Function at 0x4ab1b8
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab729
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4ab740
mov eax, ebx
call fcn.004aa32c
mov edx, 0x4ab750
mov eax, ebx
call fcn.004aa32c
mov edx, 0x4ab760
mov eax, ebx
call fcn.004aa32c
mov edx, 0x4ab774
mov eax, ebx
call fcn.004aa32c
mov edx, 0x4ab78c
mov eax, ebx
call fcn.004aa32c
mov edx, 0x4ab7a4
mov eax, ebx
call fcn.004aa32c
mov esi, 1
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408d10
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004aa3f8
inc esi
cmp esi, 0x15
jne 0x4ab221
mov edx, 0x4ab7b8
mov eax, ebx
call fcn.004aa5a0
mov edx, 0x4ab7cc
mov eax, ebx
call fcn.004aa5a0
mov edx, 0x4ab7e0
mov eax, ebx
call fcn.004aa5a0
mov edx, 0x4ab7f0
mov eax, ebx
call fcn.004aa4d8
mov edx, 0x4ab800
mov eax, ebx
call fcn.004aa4d8
mov edx, 0x4ab814
mov eax, ebx
call fcn.004aa4d8
mov ecx, 0x4ab828
mov edx, 0x4ab848
mov eax, ebx
call fcn.004aa7f0
mov ecx, 0x4ab858
mov edx, 0x4ab848
mov eax, ebx
call fcn.004aa7f0
mov ecx, 0x4ab86c
mov edx, 0x4ab848
mov eax, ebx
call fcn.004aa7f0
mov ecx, 0x4ab774
mov edx, 0x4ab884
mov eax, ebx
call fcn.004aa7f0
mov ecx, 0x4ab898
mov edx, 0x4ab884
mov eax, ebx
call fcn.004aa7f0
mov ecx, 0x4ab8a8
mov edx, 0x4ab884
mov eax, ebx
call fcn.004aa7f0
mov ecx, 0x4ab8bc
mov edx, 0x4ab884
mov eax, ebx
call fcn.004aa7f0
mov eax, ebx
call fcn.004aa668
mov eax, ebx
call fcn.004aa720
mov eax, ebx
call fcn.004a9f30
push 0x4ab8d4
mov ecx, 0x4ab8e8
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab904
mov ecx, 0x4ab918
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab934
mov ecx, 0x4ab944
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab8d4
mov ecx, 0x4ab8e8
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4ab98c
mov ecx, 0x4ab99c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab9e4
mov ecx, 0x4aba14
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4aba58
mov ecx, 0x4aba6c
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4abad0
mov ecx, 0x4aba6c
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4abadc
mov ecx, 0x4abaf4
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4abb30
mov ecx, 0x4abb44
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4abb7c
mov ecx, 0x4abb8c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abbc4
mov ecx, 0x4abbd0
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abbec
mov ecx, 0x4abc08
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abbec
mov ecx, 0x4abc3c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abc70
mov ecx, 0x4abbd0
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abc80
mov ecx, 0x4abbd0
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abbec
mov ecx, 0x4abc90
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab7f0
mov ecx, 0x4abcc4
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab7f0
mov ecx, 0x4abd04
mov edx, 0x80000003
mov eax, ebx
call fcn.004aacc0
push 0x4ab7f0
mov ecx, 0x4abd44
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
mov eax, dword [ebx + 0x334]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ab52c
inc eax
mov dword [ebp - 8], eax
xor esi, esi
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x334]
mov eax, dword [eax + 0x218]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409420
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404630
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4ab944
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
inc esi
dec dword [ebp - 8]
jne 0x4ab4e3
push 0x4abd7c
push 0x4abd90
mov ecx, 0x4abdc0
mov edx, 0x80000002
mov eax, ebx
call fcn.004aad60
push 0x4abd7c
push 0x4abd90
mov ecx, 0x4abdf4
mov edx, 0x80000002
mov eax, ebx
call fcn.004aad60
push 0x4abd7c
push 0x4abd90
mov ecx, 0x4abc08
mov edx, 0x80000002
mov eax, ebx
call fcn.004aad60
push 0x4abd7c
push 0x4abd90
mov ecx, 0x4abc3c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aad60
push 0x4abe28
mov ecx, 0x4abe40
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abe64
mov ecx, 0x4abe78
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4abe8c
mov ecx, 0x4abebc
mov edx, 0x80000001
mov eax, ebx
call fcn.004aacc0
push 0x4abf0c
mov ecx, 0x4abf1c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ab8d4
mov ecx, 0x4ab8e8
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abf68
mov ecx, 0x4abf80
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abfac
mov ecx, 0x4abfc4
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abff0
mov ecx, 0x4ac010
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abfac
mov ecx, 0x4ac03c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abff0
mov ecx, 0x4ac064
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4abe8c
mov ecx, 0x4ac08c
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ac0ac
mov ecx, 0x4ab944
mov edx, 0x80000002
mov eax, ebx
call fcn.004aacc0
push 0x4ac0bc
push 0x4e20
mov ecx, 0x4ac0e0
mov edx, 0x80000002
mov eax, ebx
call fcn.004ac420
push 0x4ac0bc
push 0x4e20
mov ecx, 0x4ac108
mov edx, 0x80000002
mov eax, ebx
call fcn.004ac420
push 0x4ac134
push 0
mov ecx, 0x4ac150
mov edx, 0x80000002
mov eax, ebx
call fcn.004ac4b8
push 0x4ac134
push 0
mov ecx, 0x4ac17c
mov edx, 0x80000002
mov eax, ebx
call fcn.004ac4b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab730
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004045bc
lea eax, [ebp - 4]
call fcn.00404598
ret