Function at 0x4bbe10
Capabilities:
Delete registry value
Get common file path
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x310
lea eax, [esp + 0x190]
push ebx
push ebp
push esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
xor ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push ebx
push 0xf003f
push ebx
push 0xc30c0c
push ebx
push str..DEFAULTSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_closesocket
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4bbe84
mov eax, dword [esp + 0xc]
push str.DisableRegistryTools
push eax
call ebp
push 0xc30c0c
push str.DisableRegistryTools
push str.HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.004bb8b0
add esp, 0xc
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push ebx
push 0xf003f
push ebx
push 0xc30c0c
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push closesocket
call esi
test eax, eax
jne 0x4bc248
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push edi
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.AppInit_DLLs
push ecx
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 1
mov byte [esp + 0x38], bl
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.AppInit_DLLs
push edx
call esi
test eax, eax
jne 0x4bbf44
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4bbf44
mov eax, dword [esp + 0x10]
push str.AppInit_DLLs
push eax
call ebp
push 0xc30c0c
push str.AppInit_DLLs
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.004bb8b0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x5142f8
push ecx
mov byte [esp + 0x38], bl
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x5142f8
push edx
call esi
test eax, eax
jne 0x4bbfa0
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4bbfa0
mov eax, dword [esp + 0x10]
push 0x5142f8
push eax
call ebp
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x50df10
push ecx
mov byte [esp + 0x38], bl
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0x50df10
push edx
call esi
test eax, eax
jne 0x4bbffc
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4bbffc
mov eax, dword [esp + 0x10]
push 0x50df10
push eax
call ebp
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.Userinit
push ecx
mov byte [esp + 0x38], bl
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.Userinit
push edx
call esi
test eax, eax
jne 0x4bc0b2
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4bc0b2
lea eax, [esp + 0x20]
lea ecx, [esp + 0x120]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x1ac]
lea eax, [esp + 0x22c]
push edx
push str._suserinit.exe
push eax
call fcn.004f175f
lea ecx, [esp + 0x138]
push str.userinit.exe
push ecx
call fcn.004f61e0
add esp, 0x20
test eax, eax
je 0x4bc0c9
lea edx, [esp + 0x220]
lea eax, [esp + 0x120]
push edx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc0c9
push str.userinit.exe
push str.Userinit
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.004bb8b0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.UIHost
push ecx
mov byte [esp + 0x38], bl
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.UIHost
push edx
call esi
test eax, eax
jne 0x4bc17f
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4bc17f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x120]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x1ac]
lea eax, [esp + 0x22c]
push edx
push str._slogonui.exe
push eax
call fcn.004f175f
lea ecx, [esp + 0x138]
push str.logonui.exe
push ecx
call fcn.004f61e0
add esp, 0x20
test eax, eax
je 0x4bc196
lea edx, [esp + 0x220]
lea eax, [esp + 0x120]
push edx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4bc196
push str.logonui.exe
push str.UIHost
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.004bb8b0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.shell
push ecx
mov byte [esp + 0x38], bl
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.shell
push edx
call esi
test eax, eax
jne 0x4bc216
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4bc216
lea eax, [esp + 0x20]
lea ecx, [esp + 0x120]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x12c]
push str.explorer.exe
push edx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4bc22d
push str.explorer.exe
push str.Shell
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.004bb8b0
add esp, 0xc
mov eax, dword [esp + 0x10]
push str.legalnoticecaption
push eax
call ebp
mov ecx, dword [esp + 0x10]
push str.legalnoticetext
push ecx
call ebp
pop edi
jmp 0x4bc2bb
lea edx, [esp + 0x19c]
push edx
call fcn.004fa6c0
push eax
lea eax, [esp + 0x224]
push str._suserinit.exe
push eax
call fcn.004f175f
push str.explorer.exe
push str.Shell
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.004bb8b0
push str.userinit.exe
push str.Userinit
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.004bb8b0
push 0xc30c0c
push 0x50df10
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.004bb8b0
push str.logonui.exe
push str.UIHost
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.004bb8b0
add esp, 0x40
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x310
ret