Function at 0x6bb644
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x6bb64c
push ebx
push esi
push edi
mov ebx, eax
mov edi, 0x8bc9c0
xor eax, eax
push ebp
push 0x6bbbd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6bbbf0
call fcn.0066312c
push 0x27d9
xor ecx, ecx
mov edx, 0x80000002
mov eax, ebx
call fcn.006b30f0
mov eax, 0x6bbc1c
call fcn.0066312c
push 0x27d9
xor ecx, ecx
mov edx, 0x80000001
mov eax, ebx
call fcn.006b30f0
mov eax, 0x6bbc48
call fcn.0066312c
mov dl, 1
mov eax, dword [0x60799c]
call fcn.00608b7c
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x47e80c]
call fcn.004a2178
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
call fcn.0040a790
mov eax, dword [ebp - 8]
cmp dword [eax + 0x16], 0
je 0x6bb6ee
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x16]
call fcn.0040abb8
jmp 0x6bb6f6
lea eax, [ebp - 4]
call fcn.006adf1c
mov eax, 0x6bbc74
call fcn.0066312c
mov edx, 0x80000003
mov eax, dword [ebp - 8]
call fcn.00608c44
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00608f2c
test al, al
je 0x6bb72e
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006093f8
mov eax, dword [ebp - 8]
call fcn.00608c10
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.00408ac4
mov eax, 0x6bbca0
call fcn.0066312c
push 0x27da
xor ecx, ecx
mov edx, 0x80000002
mov eax, ebx
call fcn.006b4704
mov eax, ebx
call fcn.006b77ec
mov eax, ebx
call fcn.006b7590
push 0x6bbccc
push 0xc350
push 0x6bbcfc
push 0x6bbd1c
lea eax, [ebp - 0x14]
mov ecx, 0x6bbd30
mov edx, dword [0x8bc9c4]
call fcn.0040ba64
mov ecx, dword [ebp - 0x14]
mov edx, 0x80000002
mov eax, ebx
call fcn.006b2530
mov eax, 0x6bbd64
call fcn.0066312c
push 0x4e85
lea eax, [ebp - 0x18]
mov ecx, 0x6bbd90
mov edx, dword [0x8bc9bc]
call fcn.0040ba64
mov ecx, dword [ebp - 0x18]
mov edx, 0x80000002
mov eax, ebx
call fcn.006bb234
push 0x4ee9
lea eax, [ebp - 0x1c]
mov ecx, 0x6bbdac
mov edx, dword [0x8bc9bc]
call fcn.0040ba64
mov ecx, dword [ebp - 0x1c]
mov edx, 0x80000002
mov eax, ebx
call fcn.006bade8
mov eax, 0x6bbdd4
call fcn.0066312c
mov eax, ebx
call fcn.006b8c04
xor ecx, ecx
mov edx, 0x27e6
mov eax, ebx
call fcn.006b7a40
mov ecx, 0x6bbe00
mov edx, 0x27e6
mov eax, ebx
call fcn.006b7a40
mov eax, 0x6bbe10
call fcn.0066312c
xor ecx, ecx
mov edx, 0x27ec
mov eax, ebx
call fcn.006b9bec
mov ecx, 0x6bbe00
mov edx, 0x27ec
mov eax, ebx
call fcn.006b9bec
push 0
lea eax, [ebp - 0x20]
mov ecx, 0x6bbe3c
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x20]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b9354
push 0x6bbe00
lea eax, [ebp - 0x24]
mov ecx, 0x6bbe3c
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x24]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b9354
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x6bbe90
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x28]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b9354
push 0x6bbe00
lea eax, [ebp - 0x2c]
mov ecx, 0x6bbe90
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x2c]
mov ecx, 0x27e3
mov eax, ebx
call fcn.006b9354
mov eax, 0x6bbeec
call fcn.0066312c
push 0
lea eax, [ebp - 0x30]
mov ecx, 0x6bbf18
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x30]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b99f8
push 0x6bbe00
lea eax, [ebp - 0x34]
mov ecx, 0x6bbf18
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x34]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b99f8
push 0
lea eax, [ebp - 0x38]
mov ecx, 0x6bbf58
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x38]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b99f8
push 0x6bbe00
lea eax, [ebp - 0x3c]
mov ecx, 0x6bbf58
mov edx, dword [edi]
call fcn.0040ba64
mov edx, dword [ebp - 0x3c]
mov ecx, 0x27e5
mov eax, ebx
call fcn.006b99f8
mov eax, 0x6bbf98
call fcn.0066312c
xor ecx, ecx
mov edx, 0x27ef
mov eax, ebx
call fcn.006b89b0
mov ecx, 0x6bbe00
mov edx, 0x27ef
mov eax, ebx
call fcn.006b89b0
xor ecx, ecx
mov edx, 0x27f0
mov eax, ebx
call fcn.006b9548
mov ecx, 0x6bbe00
mov edx, 0x27f0
mov eax, ebx
call fcn.006b9548
xor ecx, ecx
mov edx, 0x27f1
mov eax, ebx
call fcn.006b44c8
mov ecx, 0x6bbe00
mov edx, 0x27f1
mov eax, ebx
call fcn.006b44c8
mov eax, 0x6bbfc4
call fcn.0066312c
xor ecx, ecx
mov edx, 0x138e4
mov eax, ebx
call fcn.006b7fa0
mov ecx, 0x6bbe00
mov edx, 0x138e4
mov eax, ebx
call fcn.006b7fa0
xor ecx, ecx
mov edx, 0x13948
mov eax, ebx
call fcn.006b7c60
mov ecx, 0x6bbe00
mov edx, 0x13948
mov eax, ebx
call fcn.006b7c60
mov eax, 0x6bbff0
call fcn.0066312c
push 0x9c41
lea eax, [ebp - 0x40]
mov ecx, 0x6bc01c
mov edx, dword [0x8bc9b8]
call fcn.0040ba64
mov ecx, dword [ebp - 0x40]
mov edx, 0x80000002
mov eax, ebx
call fcn.006baa68
xor ecx, ecx
mov edx, 0x7595
mov eax, ebx
call fcn.006b7128
mov ecx, 0x6bbe00
mov edx, 0x7595
mov eax, ebx
call fcn.006b7128
mov eax, 0x6bc068
call fcn.0066312c
xor ecx, ecx
mov edx, 0x18704
mov eax, ebx
call fcn.006b6c58
mov ecx, 0x6bbe00
mov edx, 0x18704
mov eax, ebx
call fcn.006b6c58
xor ecx, ecx
mov edx, 0x18768
mov eax, ebx
call fcn.006b6ec0
mov ecx, 0x6bbe00
mov edx, 0x18768
mov eax, ebx
call fcn.006b6ec0
push 0x27da
xor ecx, ecx
mov edx, 0x80000001
mov eax, ebx
call fcn.006b4704
mov eax, 0x6bc094
call fcn.0066312c
mov eax, ebx
call fcn.006b433c
mov eax, ebx
call fcn.006b9e30
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov esi, eax
test esi, esi
jl 0x6bbaf0
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6bbba2
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6bbba2
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
lea ecx, [ebp - 0x48]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
mov edx, 0x6bc0c0
call fcn.0040ba64
mov eax, dword [ebp - 0x44]
call fcn.0066312c
push 0x27d9
lea ecx, [ebp - 0x4c]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x4c]
mov edx, 0x6bc10c
call fcn.0040ba0c
mov ecx, dword [ebp - 0x4c]
mov edx, 0x80000003
mov eax, ebx
call fcn.006b30f0
push 0x27da
lea ecx, [ebp - 0x50]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x50]
mov edx, 0x6bc10c
call fcn.0040ba0c
mov ecx, dword [ebp - 0x50]
mov edx, 0x80000003
mov eax, ebx
call fcn.006b4704
inc esi
dec dword [ebp - 0x10]
jne 0x6bbb17
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.00408ac4
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bbbdb
lea eax, [ebp - 0x50]
mov edx, 0x10
call fcn.0040a7f0
lea eax, [ebp - 4]
call fcn.0040a790
ret