Function at 0x5480a0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
sub esp, 0x91c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x918], eax
push ebp
mov ebp, dword [esp + 0x924]
cmp ebp, 0xb
jne 0x5480ee
call fcn.004d9b00
test eax, eax
je 0x548643
push 1
call fcn.00547ad0
add esp, 4
pop ebp
mov ecx, dword [esp + 0x918]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x91c
ret
cmp ebp, 0xa
jne 0x548120
call fcn.004d9b00
test eax, eax
je 0x548643
push 2
call fcn.00547ad0
add esp, 4
pop ebp
mov ecx, dword [esp + 0x918]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x91c
ret
push ebx
push esi
push edi
mov ecx, 0xa
mov esi, str.SYSTEMCurrentControlSetControlSafeBoot
lea edi, [esp + 0x414]
rep movsd dword es:[edi], dword [esi]
push 0xda
xor ebx, ebx
lea eax, [esp + 0x442]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x529]
push ebx
push ecx
mov byte [esp + 0x530], bl
call fcn.005dfd60
add esp, 0x18
lea edx, [esp + 0x518]
push edx
call fcn.00503120
cmp byte [esp + 0x518], bl
je 0x548640
cmp ebp, 1
jne 0x548461
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.AlternateShell
push str.SYSTEMCurrentControlSetControlSafeBoot
mov esi, 0x400
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x28], bl
mov dword [esp + 0x24], esi
call fcn.004d5770
cmp byte [esp + 0x14], bl
jne 0x5481d1
mov edx, dword [str.cmd.exe]
mov eax, dword [0x62ea20]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
push ebx
lea ecx, [esp + 0x18]
push str.slock.exe
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x548359
lea edx, [esp + 0x414]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e4990
add esp, 8
test eax, eax
je 0x548359
lea eax, [esp + 0x518]
push eax
lea ecx, [esp + 0x418]
push ecx
lea edx, [esp + 0x728]
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_s
push edx
call fcn.005dfb23
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
lea eax, [esp + 0x744]
push 1
push eax
call fcn.00506de0
add esp, 0x2c
test eax, eax
je 0x548284
push 0x103
lea ecx, [esp + 0x621]
push ebx
push ecx
mov byte [esp + 0x628], bl
call fcn.005dfd60
lea edx, [esp + 0x628]
push 0x104
push edx
call fcn.004d8c20
lea eax, [esp + 0x630]
push eax
push str._SUBINACL_SB__Failed_to_start_subinacl_A1___Reason:__s
jmp 0x5482ff
lea ecx, [esp + 0x518]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x41c]
push eax
lea ecx, [esp + 0x72c]
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_s__grant_sf
push ecx
call fcn.005dfb23
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
lea edx, [esp + 0x748]
push 1
push edx
call fcn.00506de0
add esp, 0x30
test eax, eax
je 0x548308
push 0x103
lea eax, [esp + 0x621]
push ebx
push eax
mov byte [esp + 0x628], bl
call fcn.005dfd60
lea ecx, [esp + 0x628]
push 0x104
push ecx
call fcn.004d8c20
lea edx, [esp + 0x630]
push edx
push str._SUBINACL_SB__Failed_to_start_subinacl_B1___Reason:__s
push ebx
call fcn.004f0f30
add esp, 0x20
lea eax, [esp + 0x14]
push eax
push str.ASBack
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
mov ecx, dword [str.slock.exe]
mov edx, dword [0x623544]
mov ax, word [0x623548]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push str.AlternateShell
push str.SYSTEMCurrentControlSetControlSafeBoot
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edx
mov word [esp + 0x2c], ax
call fcn.004e7720
mov byte [esp + 0x14], bl
mov dword [esp + 0x10], esi
call fcn.004d96c0
test eax, eax
je 0x54838a
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 0x64a5bc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004feb40
jmp 0x5483a8
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x64a5bc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp byte [esp + 0x14], bl
jne 0x5483d4
mov eax, dword [0x618e20]
mov ecx, dword [0x618e24]
mov edx, dword [0x618e28]
mov dword [esp + 0x14], eax
mov al, byte [0x618e2c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], al
push ebx
lea ecx, [esp + 0x18]
push str.slock.exe
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x54845a
lea edx, [esp + 0x14]
push edx
push str.SHBack
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push 1
push 0x2c
push str.slock.exe
lea eax, [esp + 0x20]
push eax
call fcn.004e56c0
call fcn.004d96c0
test eax, eax
je 0x548441
lea ecx, [esp + 0x14]
push ecx
push 0x64a5bc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004febf0
push 1
jmp 0x548638
lea edx, [esp + 0x14]
push edx
push 0x64a5bc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push 1
jmp 0x548638
cmp ebp, ebx
jne 0x548640
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.ASBack
push 0x60d814
mov esi, 0x400
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x28], bl
mov dword [esp + 0x24], esi
call fcn.004d5770
cmp byte [esp + 0x14], bl
je 0x5484b2
push ebx
lea edx, [esp + 0x18]
push str.slock.exe
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x5484c5
mov eax, dword [str.cmd.exe]
mov ecx, dword [0x62ea20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
lea edx, [esp + 0x414]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e4990
add esp, 8
test eax, eax
je 0x54858f
lea eax, [esp + 0x14]
push eax
push str.AlternateShell
push str.SYSTEMCurrentControlSetControlSafeBoot
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
lea ecx, [esp + 0x518]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x41c]
push eax
lea ecx, [esp + 0x72c]
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_s__grant_sr
push ecx
call fcn.005dfb23
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
lea edx, [esp + 0x748]
push 1
push edx
call fcn.00506de0
add esp, 0x30
call fcn.004d9b00
test eax, eax
je 0x548559
lea eax, [esp + 0x414]
push eax
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setowner_NT_SERVICETrustedInstaller_
lea ecx, [esp + 0x728]
push ecx
jmp 0x54856e
lea edx, [esp + 0x414]
push edx
push str.SUBINACL__keyreg__HKEY_LOCAL_MACHINE_s___setownerAdministrators
lea eax, [esp + 0x728]
push eax
call fcn.005dfb23
add esp, 0xc
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
lea ecx, [esp + 0x734]
push 1
push ecx
call fcn.00506de0
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push str.SHBack
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x28], bl
mov dword [esp + 0x24], esi
call fcn.004d5770
cmp byte [esp + 0x14], bl
je 0x5485d3
push ebx
lea ecx, [esp + 0x18]
push str.slock.exe
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x5485fa
mov edx, dword [0x618e20]
mov eax, dword [0x618e24]
mov ecx, dword [0x618e28]
mov dword [esp + 0x14], edx
mov dl, byte [0x618e2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x20], dl
call fcn.004d96c0
test eax, eax
je 0x54861e
lea eax, [esp + 0x14]
push eax
push 0x64a5bc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004febf0
jmp 0x548637
lea ecx, [esp + 0x14]
push ecx
push 0x64a5bc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push ebx
call fcn.00547230
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x91c]
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x91c
ret