Function at 0x750d9c
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x750da4
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x75119f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x768]
mov edx, dword [eax]
call dword [edx + 0x38c]
mov eax, dword [ebx + 0xcd4]
test eax, eax
jne 0x750dfa
mov ecx, ebx
mov dl, 1
mov eax, dword [0x475134]
call fcn.00485acc
mov esi, eax
mov dword [ebx + 0xcd4], esi
mov edx, 0xff000005
mov eax, esi
call fcn.004864d4
jmp 0x750dff
call fcn.004864c8
mov ecx, 1
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 0x36
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 0x1e
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 0x29
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
xor ecx, ecx
mov edx, dword [ebx + 0x2f8]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 0x34
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 2
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 0x3a
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov ecx, 0x18
mov edx, dword [ebx + 0x30c]
mov eax, dword [ebx + 0xcd4]
call fcn.004869ac
mov edx, dword [ebx + 0xcd4]
mov eax, dword [ebx + 0x768]
call fcn.005482dc
lea ecx, [ebp - 4]
mov edx, 7
mov eax, dword [0x7ce794]
call fcn.0079596c
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov edx, dword [ebp - 8]
mov ecx, dword [ebx + 0x768]
pop eax
call fcn.006d782c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jle 0x750f44
lea ecx, [ebp - 0xc]
mov edx, 0x18
mov eax, dword [0x7ce794]
call fcn.0079596c
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x768]
pop eax
call fcn.006d782c
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x14]
mov edx, 0x7511b4
mov eax, 0x80000002
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x18]
mov edx, 0x7511ec
mov eax, 0x80000002
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x1c]
mov edx, 0x75122c
mov eax, 0x80000002
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x20]
mov edx, 0x751268
mov eax, 0x80000002
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x24]
mov edx, 0x7512ac
mov eax, 0x80000002
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x28]
mov edx, 0x7512e8
mov eax, 0x80000002
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov ecx, dword [ebp - 0x2c]
mov edx, 0x7511b4
mov eax, 0x80000001
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov ecx, dword [ebp - 0x30]
mov edx, 0x7511ec
mov eax, 0x80000001
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x34]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov ecx, dword [ebp - 0x34]
mov edx, 0x75122c
mov eax, 0x80000001
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov ecx, dword [ebp - 0x38]
mov edx, 0x751268
mov eax, 0x80000001
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov ecx, dword [ebp - 0x3c]
mov edx, 0x7512ac
mov eax, 0x80000001
call fcn.006d8be8
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x40]
mov eax, dword [0x7b8b60]
call fcn.00407bd4
mov ecx, dword [ebp - 0x40]
mov edx, 0x7512e8
mov eax, 0x80000001
call fcn.006d8be8
lea edx, [ebp - 0x44]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebx + 0x768]
push eax
mov ecx, 0x751330
mov edx, 0x751344
mov eax, 0x80000002
call fcn.006d8498
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x48]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x48]
mov edx, 0x751384
mov eax, 0x80000002
call fcn.006d8730
mov eax, dword [ebx + 0x768]
push eax
lea edx, [ebp - 0x4c]
mov eax, dword [0x7b9a40]
call fcn.00407bd4
mov ecx, dword [ebp - 0x4c]
mov edx, 0x7513d4
mov eax, 0x80000002
call fcn.006d8730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7511a6
lea eax, [ebp - 0x4c]
mov edx, 0x13
call fcn.0040553c
ret