Function at 0x43bb20
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468131
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1fc
mov dword [ebp - 0x208], ecx
lea ecx, [ebp - 0x30]
call fcn.0045ee70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0045ee70
mov byte [ebp - 4], 1
push 1
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects]
push ecx
call fcn.0045fab0
test eax, eax
jge 0x43bb95
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0045e8e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0045e8e0
jmp 0x43c067
push 1
lea edx, [ebp - 0x54]
push edx
mov eax, dword [str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify]
push eax
call fcn.0045fab0
test eax, eax
jge 0x43bbca
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0045e8e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0045e8e0
jmp 0x43c067
mov dword [ebp - 0x58], 0
jmp 0x43bbdc
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x184]
jae 0x43c044
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x18]
jb 0x43bc06
push 0x80070057
call fcn.0040109c
mov edx, dword [ebp - 0x58]
imul edx, edx, 0x24
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
push eax
lea ecx, [ebp - 0x60]
call fcn.0040cbde
mov byte [ebp - 4], 2
push 0x47fe44
lea ecx, [ebp - 0x5c]
call fcn.0040204e
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x18c], ecx
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x18c]
push eax
call fcn.00463170
test eax, eax
jge 0x43bc91
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5c]
sub ecx, 0x10
mov dword [ebp - 0x190], ecx
mov ecx, dword [ebp - 0x190]
call fcn.00401741
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x60]
sub edx, 0x10
mov dword [ebp - 0x194], edx
mov ecx, dword [ebp - 0x194]
call fcn.00401741
jmp 0x43bbd3
lea eax, [ebp - 0x5c]
push eax
call fcn.00462490
test eax, eax
jge 0x43bcd9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5c]
sub ecx, 0x10
mov dword [ebp - 0x198], ecx
mov ecx, dword [ebp - 0x198]
call fcn.00401741
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x60]
sub edx, 0x10
mov dword [ebp - 0x19c], edx
mov ecx, dword [ebp - 0x19c]
call fcn.00401741
jmp 0x43bbd3
mov dword [ebp - 0x64], 0
jmp 0x43bceb
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x1a0], ecx
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x1a0]
jae 0x43c027
push 0x47fe44
lea ecx, [ebp - 0x174]
call fcn.0040204e
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x3c]
jb 0x43bd29
push 0x80070057
call fcn.0040109c
mov ecx, dword [ebp - 0x64]
imul ecx, ecx, 0x24
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x1a4], ecx
mov edx, dword [ebp - 0x1a4]
mov eax, dword [edx]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x1a8]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify_s
lea edx, [ebp - 0x174]
push edx
call fcn.0040ec1f
add esp, 0xc
mov dword [ebp - 0x170], 0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1b0], 0
lea ecx, [ebp - 0x1b0]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x1ac]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jne 0x43bdd1
lea ecx, [ebp - 0x170]
call fcn.00402280
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x1b4], 0
je 0x43be0c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x170]
call fcn.00402280
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x174]
sub ecx, 0x10
mov dword [ebp - 0x1b8], ecx
mov ecx, dword [ebp - 0x1b8]
call fcn.00401741
jmp 0x43bce2
mov dword [ebp - 0x178], 0x104
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x16c]
push eax
push str.DllName
lea ecx, [ebp - 0x170]
call fcn.004290b0
test eax, eax
je 0x43be6a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x170]
call fcn.00402280
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x174]
sub ecx, 0x10
mov dword [ebp - 0x1c8], ecx
mov ecx, dword [ebp - 0x1c8]
call fcn.00401741
jmp 0x43bce2
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x17c]
call fcn.00409a7c
mov byte [ebp - 4], 6
lea eax, [ebp - 0x17c]
push eax
call fcn.00462490
test eax, eax
jge 0x43bee0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x17c]
sub ecx, 0x10
mov dword [ebp - 0x1d0], ecx
mov ecx, dword [ebp - 0x1d0]
call fcn.00401741
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x170]
call fcn.00402280
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x174]
sub edx, 0x10
mov dword [ebp - 0x1d4], edx
mov ecx, dword [ebp - 0x1d4]
call fcn.00401741
jmp 0x43bce2
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1d8], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x1dc], ecx
mov edx, dword [ebp - 0x1d8]
push edx
mov eax, dword [ebp - 0x1dc]
push eax
call fcn.0044b67a
add esp, 8
test eax, eax
jne 0x43bfd0
mov ecx, dword [ebp - 0x5c]
push ecx
push str.winlogon
mov ecx, dword [ebp - 0x208]
call fcn.0043b9a0
mov dword [ebp - 0x180], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x17c]
sub edx, 0x10
mov dword [ebp - 0x1e0], edx
mov ecx, dword [ebp - 0x1e0]
call fcn.00401741
mov byte [ebp - 4], 4
mov dword [ebp - 0x1e4], 0
cmp dword [ebp - 0x170], 0
je 0x43bf83
mov eax, dword [ebp - 0x170]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x170], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x174]
call fcn.00402073
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.00402073
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.00402073
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0045e8e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0045e8e0
mov eax, dword [ebp - 0x180]
jmp 0x43c069
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x17c]
call fcn.00402073
mov byte [ebp - 4], 4
mov dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x170], 0
je 0x43c013
mov ecx, dword [ebp - 0x170]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x170], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x174]
call fcn.00402073
jmp 0x43bce2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.00402073
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.00402073
jmp 0x43bbd3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0045e8e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0045e8e0
xor edx, edx
jne 0x43bb44
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret