Function at 0x408815
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x1bc], eax
mov eax, dword [ebp + 0x1c8]
push ebx
push esi
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x1cc]
push edi
mov dword [ebp - 0x6c], eax
xor ecx, ecx
push 4
mov eax, 0x8000
pop edx
mov dword [ebp - 0x54], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00419190
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and dword [ebp - 0x5c], 0
mov dword [esp], str.EnumProcesses
mov ebx, str.PSAPI.DLL
push ebx
mov dword [ebp - 0x60], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.EnumProcessModules
push ebx
mov dword [ebp - 0x50], eax
call esi
push eax
call edi
push str.GetModuleBaseNameA
push ebx
mov dword [ebp - 0x68], eax
call esi
push eax
call edi
xor ebx, ebx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x50], ebx
je 0x408a90
cmp dword [ebp - 0x68], ebx
je 0x408a90
cmp eax, ebx
je 0x408a90
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x54]
shl eax, 2
push eax
push dword [ebp - 0x60]
call dword [ebp - 0x50]
test eax, eax
je 0x408a90
shr dword [ebp - 0x54], 2
mov esi, str.Explorer.exe
lea edi, [ebp + 0xb8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xf7
lea eax, [ebp + 0xc5]
push ebx
push eax
mov dword [ebp - 0x70], ebx
movsb byte es:[edi], byte [esi]
call fcn.0044f370
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xb8]
push eax
push ebx
push ebx
push str.Shell
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xb8]
push 0x5c
push eax
call fcn.0044ee50
mov esi, eax
pop ecx
inc esi
pop ecx
test eax, eax
jne 0x408958
lea esi, [ebp + 0xb8]
push esi
call fcn.0044fc30
inc eax
push eax
lea eax, [ebp + 0xb8]
push esi
push eax
call fcn.004504e0
add esp, 0x10
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x54], ebx
jbe 0x408a80
mov esi, 0x2000000
jmp 0x408985
xor ebx, ebx
mov edi, dword [ebp - 0x5c]
cmp edi, dword [ebp + 0x1d0]
jae 0x408a83
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x50]
push dword [eax + ecx*4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x408a6f
and dword [ebp - 0x74], 0
lea eax, [ebp - 0x80]
push eax
push 4
lea eax, [ebp - 0x74]
push eax
push ebx
call dword [ebp - 0x68]
test eax, eax
je 0x408a62
push 0x104
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x74]
push ebx
call dword [ebp - 0x78]
test eax, eax
je 0x408a62
lea eax, [ebp + 0xb8]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0044f215
pop ecx
pop ecx
test eax, eax
jne 0x408a1e
and dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408a1e
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov byte [eax + edi], 0
mov eax, dword [ebp - 0x58]
mov dword [ecx + edi*4], eax
inc edi
mov dword [ebp - 0x5c], edi
cmp byte [0x4ad76b], 0
je 0x408a62
lea eax, [ebp - 0x4c]
push str.winlogon.exe
push eax
call fcn.0044f215
pop ecx
pop ecx
test eax, eax
jne 0x408a62
and dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408a62
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov byte [eax + edi], 1
mov eax, dword [ebp - 0x58]
mov dword [ecx + edi*4], eax
inc edi
mov dword [ebp - 0x5c], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x54]
jb 0x408983
jmp 0x408a83
mov edi, dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.004191bf
pop ecx
mov eax, edi
jmp 0x408a92
xor eax, eax
mov ecx, dword [ebp + 0x1bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f35b
add ebp, 0x1c0
leave
ret