Function at 0x41bae1
Capabilities:
Delete directory
Delete registry value
Get common file path
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov eax, 0x1c90
lea ebp, [esp - 0x1c10]
call fcn.00425e20
mov eax, dword [0x44de90]
or dword [ebp - 0x68], 0xffffffff
push ebx
push esi
push edi
mov dword [ebp + 0x1c0c], eax
mov ebx, 0x400
push ebx
lea eax, [ebp + 0x3a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + 0x3a4]
push str.System32_ntos.exe
push eax
call fcn.00425610
and dword [ebp - 0x6c], 0
pop ecx
pop ecx
push 0xd
pop ecx
mov esi, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
lea edi, [ebp + 0x1ba4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
push eax
push 0x2001f
push 0
lea eax, [ebp + 0x1ba4]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41bc00
mov byte [ebp + 0x13a4], al
mov ecx, 0xff
lea edi, [ebp + 0x13a5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x13a4]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push str.Userinit
push dword [ebp - 0x6c]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41bc00
lea eax, [ebp + 0x13a4]
push eax
call fcn.0043109b
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x3a4]
push eax
call fcn.0043109b
and dword [ebp - 0x70], 0
pop ecx
pop ecx
push 0xb
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea edi, [ebp + 0x1bdc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x70]
push eax
push 0x2001f
push 0
lea eax, [ebp + 0x1bdc]
push eax
push 0x80000001
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41bc07
xor eax, eax
jmp 0x41bdfd
xor eax, eax
mov byte [ebp + 0xba4], 0
mov ecx, 0xff
lea edi, [ebp + 0xba5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xba4]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push str.userinit
push dword [ebp - 0x70]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xba4]
push eax
call fcn.0043109b
mov edi, dword [ebp - 0x60]
mov esi, dword [ebp - 0x78]
push edi
push esi
mov dword [ebp - 0x74], eax
call fcn.00425fe0
add esp, 0xc
test eax, eax
jne 0x41bc74
push edi
push dword [ebp - 0x74]
call fcn.00425fe0
test eax, eax
pop ecx
pop ecx
je 0x41bc7f
push str.Registry_contains_values_from_Trojan_Spy.Win32.Banker.cmb__variants__nTrying_to_remove_the_malicious_registry_keys_and_files._n
call fcn.00419ab0
pop ecx
push edi
push esi
call fcn.00425fe0
test eax, eax
pop ecx
pop ecx
je 0x41bdad
push edi
push esi
call fcn.00425fe0
mov edi, eax
lea eax, [ebp + 0xfa4]
push esi
push eax
mov byte [edi], 0
call fcn.00425600
push dword [ebp - 0x60]
call fcn.00425700
add eax, edi
push eax
lea eax, [ebp + 0xfa4]
push eax
call fcn.00425610
xor esi, esi
lea eax, [ebp + 0xfa4]
inc esi
push eax
mov dword [ebp - 0x64], esi
call fcn.00425700
add esp, 0x20
inc eax
push eax
lea eax, [ebp + 0xfa4]
push eax
push dword [ebp - 0x64]
push 0
push str.Userinit
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x17a4]
push eax
call fcn.00425600
lea eax, [ebp + 0x17a4]
push str.System32wsnpoem_audio.dll
push eax
call fcn.00425610
lea eax, [ebp + 0x17a4]
push eax
call fcn.0041b113
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x41bd3a
mov eax, dword [ebp + 0x1c18]
inc dword [eax]
cmp edi, esi
jne 0x41bd46
mov eax, dword [ebp + 0x1c1c]
inc dword [eax]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x17a4]
push eax
call fcn.00425600
lea eax, [ebp + 0x17a4]
push str.System32wsnpoem_video.dll
push eax
call fcn.00425610
lea eax, [ebp + 0x17a4]
push eax
call fcn.0041b113
add esp, 0x14
test edi, edi
jne 0x41bd82
mov eax, dword [ebp + 0x1c18]
inc dword [eax]
cmp edi, esi
mov edi, dword [ebp + 0x1c1c]
jne 0x41bd8e
inc dword [edi]
push dword [ebp - 0x60]
call fcn.0041b113
test eax, eax
pop ecx
mov dword [ebp - 0x68], eax
jne 0x41bda6
mov eax, dword [ebp + 0x1c18]
inc dword [eax]
cmp dword [ebp - 0x68], esi
jne 0x41bdad
inc dword [edi]
push dword [ebp - 0x60]
push dword [ebp - 0x74]
call fcn.00425fe0
test eax, eax
pop ecx
pop ecx
je 0x41bdcc
push str.userinit
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push ebx
lea eax, [ebp + 0x7a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + 0x7a4]
push str.System32wsnpoem
push eax
call fcn.00425610
pop ecx
pop ecx
lea eax, [ebp + 0x7a4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 0x1c0c]
pop edi
pop esi
pop ebx
call fcn.00425221
add ebp, 0x1c10
leave
ret