Function at 0x41be13
Capabilities:
Get common file path
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x44de90]
or dword [ebp - 0x78], 0xffffffff
push ebx
push esi
push edi
mov dword [ebp + 0xbbc], eax
push 0x400
lea eax, [ebp + 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + 0x390]
push str.winxp.exe
push eax
call fcn.00425610
pop ecx
pop ecx
push 0xa
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSafeBoot
lea edi, [ebp + 0xb90]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74]
push eax
push 0x2001f
xor ebx, ebx
push ebx
lea eax, [ebp + 0xb90]
push eax
push 0x80000002
mov dword [ebp - 0x74], ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41becc
mov byte [ebp - 0x70], bl
mov ecx, 0xff
lea edi, [ebp - 0x6f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.AlternateShell
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41bed3
xor eax, eax
jmp 0x41c348
lea eax, [ebp - 0x70]
push eax
call fcn.0043109b
mov esi, eax
lea eax, [ebp + 0x390]
push eax
call fcn.0043109b
push eax
push esi
call fcn.00425fe0
add esp, 0x10
test eax, eax
je 0x41c345
push str.Registry_contains_values_from_Worm.Win32.VB.gj__variants__nTrying_to_remove_the_malicious_registry_keys._n
call fcn.00419ab0
push ebx
push ebx
push ebx
push ebx
push str.winxp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.0041aa5e
add esp, 0x20
test al, al
je 0x41bf30
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionRunwinxp_value_was_removed._n
call fcn.00419ab0
pop ecx
mov esi, str.Explorer.exe
lea edi, [ebp + 0x790]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, 0xfc
lea edi, [ebp + 0x79d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x790]
push ebx
push eax
call fcn.00425700
pop ecx
inc eax
push eax
lea eax, [ebp + 0x790]
push eax
push 1
push ebx
push str.Shell
mov edi, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push edi
mov esi, 0x80000002
push esi
call fcn.0041af74
add esp, 0x20
test al, al
je 0x41bf93
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogonShell_value_was_restored._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push 1
lea eax, [ebp + 0x390]
push eax
push str.Userinit
push edi
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41bfbc
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogonUserinit_value_was_restored._n
call fcn.00419ab0
pop ecx
lea eax, [ebp + 0x790]
push str.cmd.exe
push eax
call fcn.00425600
pop ecx
pop ecx
lea eax, [ebp + 0x790]
push ebx
push eax
call fcn.00425700
pop ecx
inc eax
push eax
lea eax, [ebp + 0x790]
push eax
push 1
push ebx
push str.AlternateShell
push str.SystemCurrentControlSetControlSafeBoot
push esi
call fcn.0041af74
add esp, 0x20
test al, al
je 0x41c00b
push str.HKLMSystemCurrentControlSetControlSafeBootAlternateShell_value_was_restored._n
call fcn.00419ab0
pop ecx
lea eax, [ebp + 0x790]
push 0x43815c
push eax
call fcn.00425600
pop ecx
pop ecx
lea eax, [ebp + 0x790]
push ebx
push eax
call fcn.00425700
pop ecx
inc eax
push eax
lea eax, [ebp + 0x790]
push eax
push 1
push ebx
push str.Auto
push str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
push esi
call fcn.0041af74
add esp, 0x20
test al, al
je 0x41c05a
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionAeDebugAuto_value_was_restored._n
call fcn.00419ab0
pop ecx
push 1
push ebx
mov edi, str.__1___
push edi
push ebx
push ebx
call fcn.0041b7fd
push 1
push ebx
push edi
push ebx
push 1
call fcn.0041b7fd
push 1
push ebx
push edi
push ebx
push 2
call fcn.0041b7fd
push 1
push ebx
push edi
push ebx
push 4
call fcn.0041b7fd
add esp, 0x50
lea eax, [ebp + 0x790]
push str.Application
push eax
call fcn.00425600
pop ecx
pop ecx
lea eax, [ebp + 0x790]
push ebx
push eax
call fcn.00425700
pop ecx
inc eax
push eax
lea eax, [ebp + 0x790]
push eax
push 1
push ebx
push ebx
push str.exefile
push 0x80000000
call fcn.0041af74
add esp, 0x20
test al, al
je 0x41c0e0
push str.HKCRexefile_Default__value_was_restored._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableCMD
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov edi, 0x80000001
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c10b
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableCMD_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c131
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c157
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.NoClose
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c17d
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoClose_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.NoDispCPL
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c1a3
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemNoDispCPL_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.Disable
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c1c9
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldAppDisable_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.Nofolderoptions
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c1ef
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNofolderoptions_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.Nofolderoptions
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c215
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNofolderoptions_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableRegistryTools
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c23b
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableRegistryTools
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c261
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableConfig
push str.SoftwarePoliciesMicrosoftWindows_NTSystemRestore
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c287
push str.HKLMSoftwarePoliciesMicrosoftWindows_NTSystemRestoreDisableConfig_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.LimitSystemRestoreCheckpointing
push str.SoftwarePoliciesMicrosoftWindowsInstaller
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c2ad
push str.HKLMSoftwarePoliciesMicrosoftWindowsInstallerLimitSystemRestoreCheckpointing_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.DisableMSI
push str.SoftwarePoliciesMicrosoftWindowsInstaller
push esi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c2d3
push str.HKLMSoftwarePoliciesMicrosoftWindowsInstallerDisableMSI_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.HideFileExt
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push esi
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c2fa
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHideFileExt_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.Hidden
push esi
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c31c
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden_value_was_removed._n
call fcn.00419ab0
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.ShowSuperHidden
push esi
push edi
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x41c33e
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedShowSuperHidden_value_was_removed._n
call fcn.00419ab0
pop ecx
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
pop ebx
call fcn.00425221
add ebp, 0xbc0
leave
ret