Function at 0x41163a
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4280c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x25c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
push 0x402368
push 0x17
push ebx
push 0x409404
mov esi, ecx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x244], ebx
call dword [fcn.0040145c]
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
mov eax, dword [esi + 0x54]
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx]
lea edi, [ebp - 0x230]
push edi
push eax
push ecx
call dword [edx + 0x24]
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
push 0xb
pop eax
mov word [ebp - 0x25c], ax
or eax, 0xffffffff
lea edx, [ebp - 0x25c]
push edx
mov word [ebp - 0x254], ax
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push 0x409310
push eax
call dword [ecx + 0x18]
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
push ebx
lea eax, [ebp - 0x240]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x403ab8
push 0x80000002
call dword [0x401008]
cmp eax, ebx
je 0x41178c
jg 0x411780
mov dword [ebp - 0x210], eax
jmp 0x411928
and eax, 0xffff
or eax, 0x80070000
jmp 0x411775
mov eax, dword [esi + 0x54]
mov edi, dword [fcn.00401010]
push 4
lea ecx, [ebp - 0x218]
push ecx
push 4
push ebx
push eax
push dword [ebp - 0x240]
mov dword [ebp - 0x218], ebx
call edi
cmp eax, ebx
jne 0x411773
mov ecx, dword [esi + 0x54]
lea eax, [esi + 0x34]
push eax
push dword [esi + 0x30]
mov dword [eax], 0x20
mov dword [esi + 0x3c], ecx
call dword [0x40134c]
test eax, eax
jne 0x4117db
call dword [fcn.00401210]
cmp eax, ebx
jmp 0x411773
mov eax, dword [esi + 0x50]
cmp eax, ebx
jne 0x4117f1
mov dword [ebp - 0x210], 0x8000ffff
jmp 0x411928
push ebx
lea ecx, [ebp - 0x238]
push ecx
push ebx
push 2
push ebx
push ebx
push ebx
push 0x403a48
push eax
call dword [0x401008]
cmp eax, ebx
jne 0x411773
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0x403a10
call dword [0x40116c]
cmp eax, ebx
je 0x4117d1
cmp eax, 0x104
jbe 0x411844
mov dword [ebp - 0x210], 0x80070018
jmp 0x411928
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x403a04
push dword [ebp - 0x238]
call edi
cmp eax, ebx
jne 0x411773
push ebx
lea eax, [ebp - 0x22c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x4039d8
push dword [esi + 0x50]
call dword [0x401008]
cmp eax, ebx
jne 0x411773
push 4
push 0x4039d4
push 1
push ebx
push 0x4039ac
push dword [ebp - 0x22c]
call edi
cmp eax, ebx
jne 0x411773
push ebx
lea eax, [ebp - 0x228]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x403980
push dword [esi + 0x50]
call dword [0x401008]
cmp eax, ebx
jne 0x411773
push 0xc
push 0x403974
push 1
push ebx
push 0x40395c
push dword [ebp - 0x228]
call edi
cmp eax, ebx
jne 0x411773
call dword [0x401468]
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
lea eax, [ebp - 0x220]
push eax
push 0x20019
call dword [0x401040]
cmp eax, ebx
je 0x411a1f
jg 0x411a10
mov dword [ebp - 0x210], eax
call dword [0x401464]
mov esi, dword [fcn.00401004]
cmp dword [ebp - 0x238], ebx
je 0x41193e
push dword [ebp - 0x238]
call esi
cmp dword [ebp - 0x240], ebx
je 0x41194e
push dword [ebp - 0x240]
call esi
cmp dword [ebp - 0x22c], ebx
je 0x41195e
push dword [ebp - 0x22c]
call esi
lea eax, [ebp - 0x25c]
push eax
call dword [0x40146c]
cmp dword [ebp - 0x220], ebx
je 0x41197b
push dword [ebp - 0x220]
call esi
cmp dword [ebp - 0x224], ebx
je 0x41198b
push dword [ebp - 0x224]
call esi
cmp dword [ebp - 0x234], ebx
je 0x41199b
push dword [ebp - 0x234]
call esi
cmp dword [ebp - 0x23c], ebx
je 0x4119ab
push dword [ebp - 0x23c]
call esi
cmp dword [ebp - 0x21c], ebx
je 0x4119bb
push dword [ebp - 0x21c]
call esi
cmp dword [ebp - 0x244], ebx
je 0x4119cb
push dword [ebp - 0x244]
call esi
cmp dword [ebp - 0x228], ebx
je 0x4119db
push dword [ebp - 0x228]
call esi
mov eax, dword [ebp - 0x230]
cmp eax, ebx
je 0x4119eb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x248]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x4119fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
call fcn.0041e0ac
leave
ret
and eax, 0xffff
or eax, 0x80070000
jmp 0x41191c
call dword [0x401464]
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411922
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x403924
push dword [esi + 0x50]
call dword [0x401008]
cmp eax, ebx
jne 0x411773
push ebx
push dword [ebp - 0x224]
push 0x403924
push dword [ebp - 0x220]
call dword [0x401320]
cmp eax, ebx
jle 0x411a80
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
mov ecx, esi
call fcn.0040fa7e
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x411928
push ebx
lea eax, [ebp - 0x234]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x4021f8
push dword [esi + 0x50]
call dword [0x401008]
cmp eax, ebx
jne 0x411773
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push ebx
push 0x4038fc
push dword [ebp - 0x234]
mov dword [ebp - 0x218], 1
call edi
cmp eax, ebx
jne 0x411773
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x403868
push dword [esi + 0x50]
call dword [0x401008]
cmp eax, ebx
jne 0x411773
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push ebx
push 0x403838
push dword [ebp - 0x23c]
mov dword [ebp - 0x218], 1
call edi
cmp eax, ebx
jne 0x411773
push ebx
lea eax, [ebp - 0x21c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x4037d0
push dword [esi + 0x50]
call dword [0x401008]
cmp eax, ebx
je 0x411b9a
mov edi, eax
push edi
push 0x4037d0
push 0x403790
push ebx
push 0x3c
add esi, 4
push esi
call fcn.0042548a
add esp, 0x18
cmp edi, ebx
jg 0x411b8c
mov dword [ebp - 0x210], edi
jmp 0x411928
and edi, 0xffff
or edi, 0x80070000
jmp 0x411b81
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push ebx
push 0x403778
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], 1
call edi
cmp eax, ebx
je 0x411bd0
mov edi, eax
push edi
push 0x403778
push 0x403728
jmp 0x411b6e
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push ebx
push 0x40370c
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], 1
call edi
cmp eax, ebx
je 0x411c01
mov edi, eax
push edi
push 0x40370c
jmp 0x411bc9
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x10
push 0x4036f8
push 0x4037d0
push dword [ebp - 0x220]
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x24c], 4
call dword [0x40102c]
cmp eax, ebx
je 0x411c4e
mov edi, eax
push edi
push 0x4036f8
push 0x403680
jmp 0x411b6e
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push ebx
push 0x4036f8
push dword [ebp - 0x21c]
call edi
mov edi, eax
cmp edi, ebx
je 0x411c78
push edi
push 0x4036f8
jmp 0x411bc9
push ebx
lea eax, [ebp - 0x244]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
mov edi, 0x403608
push edi
push dword [esi + 0x50]
call dword [0x401008]
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x411cc5
push eax
push edi
push 0x403790
push ebx
push 0x3c
add esi, 4
push esi
call fcn.0042548a
mov eax, dword [ebp - 0x214]
add esp, 0x18
cmp eax, ebx
jmp 0x411773
push ebx
push dword [ebp - 0x244]
push edi
push dword [ebp - 0x220]
call dword [0x401320]
mov dword [ebp - 0x214], eax
cmp eax, 2
jne 0x411dab
push edi
push 0x4035a0
push ebx
lea eax, [esi + 4]
push 0x64
push eax
call fcn.0042548a
add esp, 0x14
push 0x403540
push dword [esi + 0x50]
call dword [0x40131c]
mov edi, 0x4034f8
cmp eax, ebx
je 0x411d2a
push eax
push 0x403540
push edi
push ebx
lea eax, [esi + 4]
push 0x64
push eax
call fcn.0042548a
add esp, 0x18
push 0x403498
push dword [esi + 0x50]
call dword [0x40131c]
cmp eax, ebx
je 0x411d52
push eax
push 0x403498
push edi
push ebx
lea eax, [esi + 4]
push 0x64
push eax
call fcn.0042548a
add esp, 0x18
push 0x403430
push dword [esi + 0x50]
call dword [0x40131c]
cmp eax, ebx
je 0x411d7a
push eax
push 0x403430
push edi
push ebx
lea eax, [esi + 4]
push 0x64
push eax
call fcn.0042548a
add esp, 0x18
push 0x4033c8
push dword [esi + 0x50]
call dword [0x40131c]
cmp eax, ebx
je 0x411928
push eax
push 0x4033c8
push edi
push ebx
push 0x64
add esi, 4
push esi
call fcn.0042548a
add esp, 0x18
jmp 0x411928
cmp eax, ebx
je 0x411cfd
push eax
push edi
push 0x403360
jmp 0x411ca9