Function at 0x6ea3e0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
xor eax, eax
push ebp
push 0x6ea970
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x449884]
call fcn.004499f0
mov dword [ebp - 0x24], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x24]
call fcn.00449acc
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jne 0x6ea4d0
mov eax, dword [0x7b9914]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c0]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x6ea4d0
xor ecx, ecx
mov edx, 0x6ea988
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea476
mov ecx, 0x3e8
mov edx, 0x6ea9b8
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6ea9cc
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea4a3
mov ecx, 1
mov edx, 0x6eaa04
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6eaa14
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea4d0
mov ecx, 0x6eaa48
mov edx, 0x6eaa54
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jle 0x6ea50a
xor ecx, ecx
mov edx, 0x6eaa6c
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea50a
mov ecx, 1
mov edx, 0x6eaaac
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 6
jge 0x6ea525
mov eax, dword [0x7b9cd0]
mov eax, dword [eax]
xor edx, edx
call fcn.0068bc30
xor ecx, ecx
mov edx, 0x6eaac8
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea574
xor eax, eax
push ebp
push 0x6ea562
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x7d0
mov edx, 0x6eab04
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ea56c
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.00449acc
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jle 0x6ea5b6
xor ecx, ecx
mov edx, 0x6eab20
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea5b6
mov edx, 0x6eab64
mov eax, dword [ebp - 0x24]
call fcn.0044a064
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7b9cd0]
mov eax, dword [eax]
mov dl, 1
call fcn.0068c044
xor ecx, ecx
mov edx, 0x6eab20
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea60b
mov edx, 0x6eab80
mov eax, dword [ebp - 0x24]
call fcn.0044a064
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x6ea603
mov ecx, 1
mov edx, 0x6eab98
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6eabb8
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea638
mov ecx, 0x6eaa48
mov edx, 0x6eabe4
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x6ea693
xor ecx, ecx
mov edx, 0x6eabf8
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea693
mov ecx, 1
mov edx, 0x6eac18
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov ecx, 1
mov edx, 0x6eac34
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
xor ecx, ecx
mov edx, 0x6eac48
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6eac64
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea8c6
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 6
jge 0x6ea6cb
mov eax, 1
mov ecx, eax
mov edx, 0x6eac84
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov ecx, 0x6eaa48
mov edx, 0x6eac9c
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov ecx, 0x6eacb4
mov edx, 0x6eacc0
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jne 0x6ea723
mov byte [ebp - 4], 0x1e
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea ecx, [ebp - 4]
mov edx, 0x6eacd8
mov eax, dword [ebp - 0x24]
call fcn.0044a450
jmp 0x6ea80e
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6eacf4
call fcn.00405940
jne 0x6ea760
mov byte [ebp - 4], 0xb0
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0x80
push 4
lea ecx, [ebp - 4]
mov edx, 0x6ead04
mov eax, dword [ebp - 0x24]
call fcn.0044a450
jmp 0x6ea80e
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ead20
call fcn.00405940
je 0x6ea78c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ead2c
call fcn.00405940
jne 0x6ea7b0
mov byte [ebp - 4], 0xbe
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 7
mov byte [ebp - 1], 0x80
push 4
lea ecx, [ebp - 4]
mov edx, 0x6ead04
mov eax, dword [ebp - 0x24]
call fcn.0044a450
jmp 0x6ea80e
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ead3c
call fcn.00405940
je 0x6ea7dc
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ead4c
call fcn.00405940
jne 0x6ea80e
mov byte [ebp - 0xc], 0x9e
mov byte [ebp - 0xb], 0x3e
mov byte [ebp - 0xa], 7
mov byte [ebp - 9], 0x80
mov byte [ebp - 8], 0x12
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
push 8
lea ecx, [ebp - 0xc]
mov edx, 0x6ead04
mov eax, dword [ebp - 0x24]
call fcn.0044a450
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x6ea8a9
xor ecx, ecx
mov edx, 0x6ead5c
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea854
mov ecx, 1
mov edx, 0x6eada8
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6eadc0
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea893
mov ecx, 1
mov edx, 0x6eae04
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov ecx, 1
mov edx, 0x6eae20
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov byte [ebp - 0xd], 0
push 0
lea eax, [ebp - 0xd]
push eax
push 0
push 0x1043
call sub.user32.dll_SystemParametersInfoA
mov dword [ebp - 0x15], 8
mov dword [ebp - 0x11], 1
push 0
lea eax, [ebp - 0x15]
push eax
push 8
push 0x49
call sub.user32.dll_SystemParametersInfoA
mov edx, 0x80000000
mov eax, dword [ebp - 0x24]
call fcn.00449acc
xor ecx, ecx
mov edx, 0x6eae3c
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6ea919
lea edx, [ebp - 0x28]
mov eax, dword [0x7b9914]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d0]
mov eax, dword [eax + 0x220]
call fcn.0040d6bc
mov ecx, dword [ebp - 0x28]
mov edx, 0x6eacc0
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [ebp - 0x24]
call fcn.004045cc
lea eax, [ebp - 0x1c]
mov edx, 0x6eae74
call fcn.004055b0
lea edx, [ebp - 0x20]
mov eax, dword [0x7ba4c8]
call fcn.00407bd4
mov eax, dword [0x7b9914]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.00705ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ea977
lea eax, [ebp - 0x28]
call fcn.00405518
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040553c
ret