Function at 0x512c68
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x512fce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x458670]
call fcn.00458770
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x512fb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00458810
mov cl, 1
mov edx, 0x512fe4
mov eax, dword [ebp - 4]
call fcn.00458954
test al, al
je 0x512ebe
mov ecx, dword [0x535080]
mov cl, byte [ecx]
mov edx, 0x513020
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534fb0]
mov cl, byte [ecx]
mov edx, 0x513034
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534fdc]
mov cl, byte [ecx]
mov edx, 0x513048
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534c90]
mov cl, byte [ecx]
mov edx, 0x51305c
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534fc4]
mov ecx, dword [ecx]
mov edx, 0x513074
mov eax, dword [ebp - 4]
call fcn.00458f68
mov ecx, dword [0x534f0c]
mov ecx, dword [ecx]
mov edx, 0x513084
mov eax, dword [ebp - 4]
call fcn.00458f68
mov ecx, dword [0x534f3c]
mov ecx, dword [ecx]
mov edx, 0x513094
mov eax, dword [ebp - 4]
call fcn.00458f68
mov cl, byte [0x534aa0]
mov edx, 0x5130a4
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534c0c]
mov cl, byte [ecx]
mov edx, 0x5130bc
mov eax, dword [ebp - 4]
call fcn.00459050
mov cl, byte [0x534ac0]
mov edx, 0x5130d0
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534b44]
mov cl, byte [ecx]
mov edx, 0x5130e4
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535314]
mov cl, byte [ecx]
mov edx, 0x513100
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534bac]
mov cl, byte [ecx]
mov edx, 0x513114
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x53515c]
mov cl, byte [ecx]
mov edx, 0x513130
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534bb8]
mov cl, byte [ecx]
mov edx, 0x513148
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534f20]
mov cl, byte [ecx]
mov edx, 0x51315c
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534eac]
mov ecx, dword [ecx]
mov edx, 0x51316c
mov eax, dword [ebp - 4]
call fcn.0045900c
mov ecx, dword [0x534e44]
mov ecx, dword [ecx]
mov edx, 0x513188
mov eax, dword [ebp - 4]
call fcn.00458f68
mov ecx, dword [0x534c5c]
mov cl, byte [ecx]
mov edx, 0x51319c
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534c38]
mov cl, byte [ecx]
mov edx, 0x5131b8
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x534b58]
mov ecx, dword [ecx]
mov edx, 0x5131d4
mov eax, dword [ebp - 4]
call fcn.0045900c
mov ecx, dword [0x5351dc]
mov cl, byte [ecx]
mov edx, 0x5131ec
mov eax, dword [ebp - 4]
call fcn.00459050
mov ecx, dword [0x535018]
mov ecx, dword [ecx]
mov edx, 0x513208
mov eax, dword [ebp - 4]
call fcn.0045900c
mov ecx, dword [0x5351fc]
mov cl, byte [ecx]
mov edx, 0x513220
mov eax, dword [ebp - 4]
call fcn.00459050
mov eax, dword [ebp - 4]
call fcn.004587e0
mov cl, 1
mov edx, 0x51323c
mov eax, dword [ebp - 4]
call fcn.00458954
test al, al
je 0x512f93
mov edx, 0x513274
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x512ef3
mov edx, 0x513274
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x513290
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x512f11
mov edx, 0x513290
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x5132ac
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x512f2f
mov edx, 0x5132ac
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x5132c8
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x512f4d
mov edx, 0x5132c8
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov edx, 0x5132e8
mov eax, dword [ebp - 4]
call fcn.00459224
test al, al
je 0x512f6b
mov edx, 0x5132e8
mov eax, dword [ebp - 4]
call fcn.00458cd8
cmp byte [0x534aa0], 0
je 0x512f93
lea edx, [ebp - 8]
mov eax, dword [0x535040]
mov eax, dword [eax]
call fcn.00450c28
mov ecx, dword [ebp - 8]
mov edx, 0x5132e8
mov eax, dword [ebp - 4]
call fcn.00458f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512fb8
mov eax, dword [ebp - 4]
call fcn.004587e0
mov eax, dword [ebp - 4]
call fcn.004030bc
ret