Function at 0x40e870
Capabilities:
Delete registry key
Delete registry value
Get common file path
Get installed programs
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc08
push ebx
push esi
push edi
mov dword [ebp - 0x2d0], eax
mov eax, 0x5690d8
call fcn.00544234
xor edx, edx
mov dword [ebp - 0x2d4], edx
xor ecx, ecx
mov dword [ebp - 0x2d8], ecx
xor eax, eax
mov dword [ebp - 0x2d8], eax
mov edx, dword [ebp - 0x2d8]
cmp dword [edx*4 + 0x56850c], 0
jne 0x40e8b6
jmp 0x40e8c4
inc dword [ebp - 0x2d4]
inc dword [ebp - 0x2d8]
jmp 0x40e8a4
xor ecx, ecx
mov dword [ebp - 0x2d8], ecx
mov eax, dword [ebp - 0x2d8]
cmp dword [eax*4 + 0x56854c], 0
jne 0x40e8de
jmp 0x40e8ec
inc dword [ebp - 0x2d4]
inc dword [ebp - 0x2d8]
jmp 0x40e8cc
push dword [ebp - 0x2d4]
mov edx, dword [ebp - 0x2d0]
push dword [edx + 0xc]
mov ecx, dword [ebp - 0x2d0]
call dword [ecx]
add esp, 8
xor eax, eax
mov dword [ebp - 0x2d4], eax
push 0x1f4
call sub.KERNEL32.DLL_Sleep
mov word [ebp - 0x2bc], 0xc
lea eax, [ebp - 4]
call fcn.00552ee0
inc dword [ebp - 0x2b0]
mov word [ebp - 0x2bc], 0x18
xor edx, edx
mov dword [ebp - 0x2d8], edx
mov ecx, dword [ebp - 0x2d8]
cmp dword [ecx*4 + 0x56850c], 0
jne 0x40e955
jmp 0x40ea53
mov word [ebp - 0x2bc], 0x24
xor eax, eax
mov dword [ebp - 0x2dc], eax
mov word [ebp - 0x2bc], 0x24
jmp 0x40e9ef
mov edx, dword [ebp - 0x2d0]
mov eax, dword [edx + 0x18]
mov edx, dword [ebp - 0x2dc]
call fcn.0042e2f8
mov dword [ebp - 0x2e0], eax
mov word [ebp - 0x2bc], 0x30
mov ecx, dword [ebp - 0x2d8]
mov edx, dword [ecx*4 + 0x56850c]
lea eax, [ebp - 8]
call fcn.005528c0
inc dword [ebp - 0x2b0]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x2e0]
call fcn.005529f8
push eax
dec dword [ebp - 0x2b0]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00552924
pop ecx
test cl, cl
je 0x40e9e9
mov eax, dword [ebp - 0x2e0]
mov edx, dword [eax + 4]
lea eax, [ebp - 4]
call fcn.005545bc
jmp 0x40ea07
inc dword [ebp - 0x2dc]
mov edx, dword [ebp - 0x2d0]
mov ecx, dword [edx + 0x18]
mov eax, dword [ecx + 8]
cmp eax, dword [ebp - 0x2dc]
jg 0x40e971
mov word [ebp - 0x2bc], 0x18
jmp 0x40ea20
inc dword [ebp - 0x2d4]
inc dword [ebp - 0x2d8]
push dword [ebp - 0x2d4]
mov edx, dword [ebp - 0x2d0]
push dword [edx + 0xc]
mov ecx, dword [ebp - 0x2d0]
call dword [ecx + 4]
add esp, 8
push 0xa
call sub.KERNEL32.DLL_Sleep
jmp 0x40e940
dec dword [ebp - 0x2b0]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00552f30
mov word [ebp - 0x2bc], 0
push 0x1f4
call sub.KERNEL32.DLL_Sleep
mov word [ebp - 0x2bc], 0x54
mov edx, 0x568b25
lea eax, [ebp - 0xc]
call fcn.00552794
inc dword [ebp - 0x2b0]
mov word [ebp - 0x2bc], 0x48
mov word [ebp - 0x2bc], 0x60
mov edx, 0x568b26
lea eax, [ebp - 0x10]
call fcn.00552794
inc dword [ebp - 0x2b0]
mov word [ebp - 0x2bc], 0x48
xor ecx, ecx
mov dword [ebp - 0x2d8], ecx
mov eax, dword [ebp - 0x2d8]
cmp dword [eax*4 + 0x56854c], 0
jne 0x40eae0
jmp 0x40edbc
mov edx, dword [ebp - 0x2d0]
add edx, 0x10
lea eax, [ebp - 0xc]
call fcn.0055294c
mov word [ebp - 0x2bc], 0x6c
mov edx, 0x568b27
lea eax, [ebp - 0x14]
call fcn.00552794
inc dword [ebp - 0x2b0]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00552960
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0x78
mov ecx, dword [ebp - 0x2d8]
mov edx, dword [ecx*4 + 0x56854c]
lea eax, [ebp - 0x18]
call fcn.005528c0
inc dword [ebp - 0x2b0]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00552960
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0x84
mov word [ebp - 0x2bc], 0x90
mov edx, 0x568b29
lea eax, [ebp - 0x1c]
call fcn.00552794
inc dword [ebp - 0x2b0]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00552b2c
test eax, eax
setg cl
and ecx, 1
push ecx
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00552924
pop ecx
test cl, cl
je 0x40ed5e
mov word [ebp - 0x2bc], 0x9c
lea edi, [ebp - 0x28c]
xor eax, eax
mov ecx, 0x270
rep stosb byte es:[edi], al
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
add eax, 0x14
call fcn.00407850
inc dword [ebp - 0x2b0]
inc dword [ebp - 0x2b0]
mov word [ebp - 0x2bc], 0xa8
mov dword [ebp - 0x2e8], 0x1ff
mov word [ebp - 0x2bc], 0xb4
xor edx, edx
mov dword [ebp - 0x290], edx
inc dword [ebp - 0x2b0]
mov word [ebp - 0x2bc], 0xa8
mov word [ebp - 0x2bc], 0xc0
xor ecx, ecx
mov dword [ebp - 0x294], ecx
lea edx, [ebp - 0x294]
inc dword [ebp - 0x2b0]
mov eax, dword [ebp - 0xc]
call fcn.00464e98
lea edx, [ebp - 0x294]
lea eax, [ebp - 0x290]
call fcn.0055294c
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.00552924
lea ecx, [ebp - 0x28c]
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0xc]
call fcn.00464c0c
test eax, eax
jne 0x40ed16
test byte [ebp - 0x27c], 0x10
je 0x40eca2
jmp 0x40ed07
mov word [ebp - 0x2bc], 0xcc
xor ecx, ecx
mov dword [ebp - 0x298], ecx
lea ecx, [ebp - 0x298]
inc dword [ebp - 0x2b0]
lea edx, [ebp - 0x278]
lea eax, [ebp - 0x290]
call fcn.00552974
lea edx, [ebp - 0x298]
mov edx, dword [edx]
mov eax, dword [ebp - 0x2d0]
call fcn.0040e454
cmp al, 1
sete cl
and ecx, 1
push ecx
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x298]
mov edx, 2
call fcn.00552924
pop ecx
test cl, cl
je 0x40ed07
lea eax, [ebp - 0x28c]
call fcn.00464c5c
test eax, eax
je 0x40ec97
lea eax, [ebp - 0x28c]
call fcn.00464c80
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x2b0]
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0x84
jmp 0x40ed70
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2d0]
call fcn.0040e454
cmp al, 1
jne 0x40ed70
mov word [ebp - 0x2bc], 0x48
jmp 0x40ed89
inc dword [ebp - 0x2d4]
inc dword [ebp - 0x2d8]
push dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0x2d0]
push dword [ecx + 0xc]
mov eax, dword [ebp - 0x2d0]
call dword [eax + 4]
add esp, 8
push 0x64
call sub.KERNEL32.DLL_Sleep
jmp 0x40eacb
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0
mov word [ebp - 0x2bc], 0xe4
mov word [ebp - 0x2bc], 0xf0
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
inc dword [ebp - 0x2b0]
mov word [ebp - 0x2bc], 0xfc
lea eax, [ebp - 0x2ec]
push eax
push 2
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
lea edx, [ebp - 0x3f8]
push edx
push dword [ebp - 0x2ec]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov word [ebp - 0x2bc], 0x108
lea edx, [ebp - 0x3f8]
lea eax, [ebp - 0x2a0]
call fcn.00552794
inc dword [ebp - 0x2b0]
lea edx, [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
call fcn.0055294c
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x2a0]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0x114
mov edx, str.Momi
lea eax, [ebp - 0x2a4]
call fcn.00552794
inc dword [ebp - 0x2b0]
lea edx, [ebp - 0x2a4]
lea eax, [ebp - 0x29c]
call fcn.00552960
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x2a4]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0x120
cmp dword [ebp - 0x29c], 0
je 0x40eedd
mov edx, dword [ebp - 0x29c]
jmp 0x40eee2
mov edx, 0x568b32
lea eax, [ebp - 0x2a8]
call fcn.005528c0
inc dword [ebp - 0x2b0]
push dword [eax]
push dword [ebp - 0x2d0]
call fcn.0040f184
add esp, 8
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x2a8]
mov edx, 2
call fcn.00552924
dec dword [ebp - 0x2b0]
lea eax, [ebp - 0x29c]
mov edx, 2
call fcn.00552924
mov word [ebp - 0x2bc], 0xe4
mov word [ebp - 0x2bc], 0
jmp 0x40ef51
mov word [ebp - 0x2bc], 0x138
lea ecx, [ebp - 0x2f0]
push ecx
push 0xf003f
push 0
push 0x568b34
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x2f4], eax
push 0
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegDeleteValueW
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifym3ldr
push closesocket
call sub.ADVAPI32.DLL_RegDeleteKeyA
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [ebp - 0x2f0]
push eax
push 0xf003f
push 0
push 0x568bba
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x2f4], eax
push 0x568bec
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [ebp - 0x2f0]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x2f4], eax
push 0x568c24
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegCloseKey
lea ecx, [ebp - 0x2f0]
push ecx
push 0xf003f
push 0
push 0x568c2b
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x2f4], eax
push str.btldr
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [ebp - 0x2f0]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x2f4], eax
push str.ntnaccount
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [ebp - 0x2f0]
push edx
push 0xf003f
push 0
push 0x568c99
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x2f4], eax
push 0
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegDeleteValueA
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallMomi3
push closesocket
call sub.ADVAPI32.DLL_RegDeleteKeyA
push dword [ebp - 0x2f0]
call sub.ADVAPI32.DLL_RegCloseKey
mov word [ebp - 0x2bc], 0
jmp 0x40f0ff
mov ecx, dword [ebp - 0x2d0]
push dword [ecx + 0xc]
mov eax, dword [ebp - 0x2d0]
call dword [eax + 8]
pop ecx
mov edx, dword [ebp - 0x2cc]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret