Function at 0x10076d6e
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x100a50ef
call fcn.1007c8b4
sub esp, 0x40
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor bl, bl
push eax
mov byte [ebp + 0x5f], bl
call fcn.10006475
pop ecx
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 1
call fcn.10079793
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.100798e7
lea ecx, [ebp + 0x24]
mov byte [ebp + 0x5e], al
mov byte [ebp - 4], 1
call fcn.100028b5
cmp byte [ebp + 0x5e], bl
je 0x1007707c
mov edi, 0x200
lea eax, [ebp - 0x30]
push edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.1007a036
push 1
push str.DisplayName
lea ecx, [ebp + 4]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.10079f8b
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.10079916
mov edx, eax
mov dword [ebp + 0x50], 0xf
xor eax, eax
mov ecx, edx
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x3c], al
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10076e15
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x3c]
call fcn.10002936
lea ecx, [ebp + 8]
call fcn.100028b5
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.100797ce
lea ecx, [ebp + 0x20]
call fcn.10079793
mov byte [ebp - 4], 8
call fcn.10079530
test eax, eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 8]
je 0x10076e6c
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogonNotify_
push eax
call fcn.1000cdf0
add esp, 0xc
mov byte [ebp - 4], 9
jmp 0x10076e7e
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotify_
push eax
call fcn.1000cdf0
add esp, 0xc
mov byte [ebp - 4], 0xa
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
push esi
call fcn.100796dc
mov ecx, dword [eax]
add eax, 4
mov dword [ebp + 0x20], ecx
lea ecx, [ebp + 0x24]
push eax
call fcn.10005e08
lea ecx, [ebp - 0x28]
call fcn.100028b5
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.100028b5
lea ecx, [ebp - 0x2c]
call fcn.10079793
push eax
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xb
call fcn.100798e7
lea ecx, [ebp - 0x28]
mov byte [ebp + 0x5e], al
mov byte [ebp - 4], 8
call fcn.100028b5
cmp byte [ebp + 0x5e], 0
je 0x10076f32
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp + 0x20]
call fcn.1007a036
push 1
push str.Runline
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0xc
push ecx
mov ecx, eax
call fcn.10079f8b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xe
call fcn.100797ce
lea ecx, [ebp + 4]
call fcn.10079916
push eax
push 0x100ba7d4
push dword [ebp + 0x68]
call fcn.10007cc3
add esp, 0xc
lea ecx, [ebp + 8]
mov bl, 1
mov byte [ebp + 0x5f], bl
call fcn.100028b5
lea ecx, [ebp + 0x24]
call fcn.100028b5
mov eax, dword [ebp + 0x50]
mov byte [ebp - 4], 1
cmp eax, 0x10
jb 0x10076f75
mov ecx, dword [ebp + 0x3c]
inc eax
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x54], ecx
cmp eax, 0x1000
jb 0x10076f6c
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x58]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x54]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
test bl, bl
je 0x1007707c
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push esi
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xf
call fcn.1007973d
push edi
lea eax, [ebp]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp + 0x20]
call fcn.1007a036
push 0
push str.OSSProxy
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp]
call fcn.10079f8b
mov ecx, eax
mov byte [ebp - 4], 0x12
call fcn.10079916
and dword [ebp + 0x3c], 0
mov edx, eax
and dword [ebp + 0x4c], 0
mov ecx, edx
mov dword [ebp + 0x50], 0xf
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10076fd8
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x3c]
call fcn.10002936
lea ecx, [ebp - 0x28]
call fcn.100028b5
cmp dword [ebp + 0x4c], 0
jbe 0x1007701b
cmp dword [ebp + 0x50], 0x10
lea eax, [ebp + 0x3c]
push str.__bootremove
cmovae eax, dword [ebp + 0x3c]
push eax
call fcn.1007dce0
pop ecx
pop ecx
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
mov eax, dword [ebp + 0x50]
cmp eax, 0x10
jb 0x10077052
mov ecx, dword [ebp + 0x3c]
inc eax
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ecx
cmp eax, 0x1000
jb 0x10077049
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x54]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x58]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
and dword [ebp + 0x4c], 0
lea ecx, [ebp]
mov dword [ebp + 0x50], 0xf
mov byte [ebp + 0x3c], 0
call fcn.100797ce
lea ecx, [ebp + 0x24]
call fcn.100028b5
jmp 0x1007707c
lea ecx, [ebp - 0x48]
call fcn.100028b5
jmp 0x10077093
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x60
leave
ret