Function at 0x408f60
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov byte [eax], 0
cmp dword [0x40c5c8], 0
je 0x409005
cmp dword [0x40ca60], 0
je 0x408f8e
jmp 0x409005
push 0x40ca3c
push 0x2000000
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409005
mov dword [0x40c634], 0x104
push 0x40c634
push 0x40c63c
lea ecx, [ebp - 4]
push ecx
push 0
push str.shell
mov edx, dword [0x40ca3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [0x40ca3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x409005
push 0x40c63c
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x4091f2
movsx edx, byte [0x40c4c4]
test edx, edx
je 0x409026
push 0x40c4c4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x4091ed
push 0x40c354
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.explorer.exe
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x4091e8
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
sub eax, 1
mov dword [ebp - 0x110], eax
jmp 0x409076
mov ecx, dword [ebp - 0x110]
sub ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0
jle 0x4090a3
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x110]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x4090a1
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
jmp 0x4090a3
jmp 0x409067
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x110], eax
jmp 0x4090e2
mov edx, dword [ebp - 0x110]
sub edx, 1
mov dword [ebp - 0x110], edx
cmp dword [ebp - 0x110], 0
jle 0x409125
mov eax, dword [ebp - 0x110]
movsx ecx, byte [ebp + eax - 0x10c]
cmp ecx, 0x22
je 0x409111
mov edx, dword [ebp - 0x110]
movsx eax, byte [ebp + edx - 0x10c]
cmp eax, 0x20
jne 0x409121
mov ecx, dword [ebp - 0x110]
mov byte [ebp + ecx - 0x10c], 0
jmp 0x409123
jmp 0x409125
jmp 0x4090d3
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
cmp eax, 0x1d
jbe 0x409140
mov byte [ebp - 0xef], 0
cmp dword [ebp + 0xc], 0
je 0x4091e6
push 0x64
mov eax, dword [0x40c604]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [ebp - 0x110], 0
jmp 0x409187
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x110]
cmp eax, dword [0x415a68]
jge 0x4091d1
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x110]
imul edx, edx, 0x3c
add edx, 0x411e74
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4091cf
mov eax, dword [ebp - 0x110]
imul eax, eax, 0x3c
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x411e68]
mov dword [ecx], edx
jmp 0x4091d1
jmp 0x409178
cmp dword [ebp - 0x114], 0
je 0x4091e6
mov eax, dword [0x40c604]
push eax
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
jmp 0x4091f7
jmp 0x409140
jmp 0x409050
jmp 0x409050
mov esp, ebp
pop ebp
ret