Function at 0x45fc50
Capabilities:
Delete registry value
Get common file path
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x310
lea eax, [esp + 0x190]
push ebx
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
lea edx, [esp + 4]
push ecx
xor ebx, ebx
push edx
push ebx
push 0xf003f
push ebx
push 0x57d044
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x460035
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.AppInit_DLLs
push eax
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 1
mov byte [esp + 0x38], bl
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.AppInit_DLLs
push ecx
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x45fd2f
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45fd2f
mov edx, dword [esp + 0x10]
push str.AppInit_DLLs
push edx
call ebp
push 0x57d044
push str.AppInit_DLLs
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.0045f7b0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x48b084
push eax
mov byte [esp + 0x38], bl
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x48b084
push ecx
call esi
test eax, eax
jne 0x45fd8b
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45fd8b
mov edx, dword [esp + 0x10]
push 0x48b084
push edx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push 0x493e04
push eax
mov byte [esp + 0x38], bl
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push 0x493e04
push ecx
call esi
test eax, eax
jne 0x45fde7
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45fde7
mov edx, dword [esp + 0x10]
push 0x493e04
push edx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.Userinit
push eax
mov byte [esp + 0x38], bl
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.Userinit
push ecx
call esi
test eax, eax
jne 0x45fe9d
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45fe9d
lea edx, [esp + 0x20]
lea eax, [esp + 0x120]
push edx
push 0x48b2f4
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x1ac]
lea edx, [esp + 0x22c]
push ecx
push str._suserinit.exe
push edx
call fcn.0047a8f8
lea eax, [esp + 0x138]
push str.userinit.exe
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x45feb4
lea ecx, [esp + 0x220]
lea edx, [esp + 0x120]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x45feb4
push str.userinit.exe
push str.Userinit
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.0045f7b0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.UIHost
push eax
mov byte [esp + 0x38], bl
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.UIHost
push ecx
call esi
test eax, eax
jne 0x45ff6a
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x45ff6a
lea edx, [esp + 0x20]
lea eax, [esp + 0x120]
push edx
push 0x48b2f4
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x1ac]
lea edx, [esp + 0x22c]
push ecx
push str._slogonui.exe
push edx
call fcn.0047a8f8
lea eax, [esp + 0x138]
push str.logonui.exe
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x45ff81
lea ecx, [esp + 0x220]
lea edx, [esp + 0x120]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x45ff81
push str.logonui.exe
push str.UIHost
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.0045f7b0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.shell
push eax
mov byte [esp + 0x38], bl
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.shell
push ecx
call esi
test eax, eax
jne 0x460001
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x460001
lea edx, [esp + 0x20]
lea eax, [esp + 0x120]
push edx
push 0x48b2f4
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x12c]
push 0x48ba7c
push ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x460018
push 0x48ba7c
push str.Shell
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.0045f7b0
add esp, 0xc
mov edx, dword [esp + 0x10]
push str.legalnoticecaption
push edx
call ebp
mov eax, dword [esp + 0x10]
push str.legalnoticetext
push eax
call ebp
pop edi
pop esi
pop ebp
jmp 0x4600a8
lea ecx, [esp + 0x194]
push ecx
call fcn.00483565
push eax
lea edx, [esp + 0x21c]
push str._suserinit.exe
push edx
call fcn.0047a8f8
push 0x48ba7c
push str.Shell
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.0045f7b0
push str.userinit.exe
push str.Userinit
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
call fcn.0045f7b0
push 0x57d044
push 0x493e04
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.0045f7b0
push str.logonui.exe
push str.UIHost
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.0045f7b0
add esp, 0x40
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ebx
add esp, 0x310
ret