Function at 0x589670
Capabilities:
Acquire debug privileges
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad680
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x120], eax
xor esi, esi
mov byte [eax], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], esi
mov dword [ebp - 4], esi
movups xmm0, xmmword [str.explorer.exe]
mov ax, word [0x5fb73c]
push 0xe6
mov word [ebp - 0xf8], ax
lea eax, [ebp - 0xf6]
movups xmmword [ebp - 0x110], xmm0
push esi
movq xmm0, qword [0x5fb734]
push eax
movq qword [ebp - 0x100], xmm0
call fcn.004c76f0
lea edi, [ebp - 0x110]
add esp, 0xc
mov dword [ebp - 0x11c], edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], esi
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x58974e
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x128], eax
mov byte [ebp - 4], 0
test eax, eax
jne 0x58982d
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x130]
push eax
push 0
push str.Shell
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5897bb
mov eax, dword [ebp - 0x130]
cmp eax, 1
je 0x58979b
cmp eax, 2
jne 0x5897b6
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x5897e0
test al, 1
jne 0x5897b6
shr eax, 1
cmp word [ebp + eax*2 - 0x112], 0
je 0x5897e9
mov eax, 0xd
push 0
push 0
push eax
push str.CRegKey::QueryStringValue
push 0x57
push 0x783
push str.C:drone_src_srcCommonIPCWinsecAPI.cpp
push str.CWinsecApiUtil::GetUserToken
call fcn.00573980
add esp, 0x20
jmp 0x58980e
xor eax, eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.004c931d
add esp, 8
test eax, eax
je 0x58980e
lea ecx, [ebp - 0x12]
cmp eax, ecx
jae 0x58980e
add eax, 2
mov dword [ebp - 0x11c], eax
test esi, esi
je 0x589821
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x128], 0
jmp 0x589850
push 0
push 0
push eax
push str.CRegKey::Open
push 0x45
push 0x793
push str.C:drone_src_srcCommonIPCWinsecAPI.cpp
push str.CWinsecApiUtil::GetUserToken
call fcn.00573980
add esp, 0x20
mov ecx, str.SeDebugPrivilege
call fcn.00589dd0
mov ecx, str.SeAssignPrimaryTokenPrivilege
call fcn.00589dd0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x5898d2
push dword [ebp - 0x120]
mov edx, edi
push ecx
mov ecx, dword [ebp - 0x11c]
call fcn.00589930
add esp, 8
mov dword [ebp - 0x118], eax
test eax, eax
jne 0x5898c9
push str.explorer.exe
push dword [ebp - 0x11c]
call fcn.004d879e
add esp, 8
test eax, eax
je 0x5898c9
push dword [ebp - 0x120]
mov edx, edi
push ecx
mov ecx, str.explorer.exe
call fcn.00589930
add esp, 8
mov dword [ebp - 0x118], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5898fb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5fb870
push 0x45
push 0x7bd
push str.C:drone_src_srcCommonIPCWinsecAPI.cpp
push str.CWinsecApiUtil::GetUserToken
call fcn.00573980
add esp, 0x20
test esi, esi
je 0x589906
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret