Function at 0x409710
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549822
mov eax, dword fs:[0]
push eax
sub esp, 0x88c
mov eax, dword [0x5ad040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00530d50
add esp, 0xc
lea ebx, [esi + 0x1ee4]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x854], ebx
push ebx
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
xor eax, eax
mov word [ebp - 0x628], ax
push 0x206
push eax
lea eax, [ebp - 0x626]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [esi + 0x12ac]
push eax
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
xor eax, eax
mov word [ebp - 0x830], ax
push 0x206
push eax
lea eax, [ebp - 0x82e]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [esi + 0x14b4]
push eax
lea eax, [ebp - 0x830]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
mov dword [ebp - 0x858], 0
push 1
call fcn.00402e00
add esp, 4
cmp al, 1
lea eax, [ebp - 0x830]
je 0x409815
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052f62b
add esp, 0xc
lea eax, [ebp - 0x894]
push 0x3c
push 0
push eax
call fcn.00530d50
add esp, 0xc
mov dword [ebp - 0x894], 0x3c
cmp dword [esi + 0xa3c], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x884], eax
mov ecx, str._passive__norestart
mov eax, str._q__norestart
mov dword [ebp - 0x888], str.open
cmovne eax, ecx
mov dword [ebp - 0x878], 5
mov dword [ebp - 0x880], eax
lea eax, [ebp - 0x894]
push eax
mov dword [ebp - 0x890], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x85c]
call esi
test eax, eax
je 0x40990e
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x84c]
push eax
call edi
test eax, eax
je 0x4098e3
lea eax, [ebp - 0x84c]
push eax
call ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push dword [ebp - 0x85c]
call esi
cmp eax, 0xffffffff
je 0x409908
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0x85c]
call esi
test eax, eax
jne 0x4098b8
mov ebx, dword [ebp - 0x854]
lea eax, [ebp - 0x858]
push eax
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x858]
cmp eax, 0x13ec
jne 0x4099b7
call fcn.00412b6d
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x40994e
push 0x80004005
call fcn.00402af0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x850], esi
push 0x3ff
mov dword [ebp - 4], 0
call fcn.0041a31c
test eax, eax
je 0x409988
push 0x3ff
push eax
lea ecx, [ebp - 0x850]
call fcn.004024b0
mov esi, dword [ebp - 0x850]
push 1
call fcn.00402e00
add esp, 4
push 0x40030
push esi
cmp al, 1
jne 0x4099a3
push 0x58ddc0
jmp 0x4099a8
push 0x58de38
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0052fc45
cmp eax, 0x642
jne 0x409a47
call fcn.00412b6d
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4099de
push 0x80004005
call fcn.00402af0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x850], esi
push 0x3ff
mov dword [ebp - 4], 1
call fcn.0041a31c
test eax, eax
je 0x409a18
push 0x3ff
push eax
lea ecx, [ebp - 0x850]
call fcn.004024b0
mov esi, dword [ebp - 0x850]
push 1
call fcn.00402e00
add esp, 4
push 0x40030
push esi
cmp al, 1
jne 0x409a33
push str..Net_Framework_4.6
jmp 0x409a38
push 0x58df08
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0052fc45
cmp eax, 0x4005
jne 0x409b11
call fcn.00412b6d
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409a6e
push 0x80004005
call fcn.00402af0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x850], edi
mov dword [ebp - 4], 2
call fcn.00412b6d
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409a9f
push 0x80004005
call fcn.00402af0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x854], esi
push 0x3ff
mov byte [ebp - 4], 3
call fcn.0041a31c
test eax, eax
je 0x409ad6
push 0x3ff
push eax
lea ecx, [ebp - 0x850]
call fcn.004024b0
mov edi, dword [ebp - 0x850]
push 0x40c
call fcn.0041a31c
test eax, eax
je 0x409afb
push 0x40c
push eax
lea ecx, [ebp - 0x854]
call fcn.004024b0
mov esi, dword [ebp - 0x854]
push 0x40030
push edi
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0052fc45
cmp eax, 0x64e
je 0x409b23
cmp eax, 0xbc2
jne 0x409d3c
call fcn.00412b6d
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409b3f
push 0x80004005
call fcn.00402af0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x850], edi
mov dword [ebp - 4], 4
call fcn.00412b6d
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409b70
push 0x80004005
call fcn.00402af0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x854], esi
push 0x3f4
mov byte [ebp - 4], 5
call fcn.0041a31c
test eax, eax
je 0x409ba7
push 0x3f4
push eax
lea ecx, [ebp - 0x854]
call fcn.004024b0
mov esi, dword [ebp - 0x854]
push 0x3f5
call fcn.0041a31c
test eax, eax
je 0x409bcc
push 0x3f5
push eax
lea ecx, [ebp - 0x850]
call fcn.004024b0
mov edi, dword [ebp - 0x850]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
movzx eax, ax
push eax
call fcn.0040a450
cmp ax, 0x401
mov edx, 0x1c0030
mov ecx, 0x40030
cmove ecx, edx
push ecx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
je 0x409cf8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [ebp - 0x420]
push ebx
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x58df60
push 0x104
push eax
call fcn.0052f62b
add esp, 0xc
lea eax, [ebp - 0x854]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409c8e
push 0x104
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push str.NEO_Setup
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x850]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x83c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x840]
mov dword [ebp - 0x840], 1
push eax
push 0
push dword [ebp - 0x850]
mov dword [ebp - 0x834], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call fcn.0052fc45
lea edx, [esi - 0x10]
mov byte [ebp - 4], 4
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x409d18
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x409d36
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x858]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052e288
mov esp, ebp
pop ebp
ret