Function at 0x436ec0
Capabilities:
Delete registry value
Get common file path
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x428]
sub esp, 0x428
push 0xfffffffffffffffe
push 0x48a860
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x424], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov edi, 0xf003f
mov dword [ebp - 0x2c], edi
xor eax, eax
mov word [ebp], ax
push 0x206
push ebx
lea ecx, [ebp + 2]
push ecx
call fcn.004416b0
add esp, 0xc
mov dword [ebp - 4], ebx
mov esi, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x208
call fcn.00420be0
test eax, eax
je 0x436f4c
mov edi, 0xf013f
mov dword [ebp - 0x2c], edi
lea edx, [ebp - 0x1c]
push edx
push edi
push ebx
push 0x486498
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x436f7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RestoreShellKey_RegOpenKeyEx_error:__d
call fcn.00404c20
add esp, 8
jmp 0x437098
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0x208]
push ecx
lea edx, [ebp - 0x24]
push edx
push ebx
push str.Shell
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x436fbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RestoreShellKey_RegQueryValueEx_error:__d
call fcn.00404c20
add esp, 8
jmp 0x437098
lea ecx, [ebp + 0x208]
push ecx
push str.RestoreShellKey_szValue:__s
call fcn.00404c20
add esp, 8
cmp dword [ebp - 0x24], esi
jne 0x437098
push 0x104
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x437098
push str.Explorer.exe
push 0x104
lea eax, [ebp]
push eax
call fcn.0043f083
push 0x48101c
lea ecx, [ebp + 0x208]
push ecx
call fcn.0043ec25
add esp, 0x14
test eax, eax
je 0x437098
lea edx, [ebp]
push edx
lea eax, [ebp + 0x208]
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x437098
push 0x48101c
push 0x479110
lea edx, [ebp + 0x208]
call fcn.004047d0
add esp, 8
lea eax, [ebp + 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x437052
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x20], ecx
lea edx, [ebp + 0x208]
push edx
push str.RestoreUserInitKey_RegSetValueEx:__s
call fcn.00404c20
add esp, 8
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp + 0x208]
push ecx
push esi
push ebx
push str.Shell
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], 0xfffffffe
call fcn.00437185
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], esi
call fcn.00406500
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
je 0x437148
lea eax, [ebp - 0x28]
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x437148
lea ecx, [ebp - 0x1c]
push ecx
push edi
push 0
push 0x486498
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x437148
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x208
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp + 0x208]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0
push str.Shell
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x437148
lea eax, [ebp + 0x208]
push eax
push str.RestoreShellKey_RegQueryValueEx:__s
call fcn.00404c20
add esp, 8
push str.Shell
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.0043719a
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x424]
xor ecx, ebp
call fcn.0043e4c7
add ebp, 0x428
mov esp, ebp
pop ebp
ret