Function at 0x43ff00
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
mov ecx, 3
push ebx
push esi
push edi
mov esi, 0x50e18c
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x50e199]
pop edi
mov dword [ebp - 0x18], eax
xor esi, esi
mov ax, word [0x50e19d]
mov word [ebp - 0x14], ax
test bl, 1
je 0x43ff46
mov eax, ebx
jmp 0x4406c4
test bh, 0x20
jne 0x43ff78
test bh, 0x40
jne 0x43ff78
test bh, 0x10
jne 0x43ff78
test bh, 0x80
jne 0x43ff78
test ebx, 0x10000
jne 0x43ff78
test ebx, 0x40000
jne 0x43ff78
test ebx, 0x20000
jne 0x43ff78
or ebx, 0x7f000
test bh, 0x20
je 0x440078
push 0x5d06c5
lea edx, [ebp - 0x218]
push edx
call fcn.004d1ac0
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000001
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x440078
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x440078
test bl, 0x20
je 0x44002d
test edi, edi
jne 0x440001
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
jmp 0x44001c
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440025
or esi, 1
jmp 0x44006c
or esi, 0x2000
jmp 0x44006c
test edi, edi
je 0x44005a
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x2000
test bl, 0x80
je 0x44006c
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x440078
mov eax, esi
jmp 0x4406c4
test bh, 0x40
je 0x440178
push 0x5d06ff
lea edx, [ebp - 0x218]
push edx
call fcn.004d1ac0
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x440178
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x440178
test bl, 0x20
je 0x44012d
test edi, edi
jne 0x440101
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
jmp 0x44011c
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440125
or esi, 1
jmp 0x44016c
or esi, 0x4000
jmp 0x44016c
test edi, edi
je 0x44015a
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x4000
test bl, 0x80
je 0x44016c
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x440178
mov eax, esi
jmp 0x4406c4
test bh, 0x10
je 0x4402bf
push 0x5d0739
lea edx, [ebp - 0x418]
push edx
call fcn.004d1ac0
add esp, 8
lea ecx, [ebp - 0x218]
mov byte [ebp - 0x218], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x418]
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4402bf
push 4
push 0x5d0785
lea ecx, [ebp - 0x218]
push ecx
call fcn.004cd600
add esp, 0xc
test eax, eax
jne 0x4402bf
test bl, 0x20
je 0x440247
test edi, edi
jne 0x440211
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x214]
push ecx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
jmp 0x44022c
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x214]
push eax
push edx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440235
or esi, 1
jmp 0x44023b
or esi, 0x1000
test bl, 0x80
je 0x4402b3
mov eax, esi
jmp 0x4406c4
mov byte [ebp - 0x418], 0
push 1
lea edx, [ebp - 0x418]
push 0x200
push edx
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x214]
push ecx
push eax
push 0x80000001
call fcn.00406a20
add esp, 0x18
test edi, edi
je 0x4402a1
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x1000
test bl, 0x80
je 0x4402b3
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x4402bf
mov eax, esi
jmp 0x4406c4
test bh, 0x80
je 0x4403c9
push 0x5d078a
lea edx, [ebp - 0x218]
push edx
call fcn.004d1ac0
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4403c9
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x4403c9
test bl, 0x20
je 0x44037e
test edi, edi
jne 0x440348
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
jmp 0x440363
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x44036c
or esi, 1
jmp 0x440372
or esi, 0x8000
test bl, 0x80
je 0x4403bd
mov eax, esi
jmp 0x4406c4
test edi, edi
je 0x4403ab
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x8000
test bl, 0x80
je 0x4403bd
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x4403c9
mov eax, esi
jmp 0x4406c4
test ebx, 0x40000
je 0x4404d6
push 0x5d07c0
lea edx, [ebp - 0x218]
push edx
call fcn.004d1ac0
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000001
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4404d6
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x4404d6
test bl, 0x20
je 0x44048b
test edi, edi
jne 0x440455
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
jmp 0x440470
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440479
or esi, 1
jmp 0x44047f
or esi, 0x40000
test bl, 0x80
je 0x4404ca
mov eax, esi
jmp 0x4406c4
test edi, edi
je 0x4404b8
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x40000
test bl, 0x80
je 0x4404ca
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x4404d6
mov eax, esi
jmp 0x4406c4
mov edx, ebx
and edx, 0x10000
test edx, edx
je 0x4405ee
push 0x5d07f6
lea ecx, [ebp - 0x218]
push ecx
call fcn.004d1ac0
add esp, 8
lea eax, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4405ee
mov al, byte [ebp - 0x418]
test al, al
je 0x4405ee
mov edx, ebx
and edx, 0x10000
test edx, edx
je 0x4405a3
test edi, edi
jne 0x44056d
push 1
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
jmp 0x440588
push 1
push edi
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x218]
push ecx
push eax
push 0x80000002
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440591
or esi, 1
jmp 0x440597
or esi, 0x10000
test bl, 0x80
je 0x4405e2
mov eax, esi
jmp 0x4406c4
test edi, edi
je 0x4405d0
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x10000
test bl, 0x80
je 0x4405e2
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x4405ee
mov eax, esi
jmp 0x4406c4
test ebx, 0x20000
je 0x4406bf
push esi
push edi
lea edi, [ebp - 0x218]
mov esi, 0x5d0838
mov eax, edi
lea edx, [ebp - 0x218]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebp - 0x418], 0
push edx
lea ecx, [ebp - 0x418]
push 0x5d0848
push ecx
lea eax, [ebp - 0x18]
push eax
push 0x5d0843
call fcn.0040c930
test bl, 0x20
je 0x44067a
test edi, edi
jne 0x44065c
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x18]
push eax
push 0x5d0849
call fcn.0040c854
jmp 0x440672
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x18]
push edx
push edi
push ecx
push 0x5d084e
call fcn.0040c854
or esi, 0x20000
jmp 0x4406b6
test edi, edi
je 0x4406a7
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x20000
test bl, 0x80
je 0x4406b6
mov eax, esi
jmp 0x4406c4
test bl, 0x40
je 0x4406bf
mov eax, esi
jmp 0x4406c4
or esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret