Function at 0x440434
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
mov ecx, 3
push ebx
push esi
push edi
mov esi, 0x50f5d0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x50f5dd]
pop edi
mov dword [ebp - 0x18], eax
xor esi, esi
mov ax, word [0x50f5e1]
mov word [ebp - 0x14], ax
test bl, 1
je 0x44047a
mov eax, ebx
jmp 0x440bf8
test bh, 0x20
jne 0x4404ac
test bh, 0x40
jne 0x4404ac
test bh, 0x10
jne 0x4404ac
test bh, 0x80
jne 0x4404ac
test ebx, 0x10000
jne 0x4404ac
test ebx, 0x40000
jne 0x4404ac
test ebx, 0x20000
jne 0x4404ac
or ebx, 0x7f000
test bh, 0x20
je 0x4405ac
push 0x5d1ce7
lea edx, [ebp - 0x218]
push edx
call fcn.004d26c8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000001
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4405ac
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x4405ac
test bl, 0x20
je 0x440561
test edi, edi
jne 0x440535
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
jmp 0x440550
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440559
or esi, 1
jmp 0x4405a0
or esi, 0x2000
jmp 0x4405a0
test edi, edi
je 0x44058e
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x2000
test bl, 0x80
je 0x4405a0
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x4405ac
mov eax, esi
jmp 0x440bf8
test bh, 0x40
je 0x4406ac
push 0x5d1d21
lea edx, [ebp - 0x218]
push edx
call fcn.004d26c8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4406ac
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x4406ac
test bl, 0x20
je 0x440661
test edi, edi
jne 0x440635
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
jmp 0x440650
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440659
or esi, 1
jmp 0x4406a0
or esi, 0x4000
jmp 0x4406a0
test edi, edi
je 0x44068e
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x4000
test bl, 0x80
je 0x4406a0
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x4406ac
mov eax, esi
jmp 0x440bf8
test bh, 0x10
je 0x4407f3
push 0x5d1d5b
lea edx, [ebp - 0x418]
push edx
call fcn.004d26c8
add esp, 8
lea ecx, [ebp - 0x218]
mov byte [ebp - 0x218], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x418]
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4407f3
push 4
push 0x5d1da7
lea ecx, [ebp - 0x218]
push ecx
call fcn.004ce208
add esp, 0xc
test eax, eax
jne 0x4407f3
test bl, 0x20
je 0x44077b
test edi, edi
jne 0x440745
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x214]
push ecx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
jmp 0x440760
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x214]
push eax
push edx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440769
or esi, 1
jmp 0x44076f
or esi, 0x1000
test bl, 0x80
je 0x4407e7
mov eax, esi
jmp 0x440bf8
mov byte [ebp - 0x418], 0
push 1
lea edx, [ebp - 0x418]
push 0x200
push edx
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x214]
push ecx
push eax
push 0x80000001
call fcn.00406a20
add esp, 0x18
test edi, edi
je 0x4407d5
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x1000
test bl, 0x80
je 0x4407e7
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x4407f3
mov eax, esi
jmp 0x440bf8
test bh, 0x80
je 0x4408fd
push 0x5d1dac
lea edx, [ebp - 0x218]
push edx
call fcn.004d26c8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4408fd
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x4408fd
test bl, 0x20
je 0x4408b2
test edi, edi
jne 0x44087c
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
jmp 0x440897
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x4408a0
or esi, 1
jmp 0x4408a6
or esi, 0x8000
test bl, 0x80
je 0x4408f1
mov eax, esi
jmp 0x440bf8
test edi, edi
je 0x4408df
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x8000
test bl, 0x80
je 0x4408f1
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x4408fd
mov eax, esi
jmp 0x440bf8
test ebx, 0x40000
je 0x440a0a
push 0x5d1de2
lea edx, [ebp - 0x218]
push edx
call fcn.004d26c8
add esp, 8
lea ecx, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000001
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x440a0a
mov cl, byte [ebp - 0x418]
test cl, cl
je 0x440a0a
test bl, 0x20
je 0x4409bf
test edi, edi
jne 0x440989
push 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
jmp 0x4409a4
push 1
push edi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x218]
push eax
push edx
push 0x80000001
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x4409ad
or esi, 1
jmp 0x4409b3
or esi, 0x40000
test bl, 0x80
je 0x4409fe
mov eax, esi
jmp 0x440bf8
test edi, edi
je 0x4409ec
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x40000
test bl, 0x80
je 0x4409fe
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x440a0a
mov eax, esi
jmp 0x440bf8
mov edx, ebx
and edx, 0x10000
test edx, edx
je 0x440b22
push 0x5d1e18
lea ecx, [ebp - 0x218]
push ecx
call fcn.004d26c8
add esp, 8
lea eax, [ebp - 0x418]
mov byte [ebp - 0x418], 0
push 1
push 0x200
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x440b22
mov al, byte [ebp - 0x418]
test al, al
je 0x440b22
mov edx, ebx
and edx, 0x10000
test edx, edx
je 0x440ad7
test edi, edi
jne 0x440aa1
push 1
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x218]
push edx
push 0x80000002
call fcn.00406a5c
add esp, 0x14
jmp 0x440abc
push 1
push edi
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x218]
push ecx
push eax
push 0x80000002
call fcn.00406a5c
add esp, 0x14
test eax, eax
jne 0x440ac5
or esi, 1
jmp 0x440acb
or esi, 0x10000
test bl, 0x80
je 0x440b16
mov eax, esi
jmp 0x440bf8
test edi, edi
je 0x440b04
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x10000
test bl, 0x80
je 0x440b16
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x440b22
mov eax, esi
jmp 0x440bf8
test ebx, 0x20000
je 0x440bf3
push esi
push edi
lea edi, [ebp - 0x218]
mov esi, 0x5d1e5a
mov eax, edi
lea edx, [ebp - 0x218]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebp - 0x418], 0
push edx
lea ecx, [ebp - 0x418]
push 0x5d1e6a
push ecx
lea eax, [ebp - 0x18]
push eax
push 0x5d1e65
call fcn.0040c948
test bl, 0x20
je 0x440bae
test edi, edi
jne 0x440b90
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x18]
push eax
push 0x5d1e6b
call fcn.0040c86c
jmp 0x440ba6
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x18]
push edx
push edi
push ecx
push 0x5d1e70
call fcn.0040c86c
or esi, 0x20000
jmp 0x440bea
test edi, edi
je 0x440bdb
push esi
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x418]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
or esi, 0x20000
test bl, 0x80
je 0x440bea
mov eax, esi
jmp 0x440bf8
test bl, 0x40
je 0x440bf3
mov eax, esi
jmp 0x440bf8
or esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret