Function at 0x4037b0
Capabilities:
Accept command line arguments
Acquire debug privileges
Create process on windows
Create process suspended
Get common file path
Persist via winlogon helper dll registry key
Set current directory
Set registry value

Disassembly:
sub rsp, 0xb58
mov edx, 0x104
mov qword [rsp + 0xb20], rbx
lea rbx, [rsp + 0x870]
mov qword [rsp + 0xb28], rsi
mov qword [rsp + 0xb30], rdi
mov qword [rsp + 0xb38], rbp
mov qword [rsp + 0xb40], r12
mov qword [rsp + 0xb48], r13
mov rcx, rbx
mov qword [rsp + 0xb50], r14
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x401e21
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x401e21
lea rcx, str.SeDebugPrivilege
call fcn.004029c0
test eax, eax
je 0x401ee0
lea rax, [rsp + 0xb10]
xor r8d, r8d
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401e60
lea rcx, str.explorer.exe
call sub.msvcrt.dll_wcslen
lea eax, [rax + rax + 2]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Shell
mov rcx, qword [rsp + 0xb10]
mov rbx, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], eax
mov rax, qword [section..data]
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
jne 0x401f10
lea rdx, [rsp + 0xa80]
xor eax, eax
mov ecx, 0xd
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rsp + 0xaf0]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0xa80], 0x68
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 4
lea rcx, str.explorer.exe
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401f00
mov rsi, qword [rsp + 0xaf0]
mov rcx, rsi
call fcn.00402580
test rax, rax
mov rdi, rax
je 0x4022e5
mov rdx, rax
mov rcx, rsi
call fcn.00402810
test eax, eax
mov ebp, eax
je 0x402261
mov edx, eax
mov r8d, 2
mov rcx, rsi
lea rdx, [rdi + rdx]
call fcn.004026c0
test eax, eax
mov r12d, eax
je 0x4022a3
lea r13, [rsp + 0xb1c]
mov ecx, 0x1a91
mov rdx, r13
call fcn.00402a90
test rax, rax
je 0x402327
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a91
call fcn.00402b20
test eax, eax
je 0x402220
mov rdx, r13
mov ecx, 0x1a92
call fcn.00402a90
test rax, rax
je 0x402347
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a92
call fcn.00402b20
test eax, eax
je 0x4021d5
mov rdx, r13
mov ecx, 0x1a93
call fcn.00402a90
test rax, rax
je 0x402387
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a93
call fcn.00402b20
test eax, eax
je 0x402194
mov rdx, r13
mov ecx, 0x1a94
call fcn.00402a90
test rax, rax
je 0x402367
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a94
call fcn.00402b20
test eax, eax
je 0x402153
mov rdx, r13
mov ecx, 0x1a95
call fcn.00402a90
test rax, rax
je 0x402407
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a95
call fcn.00402b20
test eax, eax
je 0x402112
mov rdx, r13
mov ecx, 0x1a96
call fcn.00402a90
test rax, rax
je 0x4023e7
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a96
call fcn.00402b20
test eax, eax
je 0x4020d1
mov rdx, r13
mov ecx, 0x1a97
call fcn.00402a90
test rax, rax
je 0x4023c7
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a97
call fcn.00402b20
test eax, eax
je 0x402090
mov rdx, r13
mov ecx, 0x1a98
call fcn.00402a90
test rax, rax
je 0x4023a7
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a98
call fcn.00402b20
test eax, eax
je 0x402045
mov rdx, r13
mov ecx, 0x1a99
call fcn.00402a90
test rax, rax
je 0x402487
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a99
call fcn.00402b20
test eax, eax
je 0x402004
mov rdx, r13
mov ecx, 0x1a9a
call fcn.00402a90
test rax, rax
je 0x402467
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a9a
call fcn.00402b20
test eax, eax
je 0x401fc3
mov rdx, r13
mov ecx, 0x1a9b
call fcn.00402a90
test rax, rax
je 0x402447
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a9b
call fcn.00402b20
test eax, eax
je 0x401f82
mov rdx, r13
mov ecx, 0x1a9c
call fcn.00402a90
test rax, rax
je 0x402427
mov edx, dword [rsp + 0xb1c]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x30], edx
mov edx, 0x1a9c
call fcn.00402b20
test eax, eax
je 0x401f41
mov rax, qword [rsp + 0xaf0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb00]
mov qword [rsp + 0x60], rax
call fcn.00401820
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.expstart.exe
call sub.msvcrt.dll_wcslen
lea eax, [rax + rax + 2]
xor r8d, r8d
mov r9d, 1
lea rdx, str.Shell
mov rcx, qword [rsp + 0xb10]
mov dword [rsp + 0x28], eax
mov rax, qword [str.expstart.exe]
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
jne 0x401f30
mov rcx, qword [rsp + 0xb10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401e9b
lea rbx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov r8d, eax
lea rdx, str.Failed_to_set_Windows_directory_as_current:__u_n
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4018ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0x70]
lea rdx, str.Failed_to_open_registry_key_n
mov r8d, eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov rbx, qword [rsp + 0xb20]
mov rsi, qword [rsp + 0xb28]
mov rdi, qword [rsp + 0xb30]
mov rbp, qword [rsp + 0xb38]
mov r12, qword [rsp + 0xb40]
mov r13, qword [rsp + 0xb48]
mov r14, qword [rsp + 0xb50]
add rsp, 0xb58
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0x70]
mov r8d, eax
lea rdx, str.Failed_to_enable_debugging_privileges:__u_n
jmp 0x401e75
lea rcx, str.Failed_to_create_process:__u_n
call fcn.004017b0
jmp 0x401e9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0x70]
mov r8d, eax
lea rdx, str.Failed_to_set_registry_value_n
jmp 0x401e75
lea rcx, str.Failed_to_re_set_registry_value_n
call fcn.004017b0
jmp 0x401e9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a9c
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a9b
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401d48
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a9a
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401d02
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a99
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401cbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a98
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401c76
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a97
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401c30
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a96
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401bea
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a95
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401ba4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a94
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401b5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a93
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401b18
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a92
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401ad2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
lea rdx, str.Failed_to_update_BITMAP__u:__u_n
mov r9d, eax
mov r8d, 0x1a91
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.expstart.exe
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401a8c
mov rax, qword [rsp + 0xaf0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb00]
mov qword [rsp + 0x60], rax
call fcn.00401820
lea rcx, str.Failed_to_find_RSRC_section:__u_n
call fcn.004017b0
jmp 0x401e9b
mov rax, qword [rsp + 0xaf0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb00]
mov qword [rsp + 0x60], rax
call fcn.00401820
lea rcx, str.Failed_to_find_BITMAP_directory_entry:__u_n
call fcn.004017b0
jmp 0x401e9b
mov rax, qword [rsp + 0xaf0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb00]
mov qword [rsp + 0x60], rax
call fcn.00401820
lea rcx, str.Failed_to_get_base_address:__u_n
call fcn.004017b0
jmp 0x401e9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a91
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x40223b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a92
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x4021f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a94
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x40216e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a93
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x4021af
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a98
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x402060
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a97
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x4020ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a96
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x4020ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a95
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x40212d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a9c
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x401f5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a9b
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x401f9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a9a
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x401fde
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x70]
mov r9d, eax
mov r8d, 0x1a99
lea rdx, str.Failed_to_get_resource__u:__u_n
jmp 0x40201f
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
sub rsp, 0x38
mov dword [rsp + 0x28], r9d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
mov rax, qword [sym.imp.msvcrt.dll___argc]
mov r9d, dword [rsp + 0x28]
cmp dword [rax], 1
je 0x402540
movzx edx, word [r8]
add r8, 2
movzx eax, word [r8]
test ax, ax
je 0x40252d
cmp dx, 0x22
sete dl
movzx edx, dl
jmp 0x402513
cmp ax, 0x20
je 0x402560
add r8, 2
movzx eax, word [r8]
test ax, ax
je 0x40252d
test edx, edx
je 0x402500
xor edx, edx
cmp ax, 0x22
setne dl
add r8, 2
movzx eax, word [r8]
test ax, ax
jne 0x402513
add rsp, 0x38
mov rcx, rbx
mov rdx, rsi
pop rbx
pop rsi
jmp 0x401880
add r8, 2
cmp word [r8], 0
je 0x40252d
add r8, 2
cmp word [r8], 0
jne 0x402540
jmp 0x40252d
add r8, 2
cmp word [r8], 0x20
jne 0x40252d
add r8, 2
cmp word [r8], 0x20
je 0x402560
jmp 0x40252d
sub rsp, 0x28
call fcn.00404010
mov r9d, dword [0x00407978]
mov r8, qword [0x00407970]
xor edx, edx
mov rcx, qword [0x00407980]
add rsp, 0x28
jmp 0x4024b0