Function at 0x6bb14c
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x6bb154
push ebx
push esi
push edi
mov ebx, eax
mov edi, 0x8bb9c8
xor eax, eax
push ebp
push 0x6bb6dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6bb6f8
call fcn.00662c34
push 0x27d9
xor ecx, ecx
mov edx, 0x80000002
mov eax, ebx
call fcn.006b2bf8
mov eax, 0x6bb724
call fcn.00662c34
push 0x27d9
xor ecx, ecx
mov edx, 0x80000001
mov eax, ebx
call fcn.006b2bf8
mov eax, 0x6bb750
call fcn.00662c34
mov dl, 1
mov eax, dword [0x60799c]
call fcn.00608b7c
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x47e80c]
call fcn.004a2178
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
call fcn.0040a790
mov eax, dword [ebp - 8]
cmp dword [eax + 0x16], 0
je 0x6bb1f6
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x16]
call fcn.0040abb8
jmp 0x6bb1fe
lea eax, [ebp - 4]
call fcn.006ada24
mov eax, 0x6bb77c
call fcn.00662c34
mov edx, 0x80000003
mov eax, dword [ebp - 8]
call fcn.00608c44
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00608f2c
test al, al
je 0x6bb236
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006093f8
mov eax, dword [ebp - 8]
call fcn.00608c10
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.00408ac4
mov eax, 0x6bb7a8
call fcn.00662c34
push 0x27da
xor ecx, ecx
mov edx, 0x80000002
mov eax, ebx
call fcn.006b420c
mov eax, ebx
call fcn.006b72f4
mov eax, ebx
call fcn.006b7098
push 0x6bb7d4
push 0xc350
push 0x6bb804
push 0x6bb824
lea eax, [ebp - 0x14]
mov ecx, 0x6bb838
mov edx, dword [0x8bb9cc]
call fcn.0040ba64
mov ecx, dword [ebp - 0x14]
mov edx, 0x80000002
mov eax, ebx
call fcn.006b2038
mov eax, 0x6bb86c
call fcn.00662c34
push 0x4e85
lea eax, [ebp - 0x18]
mov ecx, 0x6bb898
mov edx, dword [0x8bb9c4]
call fcn.0040ba64
mov ecx, dword [ebp - 0x18]
mov edx, 0x80000002
mov eax, ebx
call fcn.006bad3c
push 0x4ee9
lea eax, [ebp - 0x1c]
mov ecx, 0x6bb8b4
mov edx, dword [0x8bb9c4]
call fcn.0040ba64
mov ecx, dword [ebp - 0x1c]
mov edx, 0x80000002
mov eax, ebx
call fcn.006ba8f0
mov eax, 0x6bb8dc
call fcn.00662c34
mov eax, ebx
call fcn.006b870c
xor ecx, ecx
mov edx, 0x27e6
mov eax, ebx
call fcn.006b7548
mov ecx, 0x6bb908
mov edx, 0x27e6
mov eax, ebx
call fcn.006b7548
mov eax, 0x6bb918
call fcn.00662c34
xor ecx, ecx
mov edx, 0x27ec
mov eax, ebx
call fcn.006b96f4
mov ecx, 0x6bb908
mov edx, 0x27ec
mov eax, ebx
call fcn.006b96f4
push 0
lea eax, [ebp - 0x20]
mov ecx, 0x6bb944
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x20]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b8e5c
push 0x6bb908
lea eax, [ebp - 0x24]
mov ecx, 0x6bb944
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x24]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b8e5c
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x6bb998
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x28]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b8e5c
push 0x6bb908
lea eax, [ebp - 0x2c]
mov ecx, 0x6bb998
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x2c]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b8e5c
mov eax, 0x6bb9f4
call fcn.00662c34
push 0
lea eax, [ebp - 0x30]
mov ecx, 0x6bba20
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x30]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b9500
push 0x6bb908
lea eax, [ebp - 0x34]
mov ecx, 0x6bba20
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x34]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b9500
push 0
lea eax, [ebp - 0x38]
mov ecx, 0x6bba60
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x38]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b9500
push 0x6bb908
lea eax, [ebp - 0x3c]
mov ecx, 0x6bba60
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x3c]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b9500
mov eax, 0x6bbaa0
call fcn.00662c34
xor ecx, ecx
mov edx, 0x27ef
mov eax, ebx
call fcn.006b84b8
mov ecx, 0x6bb908
mov edx, 0x27ef
mov eax, ebx
call fcn.006b84b8
xor ecx, ecx
mov edx, 0x27f0
mov eax, ebx
call fcn.006b9050
mov ecx, 0x6bb908
mov edx, 0x27f0
mov eax, ebx
call fcn.006b9050
xor ecx, ecx
mov edx, 0x27f1
mov eax, ebx
call fcn.006b3fd0
mov ecx, 0x6bb908
mov edx, 0x27f1
mov eax, ebx
call fcn.006b3fd0
mov eax, 0x6bbacc
call fcn.00662c34
xor ecx, ecx
mov edx, 0x138e4
mov eax, ebx
call fcn.006b7aa8
mov ecx, 0x6bb908
mov edx, 0x138e4
mov eax, ebx
call fcn.006b7aa8
xor ecx, ecx
mov edx, 0x13948
mov eax, ebx
call fcn.006b7768
mov ecx, 0x6bb908
mov edx, 0x13948
mov eax, ebx
call fcn.006b7768
mov eax, 0x6bbaf8
call fcn.00662c34
push 0x9c41
lea eax, [ebp - 0x40]
mov ecx, 0x6bbb24
mov edx, dword [0x8bb9c0]
call fcn.0040ba64
mov ecx, dword [ebp - 0x40]
mov edx, 0x80000002
mov eax, ebx
call fcn.006ba570
xor ecx, ecx
mov edx, 0x7595
mov eax, ebx
call fcn.006b6c30
mov ecx, 0x6bb908
mov edx, 0x7595
mov eax, ebx
call fcn.006b6c30
mov eax, 0x6bbb70
call fcn.00662c34
xor ecx, ecx
mov edx, 0x18704
mov eax, ebx
call fcn.006b6760
mov ecx, 0x6bb908
mov edx, 0x18704
mov eax, ebx
call fcn.006b6760
xor ecx, ecx
mov edx, 0x18768
mov eax, ebx
call fcn.006b69c8
mov ecx, 0x6bb908
mov edx, 0x18768
mov eax, ebx
call fcn.006b69c8
push 0x27da
xor ecx, ecx
mov edx, 0x80000001
mov eax, ebx
call fcn.006b420c
mov eax, 0x6bbb9c
call fcn.00662c34
mov eax, ebx
call fcn.006b3e44
mov eax, ebx
call fcn.006b9938
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov esi, eax
test esi, esi
jl 0x6bb5f8
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6bb6aa
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6bb6aa
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea ecx, [ebp - 0x48]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
mov edx, 0x6bbbc8
call fcn.0040ba64
mov eax, dword [ebp - 0x44]
call fcn.00662c34
push 0x27d9
lea ecx, [ebp - 0x4c]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x4c]
mov edx, 0x6bbc14
call fcn.0040ba0c
mov ecx, dword [ebp - 0x4c]
mov edx, 0x80000003
mov eax, ebx
call fcn.006b2bf8
push 0x27da
lea ecx, [ebp - 0x50]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x50]
mov edx, 0x6bbc14
call fcn.0040ba0c
mov ecx, dword [ebp - 0x50]
mov edx, 0x80000003
mov eax, ebx
call fcn.006b420c
inc esi
dec dword [ebp - 0x10]
jne 0x6bb61f
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.00408ac4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bb6e3
lea eax, [ebp - 0x50]
mov edx, 0x10
call fcn.0040a7f0
lea eax, [ebp - 4]
call fcn.0040a790
ret