Function at 0x59e8bc
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, 0x6b4e14
xor eax, eax
push ebp
push 0x59eee2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59eef8
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59ef38
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59eef8
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59ef58
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59eef8
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59ef58
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59ef68
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59ef58
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59ef68
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59ef58
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59efac
call fcn.00404d00
mov byte [ebx + 0x11], 0
lea eax, [ebx + 0xc]
mov edx, 0x59efec
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59efac
call fcn.00404d00
mov byte [ebx + 0x11], 0
lea eax, [ebx + 0xc]
mov edx, 0x59eff8
call fcn.00404d00
lea eax, [ebx + 0x14]
mov edx, 0x59ef4c
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59f008
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59f044
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59f080
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59f0b8
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59f100
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59f138
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59f180
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59f1bc
call fcn.00404d00
mov byte [ebx + 0x11], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59f1f8
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59f234
call fcn.00404d00
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x10], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59f1f8
call fcn.00404d00
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x10], 1
lea eax, [ebx + 0xc]
mov edx, 0x59f234
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000002
lea eax, [ebx + 8]
mov edx, 0x59f244
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59f234
call fcn.00404d00
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x10], 1
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov dword [ebx + 4], 0x80000001
lea eax, [ebx + 8]
mov edx, 0x59f244
call fcn.00404d00
mov byte [ebx + 0x11], 0
mov byte [ebx + 0x10], 1
lea eax, [ebx + 0xc]
mov edx, 0x59f234
call fcn.00404d00
mov byte [ebx + 0x18], 1
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov byte [ebx + 0x11], 0
lea edx, [ebp - 8]
mov eax, dword [0x69800c]
mov eax, dword [eax]
call fcn.00431fa4
mov edx, dword [ebp - 8]
lea eax, [ebx + 8]
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59f28c
call fcn.00404d00
mov byte [ebx + 0x18], 2
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov byte [ebx + 0x11], 0
lea edx, [ebp - 0xc]
mov eax, dword [0x69800c]
mov eax, dword [eax]
call fcn.00432020
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.00404d00
lea eax, [ebx + 0xc]
mov edx, 0x59f28c
call fcn.00404d00
mov byte [ebx + 0x18], 2
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov ebx, eax
mov byte [ebx + 0x11], 0
lea eax, [ebx + 8]
call fcn.00404cac
lea eax, [ebx + 0xc]
call fcn.00404cac
mov byte [ebx + 0x18], 3
mov edx, ebx
mov eax, dword [esi]
call fcn.0041ee98
xor edi, edi
mov eax, dword [0x6980f4]
cmp byte [eax], 0
je 0x59eec7
jmp 0x59eec0
mov edx, edi
mov eax, dword [esi]
call fcn.0041f044
mov ebx, eax
cmp byte [ebx + 0x18], 1
jne 0x59eebf
cmp dword [ebx + 4], 0x80000002
jne 0x59eebf
cmp byte [ebx + 0x20], 0
je 0x59eebf
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.0040a7cc
mov edx, dword [ebp - 0x10]
mov eax, 0x59f298
call fcn.0040f998
dec eax
jne 0x59eebf
mov dl, 1
mov eax, dword [0x59aa2c]
call fcn.0059c190
mov dword [ebp - 4], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0059c134
mov eax, dword [ebp - 4]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x21], 0
mov edx, dword [ebp - 4]
mov eax, dword [esi]
call fcn.0041ee98
inc edi
mov eax, dword [esi]
cmp edi, dword [eax + 8]
jl 0x59ee53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59eee9
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cd0
ret