Function at 0x5a67d0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5a67d8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5a6b29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 0x14], eax
mov edx, 0x5a6b40
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6b54
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6b6c
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6b80
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6b98
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6bb0
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6bc8
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6bdc
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6bf4
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6c20
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6c38
mov eax, dword [ebp - 0x14]
call fcn.00413a78
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.0059743c
lea eax, [ebp - 0x1c]
mov edx, 0x5a6c50
call fcn.00404198
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6c64
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6c80
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6c98
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6cb0
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6cfc
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6d48
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6d84
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6d9c
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov edx, 0x5a6db0
mov eax, dword [ebp - 0x14]
call fcn.00413a78
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 0x10], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.004568c0
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004568c0
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, 0x5a6dc8
mov eax, dword [ebp - 4]
call fcn.00456a04
test al, al
jne 0x5a6998
mov eax, dword [ebp - 4]
call fcn.00403170
mov eax, dword [ebp - 8]
call fcn.00403170
jmp 0x5a6b0e
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00456e10
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5a6af6
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x5a6e10
call fcn.004041dc
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.00456a04
test al, al
je 0x5a6ac6
xor eax, eax
push ebp
push 0x5a6abc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5a6e58
mov eax, dword [ebp - 0x10]
call fcn.00457200
test al, al
je 0x5a6ab2
lea ecx, [ebp - 0x28]
mov edx, 0x5a6e58
mov eax, dword [ebp - 0x10]
call fcn.00457068
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x50]
inc eax
jne 0x5a6ab2
lea ecx, [ebp - 0x30]
mov edx, 0x5a6e58
mov eax, dword [ebp - 0x10]
call fcn.00457068
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00408fbc
mov edx, dword [ebp - 0x2c]
mov eax, 0x5a6e68
call fcn.0040447c
test eax, eax
jne 0x5a6ab2
push 0x5a6e7c
lea edx, [ebp - 0x38]
mov eax, 1
call fcn.0059743c
push dword [ebp - 0x38]
push 0x5a6e98
lea ecx, [ebp - 0x3c]
mov edx, 0x5a6e58
mov eax, dword [ebp - 0x10]
call fcn.00457068
push dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00404250
mov edx, dword [ebp - 0x34]
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
call fcn.00413a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a6ac6
mov eax, dword [ebp - 0x10]
call fcn.00403170
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 0x10], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.004568c0
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x5a69bf
mov eax, dword [ebp - 0x10]
call fcn.00403170
mov eax, dword [ebp - 4]
call fcn.00403170
mov eax, dword [ebp - 0x14]
call fcn.00403170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6b30
lea eax, [ebp - 0x3c]
mov edx, 9
call fcn.00403f34
ret