x715d1e94
call fcn.715dd74c
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x715d5d63
mov eax, dword [0x715e4a8c]
inc dword [0x715e4a8c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x715d1e80
push dword [ebp - 0x10]
call fcn.715d84df
push dword [ebp - 4]
call edi
inc eax
push eax
lea eax, [ebp - 0x218]
push dword [ebp - 4]
push 1
push ebx
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 4]
push 0x715d1e6c
call fcn.715dd74c
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0xbc2
jmp 0x715d5dc9
push dword [ebp - 4]
call fcn.715d8de9
test eax, eax
jne 0x715d5d98
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.715e1804
mov eax, dword [ebp - 0xc]
cmp byte [eax], bl
je 0x715d5db3
push dword [ebp + 0x14]
push 0xffffffffffffffff
push ebx
push ebx
push eax
call fcn.715d8fd2
cmp eax, 0x80004005
jne 0x715d5dc9
push dword [ebp + 0x14]
push 0xffffffffffffffff
push ebx
push ebx
push dword [ebp - 4]
call fcn.715d8fd2
cmp eax, 0x80004005
je 0x715d5dfa
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x18]
mov dword [ebp - 4], ebx
push ebx
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.715d60e4
test eax, eax
jge 0x715d5bde
jmp 0x715d5e53
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x715d5e0a
call esi
jmp 0x715d5e16
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 8], eax
push ebx
lea eax, [ebp - 0x218]
push 0x200
push eax
push ebx
call esi
push eax
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push ebx
lea eax, [ebp - 0x218]
push 0x10
push eax
push dword [ebp - 4]
push 0x476
push dword [0x715e4534]
call fcn.715d6f11
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
cmp dword [ebp - 4], ebx
je 0x715d5e68
push dword [ebp - 4]
call esi
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0x715d1e44
call fcn.715dd74c
mov eax, dword [ebp - 8]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0x14