Function at 0x4095a0
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5451c8
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x5a8040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0052c790
lea ebx, [esi + 0x1cd8]
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x648], ebx
push 0x104
push eax
call fcn.0052b09f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.0052c790
lea eax, [esi + 0x12a8]
push eax
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.0052b09f
lea eax, [ebp - 0x628]
mov dword [ebp - 0x650], 0
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052b0fb
push 0x3c
lea eax, [ebp - 0x68c]
push 0
push eax
call fcn.0052c790
add esp, 0x48
mov dword [ebp - 0x68c], 0x3c
cmp dword [esi + 0xa3c], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x680], str.open
mov dword [ebp - 0x67c], eax
je 0x4096ad
cmp byte [esi + 0x20fe], 0
mov dword [ebp - 0x678], str._passive__norestart
je 0x4096b7
mov dword [ebp - 0x678], str._q__norestart
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x670], 5
push eax
mov dword [ebp - 0x688], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x654]
call esi
test eax, eax
je 0x40974e
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x644]
push eax
call edi
test eax, eax
je 0x409723
lea eax, [ebp - 0x644]
push eax
call ebx
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push dword [ebp - 0x654]
call esi
cmp eax, 0xffffffff
je 0x409748
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0x654]
call esi
test eax, eax
jne 0x4096f8
mov ebx, dword [ebp - 0x648]
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0x654]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x650]
cmp eax, 0x13ec
jne 0x409831
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x40978e
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x648], edi
mov dword [ebp - 4], 0
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4097bf
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64c], esi
push 0x3ff
mov byte [ebp - 4], 1
call fcn.00415ddb
test eax, eax
je 0x4097f6
push 0x3ff
push eax
lea ecx, [ebp - 0x64c]
call fcn.004023f0
mov esi, dword [ebp - 0x64c]
push 0x410
call fcn.00415ddb
test eax, eax
je 0x40981b
push 0x410
push eax
lea ecx, [ebp - 0x648]
call fcn.004023f0
mov edi, dword [ebp - 0x648]
push 0x40030
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0052b715
cmp eax, 0x642
jne 0x4098ee
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409858
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x64c], edi
mov dword [ebp - 4], 2
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409889
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x648], esi
push 0x3ff
mov byte [ebp - 4], 3
call fcn.00415ddb
test eax, eax
je 0x4098c0
push 0x3ff
push eax
lea ecx, [ebp - 0x648]
call fcn.004023f0
mov esi, dword [ebp - 0x648]
push 0x411
call fcn.00415ddb
test eax, eax
je 0x40981b
push 0x411
push eax
lea ecx, [ebp - 0x64c]
call fcn.004023f0
mov edi, dword [ebp - 0x64c]
jmp 0x40981b
cmp eax, 0x4005
jne 0x4099ae
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409915
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x648], edi
mov dword [ebp - 4], 4
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409946
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64c], esi
push 0x3ff
mov byte [ebp - 4], 5
call fcn.00415ddb
test eax, eax
je 0x40997d
push 0x3ff
push eax
lea ecx, [ebp - 0x648]
call fcn.004023f0
mov edi, dword [ebp - 0x648]
push 0x40c
call fcn.00415ddb
test eax, eax
je 0x4099a2
push 0x40c
push eax
lea ecx, [ebp - 0x64c]
call fcn.004023f0
mov esi, dword [ebp - 0x64c]
push 0x40030
push edi
push esi
jmp 0x409822
cmp eax, 0x64e
je 0x4099c0
cmp eax, 0xbc2
jne 0x409bce
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4099dc
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x64c], edi
mov dword [ebp - 4], 6
call fcn.0040e6bf
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x409a0d
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x648], esi
push 0x3f4
mov byte [ebp - 4], 7
call fcn.00415ddb
test eax, eax
je 0x409a44
push 0x3f4
push eax
lea ecx, [ebp - 0x648]
call fcn.004023f0
mov esi, dword [ebp - 0x648]
push 0x3f5
call fcn.00415ddb
test eax, eax
je 0x409a69
push 0x3f5
push eax
lea ecx, [ebp - 0x64c]
call fcn.004023f0
mov edi, dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call fcn.0040a2f0
cmp ax, 0x401
mov edx, 0x1c0030
mov ecx, 0x40030
cmove ecx, edx
push ecx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
je 0x409b8a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.0052c790
push ebx
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0052b09f
push 0x58a0fc
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0x24
lea eax, [ebp - 0x648]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409b22
push 0x104
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push str.HOffice_2024_Setup
push dword [ebp - 0x648]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x64c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x634]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x638]
mov dword [ebp - 0x638], 1
push eax
push 0
push dword [ebp - 0x64c]
mov dword [ebp - 0x62c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40982a
lea edx, [esi - 0x10]
mov byte [ebp - 4], 6
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x409baa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x409bc8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x650]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00529d59
mov esp, ebp
pop ebp
ret