Function at 0x4101ffe0
Capabilities:
Delete registry value
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
call fcn.41040000
xor ebx, ebx
cmp eax, ebx
jne 0x4101fffc
push 0x80004005
call fcn.410011f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
push ebx
add eax, 0x10
push 0x411584dc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
call fcn.410016e0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push str.Unregister_Key__sTPSvc...
push 0x1000001
push 0xed7
push str.TPAutoConnDll.cpp
call fcn.41002c10
add esp, 0x14
push 0xf003f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifyTPSvc
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.41010fa0
test eax, eax
jne 0x41020196
mov dword [ebp - 8], ebx
call fcn.41040000
cmp eax, ebx
jne 0x41020072
push 0x80004005
call fcn.410011f0
mov edx, dword [eax]
push esi
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov edi, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.Startup
add eax, 0x10
push edi
mov dword [ebp - 4], eax
call esi
push str.Shutdown
push edi
call esi
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.410190f0
test eax, eax
jne 0x410200d6
push str.Winlogon_contains_subkeys_not_used_by_Service__keeping_the_remains
push 0x1000001
push 0xee7
push str.TPAutoConnDll.cpp
call fcn.41002c10
mov esi, dword [ebp - 4]
add esp, 0x10
mov ebx, 1
jmp 0x4102014f
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.41019190
mov esi, dword [ebp - 4]
push str.Asynchronous
push esi
mov edi, eax
call fcn.4112e40c
add esp, 8
test eax, eax
je 0x41020125
push str.Impersonate
push esi
call fcn.4112e40c
add esp, 8
test eax, eax
je 0x41020125
push str.DllName
push esi
call fcn.4112e40c
add esp, 8
test eax, eax
jne 0x4102012b
test edi, edi
je 0x410200d6
jmp 0x4102014c
push str.Winlogon_contains_entries_that_had_not_been_set_by_DLL_registration__keeping_the_remains
push 0x1000001
push 0xef2
push str.TPAutoConnDll.cpp
call fcn.41002c10
add esp, 0x10
mov ebx, 1
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x41020161
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
push 0
push 0x411584dc
lea ecx, [ebp - 0x10]
call fcn.410016e0
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
test edx, edx
jg 0x4102018e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
jne 0x41020229
push 0xf003f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.41010fa0
cmp eax, ebx
jne 0x41020205
push 0x4116292c
lea ecx, [ebp - 0x14]
call fcn.4101b340
cmp eax, ebx
je 0x410201e4
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push str.Cannot_delete_Key__sTPSvc:_cause__d
push 0x2000001
push 0xf01
push str.TPAutoConnDll.cpp
call fcn.41002c10
add esp, 0x18
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x410201f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
push ebx
push 0x411584dc
lea ecx, [ebp - 0x10]
call fcn.410016e0
jmp 0x4102022b
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push str.Cannot_open_Key__s:_cause__d
push 0x2000001
push 0xf06
push str.TPAutoConnDll.cpp
call fcn.41002c10
add esp, 0x18
jmp 0x4102022b
xor ebx, ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4102023c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
push ebx
push 0x411584dc
lea ecx, [ebp - 0x10]
call fcn.410016e0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop ebx
test edx, edx
jg 0x4102026a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov esp, ebp
pop ebp
ret