Function at 0x40483e
Capabilities:
Persist via appinit_dlls registry key
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov eax, 0x43320e
call fcn.004269c8
sub esp, 0x15c
mov eax, dword [0x44de90]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x20]
test eax, eax
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x164], 0xc
je 0x40487a
push dword [ebp + 8]
call eax
pop ecx
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x405030
test al, 1
mov ebx, 0x4349c5
je 0x404931
push 0xb
pop ecx
push ebx
xor eax, eax
push eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea edi, [ebp - 0x44]
push eax
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x4048e9
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push ebx
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x80000001
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404931
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push str.HKEY_CURRENT_USER_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1c], 2
je 0x4049dd
push 0xc
pop ecx
push ebx
xor eax, eax
push eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea edi, [ebp - 0x48]
push eax
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404995
push ebx
push ebx
lea eax, [ebp - 0x48]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push ebx
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x80000001
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x4049dd
push ebx
push ebx
lea eax, [ebp - 0x48]
push eax
push str.HKEY_CURRENT_USER_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1c], 4
je 0x404b2a
push 0xd
pop ecx
push ebx
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea edi, [ebp - 0x4c]
push 0
rep movsd dword es:[edi], dword [esi]
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x434fc4
push eax
push 0x80000001
movsb byte es:[edi], byte [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
mov esi, str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
mov edi, str.system_registry
je 0x404a4a
push ebx
push str.__Run_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_CURRENT_USER_
push edi
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push ebx
push 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push str.Load
push eax
push 0x80000001
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404a92
push ebx
push str.__Load_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_CURRENT_USER_
push edi
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push ebx
push 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x434fc4
push eax
push 0x80000002
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404ada
push ebx
push str.__Run_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_LOCAL_MACHINE_
push edi
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push ebx
push 0
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push str.Load
push eax
push 0x80000002
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404b2a
push ebx
push str.__Load_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1c], 8
je 0x404b8a
push 0xd
pop ecx
push ebx
xor eax, eax
push eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea edi, [ebp - 0x4c]
push eax
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404b8a
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1c], 0x10
je 0x404bea
push 0xe
pop ecx
push ebx
xor eax, eax
push eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
lea edi, [ebp - 0x50]
push eax
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404bea
push ebx
push ebx
lea eax, [ebp - 0x50]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
and eax, 0x1000
cmp eax, 0x20
jne 0x404c58
push 0xd
pop ecx
push ebx
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea edi, [ebp - 0x4c]
push 0
rep movsd dword es:[edi], dword [esi]
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push str.AppInit_DLLs
push eax
push 0x80000002
movsb byte es:[edi], byte [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404c58
push ebx
push str.__AppInit_DLLs_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
and eax, 0x20
cmp eax, 0x1000
jne 0x404cbf
push 0x11
pop ecx
push ebx
xor eax, eax
push eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea edi, [ebp - 0x5c]
push eax
push dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404cbf
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1c], 0x40
je 0x404dbe
push 0xd
pop ecx
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, str.explorer.exe
push edi
push 0
push 1
push dword [ebp + 8]
mov esi, str.Shell
push esi
lea eax, [ebp - 0x4c]
push eax
push 0x80000002
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404d31
push ebx
push str.__Shell_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_LOCAL_MACHINE_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push edi
push 0
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push esi
push eax
push 0x80000001
call fcn.0041aa5e
add esp, 0x1c
test al, al
je 0x404d7d
push ebx
push str.__Shell_value_
lea eax, [ebp - 0x4c]
push eax
push str.HKEY_CURRENT_USER_
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push dword [ebp + 8]
push str.boot
push str.shell
call fcn.00419af7
add esp, 0xc
cmp eax, 3
jne 0x404dbe
push ebx
push ebx
push ebx
push str._boot__section__SHELL_key
push str.system.ini_file
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
mov edi, dword [ebp + 0xc]
test byte [edi + 0x1c], 0x80
mov esi, dword [ebp + 8]
je 0x404e38
push esi
push 0x434e18
call fcn.0041a954
cmp eax, 3
pop ecx
pop ecx
jne 0x404e01
push ebx
push ebx
push ebx
push str._Windows__section__RUN_key
push str.win.ini_file
push esi
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
push esi
push str.load
call fcn.0041a954
cmp eax, 3
pop ecx
pop ecx
jne 0x404e38
push ebx
push ebx
push ebx
push str._Windows__section__LOAD_key
push str.win.ini_file
push esi
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
test byte [edi + 0x1d], 1
je 0x404e6a
push esi
call fcn.004040c5
test al, al
pop ecx
je 0x404e6a
push ebx
push ebx
push ebx
push ebx
push str.autoexec.bat_file
push esi
push str._s_tStartUp_link_in__s_deleted___s_s_s_s__n
call fcn.00419ab0
add esp, 0x1c
mov dword [ebp - 0x164], 4
test byte [edi + 0x1d], 2
je 0x404eff
push 0
push esi
mov esi, str.__1___S
push esi
push 0
push 3
call fcn.0041b7fd
add esp, 0x14
test al, al
mov edi, str.system_registry
mov ebx, str._default_value_
je 0x404ebc
push esi
push ebx
push str.HKEY_CLASSES_ROOT_scrfile_shellopencommand
push edi
push dword [ebp + 8]
mov esi, str._s_tStartUp_link_in__s_restored_to_default_value___s__new_value__s_s__n
push esi
call fcn.00419ab0
add esp, 0x18
mov dword [ebp - 0x164], 4
jmp 0x404ec1
mov esi, str._s_tStartUp_link_in__s_restored_to_default_value___s__new_value__s_s__n
push 0
push dword [ebp + 8]
push str.__1_
push 1
push 3
call fcn.0041b7fd
add esp, 0x14
test al, al
je 0x404f0e
push str.__1_
push ebx
push str.HKEY_CLASSES_ROOT_scrfile_shellconfigcommand
push edi
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x18
mov dword [ebp - 0x164], 4
jmp 0x404f0e
mov ebx, str._default_value_
mov esi, str._s_tStartUp_link_in__s_restored_to_default_value___s__new_value__s_s__n
mov edi, str.system_registry
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1d], 4
je 0x404f53
push 0
push dword [ebp + 8]
push str.regedit.exe___1_
push 0
push 5
call fcn.0041b7fd
add esp, 0x14
test al, al
je 0x404f53
push str.regedit.exe___1_
push ebx
push str.HKEY_CLASSES_ROOT_regfile_shellopencommand
push edi
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x18
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1d], 0x20
je 0x404f98
push 0
push dword [ebp + 8]
push str._SystemRoot__system32mmc.exe___1___
push 0
push 8
call fcn.0041b7fd
add esp, 0x14
test al, al
je 0x404f98
push str.regedit.exe___1_
push ebx
push str.HKEY_CLASSES_ROOTMSCFile_shellopencommand
push edi
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x18
mov dword [ebp - 0x164], 4
mov eax, dword [ebp + 0xc]
test byte [eax + 0x1d], 8
je 0x405030
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x160], 0
lea edi, [ebp - 0x15f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
lea eax, [ebp - 0x160]
push edi
mov dword [ebp - 0x168], eax
push edi
lea eax, [ebp - 0x168]
push eax
push str.Notepad.exe
call fcn.004212f0
add esp, 0x10
push 0x434c88
push dword [ebp - 0x168]
call fcn.00425610
push edi
push dword [ebp + 8]
push dword [ebp - 0x168]
push edi
push 6
call fcn.0041b7fd
add esp, 0x1c
test al, al
je 0x405030
push dword [ebp - 0x168]
push ebx
push str.HKEY_CLASSES_ROOT_txtfile_shellopencommand
push str.system_registry
push dword [ebp + 8]
push esi
call fcn.00419ab0
add esp, 0x18
mov dword [ebp - 0x164], 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x164]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret