Function at 0x616160
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x616168
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6164e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3b0]
xor edx, edx
call fcn.00481c70
mov eax, dword [0x6aabdc]
mov eax, dword [eax]
call fcn.004b04c0
call fcn.004cadbc
mov edx, dword [0x6ab74c]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x6161de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6aabdc]
mov eax, dword [eax]
call fcn.004d26b8
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
xor edx, edx
call fcn.0062b82c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61620e
mov eax, dword [0x6ab74c]
mov eax, dword [eax]
call fcn.004cae80
mov eax, dword [0x6aabdc]
mov eax, dword [eax]
call fcn.004d26b0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x414]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x61624d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
jne 0x616283
xor eax, eax
push ebp
push 0x616279
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x616518
mov edx, 0x616530
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x616283
xor eax, eax
push ebp
push 0x6162e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x616518
mov edx, 0x616530
mov eax, 0x80000002
call fcn.00627864
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x616518
mov edx, 0x61659c
mov eax, 0x80000002
call fcn.00627630
mov ecx, 0x616518
mov edx, 0x616530
mov eax, 0x80000002
call fcn.00627a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6163b7
lea eax, [ebp - 8]
xor edx, edx
call fcn.00407cf0
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
cmp dword [eax + 0x7c8], 0
je 0x6163eb
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x7c8]
lea eax, [ebp - 8]
mov edx, 0x6166bc
call fcn.00408180
push 1
push 0x616614
lea edx, [ebp - 0x68]
mov eax, dword [0x6ab3ec]
mov eax, dword [eax]
call fcn.004d7bd4
push dword [ebp - 0x68]
push 0x6166d8
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.00408264
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
call fcn.00429cb8
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x616518
mov edx, 0x616700
mov eax, 0x80000002
call fcn.00627630
mov dl, 1
mov eax, 0x616770
call fcn.00672710
push 1
lea eax, [ebp - 4]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x6167a4
call fcn.004f30d8
inc eax
jne 0x616467
mov eax, dword [ebp - 4]
call fcn.0048dc38
mov eax, dword [0x6ab6b0]
mov eax, dword [eax]
call fcn.004d21c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6164e7
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00407c94
lea eax, [ebp - 0x60]
call fcn.0042466c
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00407c94
lea eax, [ebp - 0x48]
call fcn.0042466c
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00407c94
lea eax, [ebp - 0x30]
mov edx, dword [0x4012a8]
mov ecx, 2
call fcn.00408b38
lea eax, [ebp - 0x10]
call fcn.00407c8c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c94
ret