Function at 0x4422d0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
mov ecx, 3
push ebx
push esi
push edi
mov esi, 0x521344
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x521351]
pop edi
mov dword [ebp - 0x18], eax
xor esi, esi
mov ax, word [0x521355]
mov word [ebp - 0x14], ax
test bl, 1
je 0x442316
mov eax, ebx
jmp 0x442a97
test bh, 0x20
jne 0x442348
test bh, 0x40
jne 0x442348
test bh, 0x10
jne 0x442348
test bh, 0x80
jne 0x442348
test ebx, 0x10000
jne 0x442348
test ebx, 0x40000
jne 0x442348
test ebx, 0x20000
jne 0x442348
or ebx, 0x7f000
test bh, 0x20
je 0x442448
push 0x5eb1c3
lea edx, [ebp - 0x218]
push edx
call fcn.004d75f8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000001
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x442448
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x442448
test bl, 0x20
je 0x4423fd
test edi, edi
jne 0x4423d1
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000001
call fcn.00406a4c
add esp, 0x14
jmp 0x4423ec
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000001
call fcn.00406a4c
add esp, 0x14
test eax, eax
jne 0x4423f5
or esi, 1
jmp 0x44243c
or esi, 0x2000
jmp 0x44243c
test edi, edi
je 0x44242a
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x2000
test bl, 0x80
je 0x44243c
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x442448
mov eax, esi
jmp 0x442a97
test bh, 0x40
je 0x442548
push 0x5eb1fd
lea edx, [ebp - 0x218]
push edx
call fcn.004d75f8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x442548
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x442548
test bl, 0x20
je 0x4424fd
test edi, edi
jne 0x4424d1
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a4c
add esp, 0x14
jmp 0x4424ec
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000002
call fcn.00406a4c
add esp, 0x14
test eax, eax
jne 0x4424f5
or esi, 1
jmp 0x44253c
or esi, 0x4000
jmp 0x44253c
test edi, edi
je 0x44252a
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x4000
test bl, 0x80
je 0x44253c
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x442548
mov eax, esi
jmp 0x442a97
test bh, 0x10
je 0x44268f
push 0x5eb237
lea edx, [ebp - 0x418]
push edx
call fcn.004d75f8
add esp, 8
lea ecx, [ebp - 0x218]
mov byte [ebp - 0x218], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x418]
push edx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x44268f
push 4
push 0x5eb283
lea ecx, [ebp - 0x218]
push ecx
call fcn.004d3138
add esp, 0xc
test eax, eax
jne 0x44268f
test bl, 0x20
je 0x442617
test edi, edi
jne 0x4425e1
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x214]
push ecx
push 0x80000001
call fcn.00406a4c
add esp, 0x14
jmp 0x4425fc
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x214]
push eax
push edx
push 0x80000001
call fcn.00406a4c
add esp, 0x14
test eax, eax
jne 0x442605
or esi, 1
jmp 0x44260b
or esi, 0x1000
test bl, 0x80
je 0x442683
mov eax, esi
jmp 0x442a97
mov byte [ebp - 0x418], 0
push 1
lea edx, [ebp - 0x418]
push 0x200
push edx
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x214]
push ecx
push eax
push 0x80000001
call fcn.00406a10
add esp, 0x18
test edi, edi
je 0x442671
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x1000
test bl, 0x80
je 0x442683
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x44268f
mov eax, esi
jmp 0x442a97
test bh, 0x80
je 0x442799
push 0x5eb288
lea edx, [ebp - 0x218]
push edx
call fcn.004d75f8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x442799
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x442799
test bl, 0x20
je 0x44274e
test edi, edi
jne 0x442718
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a4c
add esp, 0x14
jmp 0x442733
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000002
call fcn.00406a4c
add esp, 0x14
test eax, eax
jne 0x44273c
or esi, 1
jmp 0x442742
or esi, 0x8000
test bl, 0x80
je 0x44278d
mov eax, esi
jmp 0x442a97
test edi, edi
je 0x44277b
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x8000
test bl, 0x80
je 0x44278d
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x442799
mov eax, esi
jmp 0x442a97
test ebx, 0x40000
je 0x4428a6
push 0x5eb2be
lea edx, [ebp - 0x218]
push edx
call fcn.004d75f8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000001
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x4428a6
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x4428a6
test bl, 0x20
je 0x44285b
test edi, edi
jne 0x442825
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000001
call fcn.00406a4c
add esp, 0x14
jmp 0x442840
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000001
call fcn.00406a4c
add esp, 0x14
test eax, eax
jne 0x442849
or esi, 1
jmp 0x44284f
or esi, 0x40000
test bl, 0x80
je 0x44289a
mov eax, esi
jmp 0x442a97
test edi, edi
je 0x442888
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x40000
test bl, 0x80
je 0x44289a
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x4428a6
mov eax, esi
jmp 0x442a97
mov edx, ebx
and edx, 0x10000
test edx, edx
je 0x4429be
push 0x5eb2f4
lea ecx, [ebp - 0x218]
push ecx
call fcn.004d75f8
add esp, 8
lea eax, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x4429be
mov al, byte [ebp - 0x418]
test al, al
je 0x4429be
mov edx, ebx
and edx, 0x10000
test edx, edx
je 0x442973
test edi, edi
jne 0x44293d
push 1
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a4c
add esp, 0x14
jmp 0x442958
push 1
push edi
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x218]
push ecx
push eax
push 0x80000002
call fcn.00406a4c
add esp, 0x14
test eax, eax
jne 0x442961
or esi, 1
jmp 0x442967
or esi, 0x10000
test bl, 0x80
je 0x4429b2
mov eax, esi
jmp 0x442a97
test edi, edi
je 0x4429a0
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x10000
test bl, 0x80
je 0x4429b2
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x4429be
mov eax, esi
jmp 0x442a97
test ebx, 0x20000
je 0x442a92
push esi
push edi
lea edi, [ebp - 0x218]
mov esi, 0x5eb336
mov eax, edi
lea edx, [ebp - 0x218]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebp - 0x418], 0
push edx
lea ecx, [ebp - 0x418]
push 0x5eb346
push ecx
lea eax, [ebp - 0x18]
push eax
push 0x5eb341
call fcn.0040ca3c
add esp, 0x14
test bl, 0x20
je 0x442a4d
test edi, edi
jne 0x442a2f
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x18]
push eax
push 0x5eb347
call fcn.0040c948
jmp 0x442a45
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x18]
push edx
push edi
push ecx
push 0x5eb34c
call fcn.0040c948
or esi, 0x20000
jmp 0x442a89
test edi, edi
je 0x442a7a
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x20000
test bl, 0x80
je 0x442a89
mov eax, esi
jmp 0x442a97
test bl, 0x40
je 0x442a92
mov eax, esi
jmp 0x442a97
or esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret