Function at 0x48b030
Capabilities:
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x22e4
call fcn.004a9b70
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor ebx, ebx
lea eax, [ebp - 0x49f]
push ebx
push eax
mov dword [ebp - 0x22a4], 0xffffffff
mov byte [ebp - 0x4a0], 0
call fcn.004a3190
add esp, 0xc
mov dword [ebp - 0x22bc], 0x104
mov dword [ebp - 0x22b4], ebx
cmp dword [0x4d2afc], ebx
je 0x48b0b6
mov ecx, dword [0x4c6444]
mov edx, dword [0x4c6448]
mov dword [ebp - 0x22e4], ecx
mov dword [ebp - 0x22e0], edx
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0x20106
push 0x80
lea edx, [ebp - 0x398]
mov ecx, 0x2da
call fcn.00499890
mov ecx, dword [0x4c6444]
add esp, 4
lea eax, [ebp - 0x22a8]
push eax
push ecx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x48b293
lea edx, [ebp - 0x22dc]
push edx
lea eax, [ebp - 0x22cc]
push eax
lea ecx, [ebp - 0x22c8]
push ecx
lea edx, [ebp - 0x22d0]
push edx
lea eax, [ebp - 0x22ac]
push eax
lea ecx, [ebp - 0x22c0]
push ecx
lea edx, [ebp - 0x22c4]
push edx
lea eax, [ebp - 0x22b4]
push eax
mov eax, dword [ebp - 0x22a8]
push ebx
lea ecx, [ebp - 0x22bc]
push ecx
lea edx, [ebp - 0x4a0]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x22ac], ebx
je 0x48b286
mov eax, dword [ebp - 0x22a8]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x22b0]
push ecx
lea edx, [ebp - 0x318]
push edx
push edi
mov esi, 0xff
push eax
mov dword [ebp - 0x22b8], esi
mov dword [ebp - 0x22b0], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [ebp - 0x22ac]
ja 0x48b286
cmp eax, 0x103
je 0x48b286
test eax, eax
jne 0x48b157
push esi
lea edx, [ebp - 0x318]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea ecx, [ebp - 0x9a0]
mov edx, 0x80000002
call fcn.0048e050
lea eax, [ebp - 0x8a0]
add esp, 0xc
push eax
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x9a0]
call fcn.0048ee50
add esp, 4
test eax, eax
je 0x48b157
push 0x1400
lea ecx, [ebp - 0x22a0]
push 0
push ecx
call fcn.004a3190
lea edx, [ebp - 0x110]
add esp, 0xc
push edx
lea ecx, [ebp - 0x22a0]
call fcn.0048e9d0
add esp, 4
lea ecx, [ebp - 0x110]
call fcn.0047d280
test eax, eax
je 0x48b25c
push 0
push 0xfc
lea eax, [ebp - 0x1ea0]
push eax
lea ecx, [ebp - 0x9a0]
push ecx
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x318]
call fcn.0048f730
add esp, 0x10
inc dword [ebp - 0x22a4]
jmp 0x48b157
lea esi, [ebp - 0x110]
call fcn.00482ee0
test eax, eax
je 0x48b157
push 0
push 0xfc
lea edx, [ebp - 0x398]
push edx
lea eax, [ebp - 0x9a0]
push eax
jmp 0x48b23d
mov ecx, dword [ebp - 0x22a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4c6444]
lea edx, [ebp - 0x22a8]
push edx
push eax
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48b4a9
lea ecx, [ebp - 0x22dc]
push ecx
lea edx, [ebp - 0x22cc]
push edx
lea eax, [ebp - 0x22c8]
push eax
lea ecx, [ebp - 0x22d0]
push ecx
lea edx, [ebp - 0x22ac]
push edx
lea eax, [ebp - 0x22c0]
push eax
lea ecx, [ebp - 0x22c4]
push ecx
lea edx, [ebp - 0x22b4]
push edx
mov edx, dword [ebp - 0x22a8]
push ebx
lea eax, [ebp - 0x22bc]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x22ac], ebx
je 0x48b495
mov edx, dword [ebp - 0x22a8]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x22b0]
push eax
lea ecx, [ebp - 0x318]
push ecx
push edi
mov esi, 0xff
push edx
mov dword [ebp - 0x22b8], esi
mov dword [ebp - 0x22b0], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [ebp - 0x22ac]
ja 0x48b49a
cmp eax, 0x103
je 0x48b49a
test eax, eax
jne 0x48b31d
lea edx, [ebp - 0x8a0]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0xea0]
call fcn.00401000
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x318]
call fcn.0048ee50
add esp, 4
test eax, eax
je 0x48b31d
push esi
lea ecx, [ebp - 0x318]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
lea ecx, [ebp - 0x8a0]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
push 0x1400
lea edx, [ebp - 0x22a0]
push 0
push edx
call fcn.004a3190
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
lea ecx, [ebp - 0x22a0]
call fcn.0048e9d0
add esp, 4
lea ecx, [ebp - 0x8a0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x48b428
lea edx, [ebp - 0xea0]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0x8a0]
call fcn.00401000
lea ecx, [ebp - 0x110]
call fcn.0047d280
test eax, eax
je 0x48b46b
push 0
push 0xfd
lea eax, [ebp - 0x1ea0]
push eax
lea ecx, [ebp - 0x318]
push ecx
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x8a0]
call fcn.0048f730
add esp, 0x10
inc dword [ebp - 0x22a4]
jmp 0x48b31d
lea esi, [ebp - 0x110]
call fcn.00482ee0
test eax, eax
je 0x48b31d
push 0
push 0xfd
lea edx, [ebp - 0x398]
push edx
lea eax, [ebp - 0x318]
push eax
jmp 0x48b44c
mov esi, 0xff
mov ecx, dword [ebp - 0x22a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48b4ae
mov esi, 0xff
mov eax, dword [0x4c6444]
lea edx, [ebp - 0x22a8]
push edx
push eax
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48b6ea
lea ecx, [ebp - 0x22dc]
push ecx
lea edx, [ebp - 0x22cc]
push edx
lea eax, [ebp - 0x22c8]
push eax
lea ecx, [ebp - 0x22d0]
push ecx
lea edx, [ebp - 0x22ac]
push edx
lea eax, [ebp - 0x22c0]
push eax
lea ecx, [ebp - 0x22c4]
push ecx
lea edx, [ebp - 0x22b4]
push edx
mov edx, dword [ebp - 0x22a8]
push ebx
lea eax, [ebp - 0x22bc]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x22ac], ebx
je 0x48b6dd
mov edx, dword [ebp - 0x22a8]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x22b0]
push eax
lea ecx, [ebp - 0x318]
push ecx
push edi
mov esi, 0xff
push edx
mov dword [ebp - 0x22b8], esi
mov dword [ebp - 0x22b0], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [ebp - 0x22ac]
ja 0x48b6dd
cmp eax, 0x103
je 0x48b6dd
test eax, eax
jne 0x48b538
lea edx, [ebp - 0x8a0]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0xea0]
call fcn.00401000
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x318]
call fcn.0048ee50
add esp, 4
test eax, eax
je 0x48b538
push esi
lea ecx, [ebp - 0x318]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
lea ecx, [ebp - 0x8a0]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
push 0x1400
lea edx, [ebp - 0x22a0]
push 0
push edx
call fcn.004a3190
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
lea ecx, [ebp - 0x22a0]
call fcn.0048e9d0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 4
lea ecx, [ebp - 0x8a0]
push ecx
call esi
test eax, eax
jne 0x48b645
lea edx, [ebp - 0xea0]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0x8a0]
call fcn.00401000
lea eax, [ebp - 0x8a0]
push eax
call esi
test eax, eax
jle 0x48b538
lea ecx, [ebp - 0x110]
call fcn.0047d280
test eax, eax
je 0x48b69a
push 0
push 0xfe
lea ecx, [ebp - 0x1ea0]
push ecx
lea edx, [ebp - 0x318]
push edx
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x8a0]
call fcn.0048f730
add esp, 0x10
add dword [ebp - 0x22a4], 2
jmp 0x48b538
lea esi, [ebp - 0x110]
call fcn.00482ee0
test eax, eax
je 0x48b538
push 0
push 0xfe
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebp - 0x318]
push ecx
mov edx, esi
lea ecx, [ebp - 0x8a0]
call fcn.0048f730
add esp, 0x10
inc dword [ebp - 0x22a4]
jmp 0x48b538
mov edx, dword [ebp - 0x22a8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str.AppInit_Dlls
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [ebp - 0xaa0]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x48b8e2
lea eax, [ebp - 0xaa0]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x22d4], ecx
test ecx, ecx
jle 0x48b814
mov al, byte [ebp + ebx - 0xaa0]
cmp al, 0x2c
je 0x48b74f
cmp al, 0x20
je 0x48b74f
mov byte [ebp + esi - 0x218], al
inc esi
jmp 0x48b80b
lea ecx, [ebp - 0x218]
push ecx
mov byte [ebp + esi - 0x218], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x48b7fc
push 0x1400
lea edx, [ebp - 0x22a0]
push 0
push edx
call fcn.004a3190
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
lea ecx, [ebp - 0x22a0]
call fcn.0048e9d0
add esp, 4
lea ecx, [ebp - 0x218]
call fcn.0047d280
test eax, eax
je 0x48b7bd
push 0
push 0xff
lea ecx, [ebp - 0x1ea0]
push ecx
lea edx, [ebp - 0x1aa0]
push edx
jmp 0x48b7e1
lea esi, [ebp - 0x218]
call fcn.00482ee0
test eax, eax
je 0x48b7fc
push 0
push 0xff
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebp - 0x1aa0]
push ecx
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x22a0]
call fcn.0048f730
inc dword [ebp - 0x22a4]
add esp, 0x10
inc edi
mov ecx, dword [ebp - 0x22d4]
xor esi, esi
mov byte [ebp - 0x218], 0
inc ebx
cmp ebx, ecx
jl 0x48b733
lea edx, [ebp - 0x218]
push edx
mov byte [ebp + esi - 0x218], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x48b8c1
push 0x1400
lea eax, [ebp - 0x22a0]
push 0
push eax
call fcn.004a3190
lea ecx, [ebp - 0x218]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x22a0]
call fcn.0048e9d0
add esp, 4
lea ecx, [ebp - 0x218]
call fcn.0047d280
test eax, eax
je 0x48b882
push 0
push 0xff
lea edx, [ebp - 0x1ea0]
push edx
lea eax, [ebp - 0x1aa0]
push eax
jmp 0x48b8a6
lea esi, [ebp - 0x218]
call fcn.00482ee0
test eax, eax
je 0x48b8c1
push 0
push 0xff
lea ecx, [ebp - 0x398]
push ecx
lea edx, [ebp - 0x1aa0]
push edx
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x22a0]
call fcn.0048f730
inc dword [ebp - 0x22a4]
add esp, 0x10
inc edi
cmp dword [ebp - 0x22d4], 0
jle 0x48b8e2
test edi, edi
jne 0x48b8e2
mov eax, str.AppInit_Dlls
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov ebx, 0x80000002
call fcn.0048e230
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0x22a8]
push eax
push ecx
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48bb53
lea edx, [ebp - 0x22dc]
push edx
lea eax, [ebp - 0x22cc]
push eax
lea ecx, [ebp - 0x22c8]
push ecx
lea edx, [ebp - 0x22d0]
push edx
lea eax, [ebp - 0x22ac]
push eax
lea ecx, [ebp - 0x22c0]
push ecx
lea edx, [ebp - 0x22c4]
push edx
lea eax, [ebp - 0x22b4]
push eax
mov eax, dword [ebp - 0x22a8]
push ebx
lea ecx, [ebp - 0x22bc]
push ecx
lea edx, [ebp - 0x4a0]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x22b4], ebx
je 0x48bb46
lea ecx, [ebp - 0x22dc]
push ecx
lea edx, [ebp - 0x22b8]
push edx
lea eax, [ebp - 0xea0]
push eax
mov eax, dword [ebp - 0x22a8]
push 0
lea ecx, [ebp - 0x22b0]
push ecx
lea edx, [ebp - 0x8a0]
push edx
push edi
mov esi, 0xff
push eax
mov dword [ebp - 0x22b8], esi
mov dword [ebp - 0x22b0], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [ebp - 0x22b4]
ja 0x48bb46
cmp eax, 0x103
je 0x48bb46
test eax, eax
jne 0x48b96d
lea edx, [ebp - 0x8a0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x48b96d
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0xea0]
call fcn.00401000
mov eax, 0x400
lea ecx, [ebp - 0xea0]
cmp byte [ecx], 0
je 0x48ba11
inc ecx
dec eax
jne 0x48ba06
jmp 0x48ba39
test eax, eax
je 0x48ba39
mov ecx, 0x400
sub ecx, eax
mov eax, 0x400
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0xea0]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x400
lea eax, [ebp - 0xea0]
cmp byte [eax], 0
je 0x48ba4f
inc eax
dec edx
jne 0x48ba44
jmp 0x48ba79
test edx, edx
je 0x48ba79
lea eax, [ebp - 0x8a0]
push eax
mov ecx, 0x400
sub ecx, edx
mov eax, 0x400
sub eax, ecx
lea ecx, [ebp + ecx - 0xea0]
mov edx, 0x7fffffff
call fcn.00401000
push esi
lea ecx, [ebp - 0xea0]
push str.DllName
push ecx
lea ecx, [ebp - 0x110]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x48b96d
push 0x1400
lea eax, [ebp - 0x22a0]
push 0
push eax
call fcn.004a3190
lea ecx, [ebp - 0x110]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x22a0]
call fcn.0048e9d0
add esp, 4
lea ecx, [ebp - 0x110]
call fcn.0047d280
test eax, eax
je 0x48bb1c
push 0
push 0x100
lea edx, [ebp - 0x1ea0]
push edx
lea eax, [ebp - 0x16a0]
push eax
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x8a0]
call fcn.0048f730
add esp, 0x10
inc dword [ebp - 0x22a4]
jmp 0x48b96d
lea esi, [ebp - 0x110]
call fcn.00482ee0
test eax, eax
je 0x48b96d
push 0
push 0x100
lea ecx, [ebp - 0x398]
push ecx
lea edx, [ebp - 0x16a0]
push edx
jmp 0x48bafd
mov eax, dword [ebp - 0x22a8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4d2afc], 0
mov eax, dword [ebp - 0x22a4]
je 0x48bb7a
mov ecx, dword [ebp - 0x22e4]
mov edx, dword [ebp - 0x22e0]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret