Function at 0x401fd4
Capabilities:
Create service
Get disk information
Get uefi variable
Identify system language via api
Print debug messages
Query or enumerate registry value
Read .ini file
Shutdown system
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
mov eax, dword [0x42635c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, edx
mov dword [ebp - 0x8fc], ecx
xor ebx, ebx
mov dword [ebp - 0x90c], edi
cmp dword [0x4e41278], 0x8dc
jne 0x402033
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
lea eax, [ebp - 0x900]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCompressedFileSizeA]
lea eax, [ebp - 0x838]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x4e3895c], eax
mov esi, 0x5960ee
cmp dword [0x4e41278], 0x154
jne 0x402072
push ebx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_AddAtomA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_SetProcessShutdownParameters]
dec esi
jne 0x402049
mov esi, ebx
jmp 0x40207b
xor ebx, ebx
cmp esi, 0xeb6e7
jne 0x402096
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
mov dword [ebp - 0x900], ebx
jmp 0x40209c
mov ebx, dword [ebp - 0x900]
inc esi
cmp esi, 0x15072c
jl 0x402079
mov ecx, dword [0x4e41278]
cmp ecx, 0xc47
jne 0x4020ca
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_EnumSystemCodePagesW]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedFlushSList]
mov ecx, dword [0x4e41278]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x8f8], edx
cmp dword [edi], edx
jbe 0x4023b3
cmp ecx, 0x1337
jne 0x402110
push 0
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetFirmwareEnvironmentVariableW]
lea eax, [ebp - 0x8f0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTimeZoneInformation]
mov ecx, dword [0x4e41278]
mov edx, dword [ebp - 0x8f8]
mov ebx, dword [ebp - 0x8fc]
mov eax, dword [ebx]
mov bl, byte [eax + edx]
mov al, byte [eax + edx + 1]
mov byte [ebp - 0x8f3], bl
mov ebx, dword [ebp - 0x8fc]
mov byte [ebp - 0x8f2], al
cmp ecx, 0xd22
jne 0x40214d
push 0
call dword [sym.imp.KERNEL32.DLL_HeapLock]
mov ecx, dword [0x4e41278]
mov edx, dword [ebp - 0x8f8]
mov eax, dword [ebx]
and dword [0x4e38958], 0
mov bl, byte [eax + edx + 2]
mov bh, byte [eax + edx + 3]
mov byte [ebp - 0x8f1], bl
cmp ecx, 0x1378
jne 0x40217c
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetMessageWaitingIndicator]
mov ecx, dword [0x4e41278]
mov bl, bh
shl bl, 2
cmp ecx, 0x4de
jne 0x4021ac
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
mov ecx, dword [0x4e41278]
and bl, 0xc0
cmp ecx, 0xaaf
jne 0x4021df
push 0
call dword [sym.imp.KERNEL32.DLL_SetThreadLocale]
xor ecx, ecx
lea eax, [ebp - 0x910]
push eax
push ecx
lea eax, [ebp - 0x804]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCalendarInfoW]
mov ecx, dword [0x4e41278]
or byte [ebp - 0x8f3], bl
mov bl, bh
shl bl, 4
cmp ecx, 0x8e8
jne 0x40220f
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
mov ecx, dword [0x4e41278]
and bl, 0xc0
or byte [ebp - 0x8f2], bl
cmp ecx, 0x10aa
jne 0x40224a
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_IsValidLocale]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
mov ecx, dword [0x4e41278]
cmp ecx, 0xe8f
jne 0x40226c
xor ecx, ecx
lea eax, [ebp - 0x804]
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov ecx, dword [0x4e41278]
shl bh, 6
cmp ecx, 0xd0b
jne 0x4022aa
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_PrepareTape]
push 0
call dword [sym.imp.KERNEL32.DLL_SetComputerNameA]
xor ecx, ecx
lea eax, [ebp - 0x91c]
push eax
push ecx
lea eax, [ebp - 0x804]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCalendarInfoW]
mov ecx, dword [0x4e41278]
and bh, 0xc0
or byte [ebp - 0x8f1], bh
xor ebx, ebx
cmp ecx, 0xbec
jne 0x402304
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_HeapSize]
xor eax, eax
mov dword [ebp - 0x930], ebx
lea edi, [ebp - 0x92c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x914]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitCommEvent]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
mov edi, dword [ebp - 0x90c]
mov al, byte [ebp - 0x8f3]
mov dword [0x4e3634c], ebx
mov ebx, dword [ebp - 0x900]
mov byte [esi + ebx], al
cmp dword [0x4e41278], 0x941
jne 0x40235d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_OpenEventA]
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x901]
push eax
lea eax, [ebp - 0x908]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov al, byte [ebp - 0x8f2]
mov byte [esi + ebx + 1], al
mov al, byte [ebp - 0x8f1]
mov byte [esi + ebx + 2], al
add esi, 3
mov ecx, dword [0x4e41278]
mov dword [0x4e36348], 0xf185d186
cmp ecx, 0xd1d
jne 0x40239c
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCommMask]
mov ecx, dword [0x4e41278]
mov edx, dword [ebp - 0x8f8]
add edx, 4
mov dword [ebp - 0x8f8], edx
cmp edx, dword [edi]
jb 0x4020dc
or dword [0x44123c], 0xffffffff
mov dword [0x441238], 0xe1c059a2
cmp ecx, 0x454
jne 0x4023f8
push 0
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
lea eax, [ebp - 0x844]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetCommProperties]
mov eax, dword [ebp - 0x8fc]
mov dword [eax], ebx
mov dword [edi], esi
cmp dword [0x4e41278], 0x1083
pop esi
jne 0x402432
xor ebx, ebx
lea eax, [ebp - 0x908]
push ebx
push ebx
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_IsBadWritePtr]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040526a
mov esp, ebp
pop ebp
ret