Function at 0x48b370
Capabilities:
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x22e4
call fcn.004d9280
mov eax, dword [0x4f72bc]
xor eax, esp
mov dword [esp + 0x22e0], eax
push ebx
push esi
push edi
push 0x103
xor ebx, ebx
lea eax, [esp + 0x17e5]
push ebx
push eax
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x17ec], 0
call fcn.004d29c0
add esp, 0xc
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], ebx
cmp dword [0x506e0c], ebx
je 0x48b3f5
mov ecx, dword [0x4f8b78]
mov edx, dword [0x4f8b7c]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push 0x80
lea edx, [esp + 0x1764]
mov ecx, 0x2da
call fcn.004ca1e0
mov ecx, dword [0x4f8b78]
add esp, 4
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push CreateStatusWindowA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x48b5b3
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x30]
push ebx
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x1808]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x14], ebx
je 0x48b5a8
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1674]
push edx
push edi
mov esi, 0xff
push eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [esp + 0x14]
ja 0x48b5a8
cmp eax, 0x103
je 0x48b5a8
test eax, eax
jne 0x48b480
push esi
lea edx, [esp + 0x1664]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea ecx, [esp + 0x1cf4]
mov edx, CreateStatusWindowA
call fcn.004bff10
lea eax, [esp + 0x18f4]
push eax
lea ecx, [esp + 0x1460]
lea edx, [esp + 0x1cf8]
call fcn.004c0d10
add esp, 0x10
test eax, eax
je 0x48b480
push 0x1400
lea ecx, [esp + 0x54]
push 0
push ecx
call fcn.004d29c0
lea edx, [esp + 0x145c]
push edx
lea ecx, [esp + 0x60]
call fcn.004c0890
add esp, 0x10
lea ecx, [esp + 0x1450]
call fcn.0047af20
test eax, eax
je 0x48b57b
push 0
push 0xfc
lea eax, [esp + 0x458]
push eax
lea ecx, [esp + 0x1cf4]
push ecx
lea edx, [esp + 0x1460]
lea ecx, [esp + 0x1670]
call fcn.004c1eb0
add esp, 0x10
inc dword [esp + 0xc]
jmp 0x48b480
lea esi, [esp + 0x1450]
call fcn.00482ac0
test eax, eax
je 0x48b480
push 0
push 0xfc
lea edx, [esp + 0x1768]
push edx
lea eax, [esp + 0x1cf4]
push eax
jmp 0x48b55c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4f8b78]
lea edx, [esp + 0x10]
push edx
push eax
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push CreateStatusWindowA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48b7ae
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x30]
push ebx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x1808]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x14], ebx
je 0x48b79c
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1674]
push ecx
push edi
mov esi, 0xff
push edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [esp + 0x14]
ja 0x48b7a1
cmp eax, 0x103
je 0x48b7a1
test eax, eax
jne 0x48b626
lea edx, [esp + 0x18e8]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [esp + 0x1eec]
call fcn.004010b0
lea eax, [esp + 0x18e8]
push eax
lea ecx, [esp + 0x1454]
lea edx, [esp + 0x1664]
call fcn.004c0d10
add esp, 4
test eax, eax
je 0x48b626
push esi
lea ecx, [esp + 0x1664]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
lea ecx, [esp + 0x18f4]
mov edx, CreateStatusWindowA
call fcn.004bff10
push 0x1400
lea edx, [esp + 0x60]
push 0
push edx
call fcn.004d29c0
lea eax, [esp + 0x1468]
push eax
lea ecx, [esp + 0x6c]
call fcn.004c0890
add esp, 0x1c
lea ecx, [esp + 0x18e8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x48b729
lea edx, [esp + 0x1ee8]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [esp + 0x18ec]
call fcn.004010b0
lea ecx, [esp + 0x1450]
call fcn.0047af20
test eax, eax
je 0x48b76f
push 0
push 0xfd
lea eax, [esp + 0x458]
push eax
lea ecx, [esp + 0x166c]
push ecx
lea edx, [esp + 0x1460]
lea ecx, [esp + 0x18f8]
call fcn.004c1eb0
add esp, 0x10
inc dword [esp + 0xc]
jmp 0x48b626
lea esi, [esp + 0x1450]
call fcn.00482ac0
test eax, eax
je 0x48b626
push 0
push 0xfd
lea edx, [esp + 0x1768]
push edx
lea eax, [esp + 0x166c]
push eax
jmp 0x48b750
mov esi, 0xff
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48b7b3
mov esi, 0xff
mov eax, dword [0x4f8b78]
lea edx, [esp + 0x10]
push edx
push eax
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push CreateStatusWindowA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48b9d4
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x30]
push ebx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x1808]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x14], ebx
je 0x48b9c9
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1674]
push ecx
push edi
mov esi, 0xff
push edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [esp + 0x14]
ja 0x48b9c9
cmp eax, 0x103
je 0x48b9c9
test eax, eax
jne 0x48b826
lea edx, [esp + 0x18e8]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [esp + 0x1eec]
call fcn.004010b0
lea eax, [esp + 0x18e8]
push eax
lea ecx, [esp + 0x1454]
lea edx, [esp + 0x1664]
call fcn.004c0d10
add esp, 4
test eax, eax
je 0x48b826
push esi
lea ecx, [esp + 0x1664]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
lea ecx, [esp + 0x18f4]
mov edx, CreateStatusWindowA
call fcn.004bff10
push 0x1400
lea edx, [esp + 0x60]
push 0
push edx
call fcn.004d29c0
lea eax, [esp + 0x1468]
push eax
lea ecx, [esp + 0x6c]
call fcn.004c0890
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x1c
lea ecx, [esp + 0x18e8]
push ecx
call esi
test eax, eax
jne 0x48b92b
lea edx, [esp + 0x1ee8]
push edx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [esp + 0x18ec]
call fcn.004010b0
lea eax, [esp + 0x18e8]
push eax
call esi
test eax, eax
jle 0x48b826
lea ecx, [esp + 0x1450]
call fcn.0047af20
test eax, eax
je 0x48b984
push 0
push 0xfe
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x166c]
push edx
lea edx, [esp + 0x1460]
lea ecx, [esp + 0x18f8]
call fcn.004c1eb0
add esp, 0x10
add dword [esp + 0xc], 2
jmp 0x48b826
lea esi, [esp + 0x1450]
call fcn.00482ac0
test eax, eax
je 0x48b826
push 0
push 0xfe
lea eax, [esp + 0x1768]
push eax
lea ecx, [esp + 0x166c]
push ecx
mov edx, esi
lea ecx, [esp + 0x18f8]
call fcn.004c1eb0
add esp, 0x10
inc dword [esp + 0xc]
jmp 0x48b826
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str.AppInit_Dlls
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
lea ecx, [esp + 0x1df4]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x48bbc8
lea eax, [esp + 0x1de8]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x3c], ecx
test ecx, ecx
jle 0x48bafe
lea ecx, [ecx]
mov al, byte [esp + ebx + 0x1de8]
cmp al, 0x2c
je 0x48ba3c
cmp al, 0x20
je 0x48ba3c
mov byte [esp + esi + 0x1558], al
inc esi
jmp 0x48baf5
lea ecx, [esp + 0x1558]
push ecx
mov byte [esp + esi + 0x155c], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x48bae7
push 0x1400
lea edx, [esp + 0x54]
push 0
push edx
call fcn.004d29c0
lea eax, [esp + 0x1564]
push eax
lea ecx, [esp + 0x60]
call fcn.004c0890
add esp, 0x10
lea ecx, [esp + 0x1558]
call fcn.0047af20
test eax, eax
je 0x48baa8
push 0
push 0xff
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x85c]
push edx
jmp 0x48bacf
lea esi, [esp + 0x1558]
call fcn.00482ac0
test eax, eax
je 0x48bae7
push 0
push 0xff
lea eax, [esp + 0x1768]
push eax
lea ecx, [esp + 0x85c]
push ecx
lea edx, [esp + 0x1568]
lea ecx, [esp + 0x60]
call fcn.004c1eb0
inc dword [esp + 0x1c]
add esp, 0x10
inc edi
mov ecx, dword [esp + 0x3c]
xor esi, esi
mov byte [esp + 0x1558], 0
inc ebx
cmp ebx, ecx
jl 0x48ba20
lea edx, [esp + 0x1558]
push edx
mov byte [esp + esi + 0x155c], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x48bba9
push 0x1400
lea eax, [esp + 0x54]
push 0
push eax
call fcn.004d29c0
lea ecx, [esp + 0x1564]
push ecx
lea ecx, [esp + 0x60]
call fcn.004c0890
add esp, 0x10
lea ecx, [esp + 0x1558]
call fcn.0047af20
test eax, eax
je 0x48bb6a
push 0
push 0xff
lea edx, [esp + 0x458]
push edx
lea eax, [esp + 0x85c]
push eax
jmp 0x48bb91
lea esi, [esp + 0x1558]
call fcn.00482ac0
test eax, eax
je 0x48bba9
push 0
push 0xff
lea ecx, [esp + 0x1768]
push ecx
lea edx, [esp + 0x85c]
push edx
lea edx, [esp + 0x1568]
lea ecx, [esp + 0x60]
call fcn.004c1eb0
inc dword [esp + 0x1c]
add esp, 0x10
inc edi
cmp dword [esp + 0x3c], 0
jle 0x48bbc8
test edi, edi
jne 0x48bbc8
mov eax, str.AppInit_Dlls
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov ebx, CreateStatusWindowA
call fcn.004c00f0
mov ecx, dword [0x4f8b78]
lea eax, [esp + 0x10]
push eax
push ecx
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push CreateStatusWindowA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48be21
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x30]
push ebx
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x1808]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x1c], ebx
je 0x48be16
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x1ef0]
push eax
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18fc]
push edx
push edi
mov esi, 0xff
push eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, ebx
inc edi
inc ebx
cmp ecx, dword [esp + 0x1c]
ja 0x48be16
cmp eax, 0x103
je 0x48be16
test eax, eax
jne 0x48bc3c
lea edx, [esp + 0x18e8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x48bc3c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [esp + 0x1eec]
call fcn.004010b0
mov eax, 0x400
lea ecx, [esp + 0x1ee8]
lea esp, [esp]
cmp byte [ecx], 0
je 0x48bcdb
inc ecx
dec eax
jne 0x48bcd0
jmp 0x48bd03
test eax, eax
je 0x48bd03
mov ecx, 0x400
sub ecx, eax
mov eax, 0x400
sub eax, ecx
push 0x4e28bc
lea ecx, [esp + ecx + 0x1eec]
mov edx, 0x7fffffff
call fcn.004010b0
mov edx, 0x400
lea eax, [esp + 0x1ee8]
nop
cmp byte [eax], 0
je 0x48bd1b
inc eax
dec edx
jne 0x48bd10
jmp 0x48bd46
test edx, edx
je 0x48bd46
lea eax, [esp + 0x18e8]
push eax
mov ecx, 0x400
sub ecx, edx
mov eax, 0x400
sub eax, ecx
lea ecx, [esp + ecx + 0x1eec]
mov edx, 0x7fffffff
call fcn.004010b0
push esi
lea ecx, [esp + 0x1eec]
push str.DllName
push ecx
lea ecx, [esp + 0x145c]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [esp + 0x1450]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x48bc3c
push 0x1400
lea eax, [esp + 0x54]
push 0
push eax
call fcn.004d29c0
lea ecx, [esp + 0x145c]
push ecx
lea ecx, [esp + 0x60]
call fcn.004c0890
add esp, 0x10
lea ecx, [esp + 0x1450]
call fcn.0047af20
test eax, eax
je 0x48bde9
push 0
push 0x100
lea edx, [esp + 0x458]
push edx
lea eax, [esp + 0xc5c]
push eax
lea edx, [esp + 0x1460]
lea ecx, [esp + 0x18f8]
call fcn.004c1eb0
add esp, 0x10
inc dword [esp + 0xc]
jmp 0x48bc3c
lea esi, [esp + 0x1450]
call fcn.00482ac0
test eax, eax
je 0x48bc3c
push 0
push 0x100
lea ecx, [esp + 0x1768]
push ecx
lea edx, [esp + 0xc5c]
push edx
jmp 0x48bdca
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x506e0c], 0
mov eax, dword [esp + 0xc]
je 0x48be42
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [0x4f8b78], ecx
mov dword [0x4f8b7c], edx
mov ecx, dword [esp + 0x22ec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret