Function at 0x6e992c
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
xor eax, eax
push ebp
push 0x6e9ef0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x449884]
call fcn.004499f0
mov dword [ebp - 0x24], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x24]
call fcn.00449acc
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jne 0x6e9a09
mov eax, dword [0x7b9914]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c0]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x6e9a09
xor ecx, ecx
mov edx, 0x6e9f08
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e99b9
mov edx, 0x6e9f38
mov eax, dword [ebp - 0x24]
call fcn.0044a064
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6e9f4c
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e99e1
mov edx, 0x6e9f84
mov eax, dword [ebp - 0x24]
call fcn.0044a064
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6e9f94
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9a09
mov edx, 0x6e9fc8
mov eax, dword [ebp - 0x24]
call fcn.0044a064
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jle 0x6e9a40
xor ecx, ecx
mov edx, 0x6e9fe0
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9a40
xor ecx, ecx
mov edx, 0x6ea020
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 6
jge 0x6e9a5b
mov eax, dword [0x7b9cd0]
mov eax, dword [eax]
mov dl, 1
call fcn.0068bc30
xor ecx, ecx
mov edx, 0x6ea03c
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9aaa
xor eax, eax
push ebp
push 0x6e9a98
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x1f4
mov edx, 0x6ea078
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6e9aa2
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov edx, 0x80000001
mov eax, dword [ebp - 0x24]
call fcn.00449acc
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jle 0x6e9ad2
mov eax, dword [0x7b9cd0]
mov eax, dword [eax]
mov dl, 1
call fcn.0068bd70
mov eax, dword [0x7b9cd0]
mov eax, dword [eax]
xor edx, edx
call fcn.0068c044
xor ecx, ecx
mov edx, 0x6ea094
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9b9d
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea0d8
call fcn.00405940
je 0x6e9b4f
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea0e4
call fcn.00405940
je 0x6e9b4f
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea0f4
call fcn.00405940
je 0x6e9b4f
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea104
call fcn.00405940
jne 0x6e9b63
mov ecx, 1
mov edx, 0x6ea114
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
jmp 0x6e9b79
mov byte [ebp - 1], 1
push 1
lea ecx, [ebp - 1]
mov edx, 0x6ea114
mov eax, dword [ebp - 0x24]
call fcn.0044a450
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x6e9b95
xor ecx, ecx
mov edx, 0x6ea12c
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6ea14c
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9bca
mov ecx, 0x6ea178
mov edx, 0x6ea184
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x6e9c22
xor ecx, ecx
mov edx, 0x6ea198
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9c22
xor ecx, ecx
mov edx, 0x6ea1b8
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
xor ecx, ecx
mov edx, 0x6ea1d4
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov ecx, 1
mov edx, 0x6ea1e8
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6ea204
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9e46
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 6
jge 0x6e9c57
xor eax, eax
mov ecx, eax
mov edx, 0x6ea224
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov ecx, 0x6ea178
mov edx, 0x6ea23c
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov ecx, 0x6ea178
mov edx, 0x6ea254
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 4
jne 0x6e9caf
mov byte [ebp - 5], 0x10
mov byte [ebp - 4], 0
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
push 4
lea ecx, [ebp - 5]
mov edx, 0x6ea26c
mov eax, dword [ebp - 0x24]
call fcn.0044a450
jmp 0x6e9d9a
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea288
call fcn.00405940
jne 0x6e9cec
mov byte [ebp - 5], 0xb0
mov byte [ebp - 4], 0x32
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0x80
push 4
lea ecx, [ebp - 5]
mov edx, 0x6ea298
mov eax, dword [ebp - 0x24]
call fcn.0044a450
jmp 0x6e9d9a
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea0d8
call fcn.00405940
je 0x6e9d18
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea0e4
call fcn.00405940
jne 0x6e9d3c
mov byte [ebp - 5], 0xb0
mov byte [ebp - 4], 0x32
mov byte [ebp - 3], 3
mov byte [ebp - 2], 0x80
push 4
lea ecx, [ebp - 5]
mov edx, 0x6ea298
mov eax, dword [ebp - 0x24]
call fcn.0044a450
jmp 0x6e9d9a
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea0f4
call fcn.00405940
je 0x6e9d68
mov eax, dword [0x7ba710]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, 0x6ea104
call fcn.00405940
jne 0x6e9d9a
mov byte [ebp - 0xd], 0x90
mov byte [ebp - 0xc], 0x12
mov byte [ebp - 0xb], 3
mov byte [ebp - 0xa], 0x80
mov byte [ebp - 9], 0x12
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
push 8
lea ecx, [ebp - 0xd]
mov edx, 0x6ea298
mov eax, dword [ebp - 0x24]
call fcn.0044a450
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [0x7ba710]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x6e9e2b
xor ecx, ecx
mov edx, 0x6ea2b4
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9ddc
mov ecx, 2
mov edx, 0x6ea300
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
xor ecx, ecx
mov edx, 0x6ea318
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9e15
xor ecx, ecx
mov edx, 0x6ea35c
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
xor ecx, ecx
mov edx, 0x6ea378
mov eax, dword [ebp - 0x24]
call fcn.0044a3e8
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov byte [ebp - 0xe], 1
push 0
lea eax, [ebp - 0xe]
push eax
push 0
push 0x1043
call sub.user32.dll_SystemParametersInfoA
mov dword [ebp - 0x16], 8
xor eax, eax
mov dword [ebp - 0x12], eax
push 0
lea eax, [ebp - 0x16]
push eax
push 8
push 0x49
call sub.user32.dll_SystemParametersInfoA
mov edx, 0x80000000
mov eax, dword [ebp - 0x24]
call fcn.00449acc
xor ecx, ecx
mov edx, 0x6ea394
mov eax, dword [ebp - 0x24]
call fcn.00449c10
test al, al
je 0x6e9e99
lea edx, [ebp - 0x28]
mov eax, dword [0x7b9914]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d0]
mov eax, dword [eax + 0x21c]
call fcn.0040d6bc
mov ecx, dword [ebp - 0x28]
mov edx, 0x6ea254
mov eax, dword [ebp - 0x24]
call fcn.0044a318
mov eax, dword [ebp - 0x24]
call fcn.00449a9c
mov eax, dword [ebp - 0x24]
call fcn.004045cc
lea eax, [ebp - 0x1c]
mov edx, 0x6ea3cc
call fcn.004055b0
lea edx, [ebp - 0x20]
mov eax, dword [0x7ba4c8]
call fcn.00407bd4
mov eax, dword [0x7b9914]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.00705ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e9ef7
lea eax, [ebp - 0x28]
call fcn.00405518
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040553c
ret