Function at 0x48c540
Capabilities:
Delete registry value
Get common file path
Persist via ginadll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2dc
push ebx
push esi
push edi
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, 1
lea ecx, [ebp - 0x68]
push ebx
mov dword [0xe56cf8], esi
mov byte [0xda6f64], 0
call fcn.004f0653
mov ecx, dword [0x4fe4e8]
mov byte [ebp - 4], bl
push ecx
push ebx
push str.c:endpcache_special_gina_dll.txt
lea ecx, [ebp - 0x68]
call fcn.004f0727
mov edx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0x64]
cmp dword [eax + 0x30], 0xffffffff
je 0x48c619
mov esi, dword [ebp - 0x64]
push 0xa
lea ecx, [ebp - 0x268]
push 0x100
inc esi
push ecx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], esi
call fcn.004f0ae9
lea edi, [ebp - 0x268]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x48c619
lea edi, [ebp - 0x268]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0xe56cfc], ebx
mov edx, ecx
mov esi, edi
mov edi, 0xda6f64
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x68]
call fcn.004f076e
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x54]
call fcn.004f05fb
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0xc30c0c
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push closesocket
mov dword [0xe56cf8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48c745
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov byte [ebp - 0x168], al
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x168]
push edx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push str.GinaDLL
push edx
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x1c], ebx
call esi
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
push ecx
push edx
push 0
push str.GinaDll
push eax
call esi
test eax, eax
jne 0x48c745
lea edi, [ebp - 0x168]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x48c745
lea ecx, [ebp - 0x168]
push ecx
push 0xda6f64
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48c7a5
lea edi, [ebp - 0x168]
or ecx, 0xffffffff
xor eax, eax
push str.GinaDLL
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [ebp - 0x14]
mov edx, ecx
mov esi, edi
mov edi, 0xd8832c
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [0xe56cf8], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0xc30c0c
push str.GINADLL
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.004bb8b0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0xe56cfc], ebx
jne 0x48c784
push 0x5147e0
push 0xda6f64
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48c784
push 0xda6f64
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
jne 0x48c784
call fcn.004cd5f0
mov eax, dword [0xe56cfc]
test eax, eax
jne 0x48c7e0
call fcn.004cd5f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0xe56cf8], 2
jmp 0x48c745
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret