Function at 0x45a540
Capabilities:
Delete registry key
Disable system features via registry on windows
Hide shutdown actions via policy
Persist via image file execution options registry key
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55adec
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5caea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x21c], ecx
push 0x5bf2d0
call fcn.0045a000
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push str.logoff.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push str.shutdown.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push str.taskmgr.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push str.tasklist.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push str.taskkill.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push str.perfmon.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.___Restore_Services...
call fcn.0045a000
mov ecx, ebx
call fcn.0045d360
push str.___Restore_Processes...
call fcn.0045a000
mov ecx, dword [ebp - 0x21c]
add esp, 8
mov ecx, dword [ecx]
mov dword [ebp - 0x21c], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x224], eax
cmp eax, ecx
je 0x45a813
cmp dword [eax + 0x1c], 8
lea ebx, [eax + 8]
jb 0x45a7af
mov ebx, dword [ebx]
mov ecx, 0x25
lea edi, [ebp - 0x218]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x182]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00530530
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0053b007
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x224]
mov eax, dword [eax]
mov dword [ebp - 0x224], eax
cmp eax, dword [ebp - 0x21c]
jne 0x45a7a4
push str.___Remove_Autorun...
call fcn.0045a000
sub esp, 0x14
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.AppDataLocal
mov word [ecx], ax
call fcn.0044a1c0
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
xor eax, eax
push 0x2d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov word [ecx], ax
call fcn.0044a1c0
mov ecx, bind
mov dword [ebp - 4], 0xffffffff
call fcn.00460d80
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x228], esp
push 0xd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.AppDataLocal
mov word [ecx], ax
call fcn.0044a1c0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0x2d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov word [ecx], ax
call fcn.0044a1c0
mov ecx, reloc.WS2_32.dll_bind
mov dword [ebp - 4], 0xffffffff
call fcn.00460d80
push str.___Remove_logon_notice...
call fcn.0045a000
add esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x228], esp
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.legalnoticetext
mov word [ecx], ax
call fcn.0044a1c0
sub esp, 0x18
mov dword [ebp - 4], 2
mov ecx, esp
xor eax, eax
push 0x39
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
mov word [ecx], ax
call fcn.0044a1c0
mov dword [ebp - 4], 0xffffffff
call fcn.00460c80
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x228], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x12
push str.legalnoticecaption
mov word [ecx], ax
call fcn.0044a1c0
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
xor eax, eax
push 0x39
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
mov word [ecx], ax
call fcn.0044a1c0
mov dword [ebp - 4], 0xffffffff
call fcn.00460c80
push str.___Allow_Shutdown...
call fcn.0045a000
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x224]
add esp, 0x34
mov dword [ebp - 0x21c], 0
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.WS2_32.dll_bind
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45aa26
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [ebp - 0x224]
call esi
push dword [ebp - 0x224]
call edi
push 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call ebx
test eax, eax
jne 0x45aa78
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [ebp - 0x224]
call esi
push dword [ebp - 0x224]
call edi
push 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x45aaca
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.shutdownwithoutlogon
push dword [ebp - 0x224]
call esi
push dword [ebp - 0x224]
call edi
push 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call ebx
test eax, eax
jne 0x45ab1c
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.NoClose
push dword [ebp - 0x224]
call esi
push dword [ebp - 0x224]
call edi
push 0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call ebx
test eax, eax
jne 0x45ab6e
push 4
lea eax, [ebp - 0x220]
push eax
push 4
push 0
push str.StartMenuLogOff
push dword [ebp - 0x224]
call esi
push dword [ebp - 0x224]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00518b27
mov esp, ebp
pop ebp
ret