Function at 0x41b0d2
Capabilities:
Check os version
Read file on windows
Shutdown system

Disassembly:
push 0x178
push 0x461a48
call fcn.00423ad0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x124], ecx
xor ebx, ebx
mov esi, ebx
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b0fc
sub ecx, edx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x188]
rep stosd dword es:[edi], eax
push 0xa
pop ecx
lea edi, [ebp - 0x160]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x128], 5
mov dword [ebp - 0x118], 0x94
push 0x90
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.00427a90
add esp, 0xc
mov dword [ebp - 0x138], ebx
call fcn.0040270e
cmp byte [eax], bl
jne 0x41b16f
or eax, 0xffffffff
jmp 0x41b590
cmp dword [ebp - 0x11c], ebx
jle 0x41b3ad
mov edi, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x11c]
mov dl, byte [edi + esi]
cmp dl, 0x20
jle 0x41b3a4
lea eax, [esi + 5]
mov ecx, dword [ebp - 0x11c]
cmp eax, ecx
jge 0x41b1de
mov al, dl
or al, 0x20
cmp al, 0x72
jne 0x41b1de
mov al, byte [edi + esi + 1]
or al, 0x20
cmp al, 0x63
jne 0x41b1de
mov al, byte [edi + esi + 2]
or al, 0x20
cmp al, 0x68
jne 0x41b1de
mov al, byte [edi + esi + 3]
or al, 0x20
cmp al, 0x75
jne 0x41b1de
mov al, byte [edi + esi + 4]
or al, 0x20
cmp al, 0x73
jne 0x41b1de
mov al, byte [edi + esi + 5]
or al, 0x20
cmp al, 0x72
je 0x41b3de
cmp dl, 0x2d
je 0x41b1e8
cmp dl, 0x2f
jne 0x41b23d
lea eax, [esi + 6]
cmp eax, ecx
jge 0x41b23d
mov al, byte [edi + esi + 1]
or al, 0x20
cmp al, 0x72
jne 0x41b23d
mov al, byte [edi + esi + 2]
or al, 0x20
cmp al, 0x65
jne 0x41b23d
mov al, byte [edi + esi + 3]
or al, 0x20
cmp al, 0x62
jne 0x41b23d
mov al, byte [edi + esi + 4]
or al, 0x20
cmp al, 0x6f
jne 0x41b23d
mov al, byte [edi + esi + 5]
or al, 0x20
cmp al, 0x6f
jne 0x41b23d
mov al, byte [edi + esi + 6]
or al, 0x20
cmp al, 0x74
jne 0x41b23d
add esi, 7
mov dword [ebp - 0x130], 1
jmp 0x41b396
cmp dl, 0x2d
je 0x41b247
cmp dl, 0x2f
jne 0x41b2c4
lea eax, [esi + 0xa]
cmp eax, ecx
jge 0x41b2c4
mov al, byte [edi + esi + 1]
or al, 0x20
cmp al, 0x72
jne 0x41b2c4
mov al, byte [edi + esi + 2]
or al, 0x20
cmp al, 0x65
jne 0x41b2c4
mov al, byte [edi + esi + 3]
or al, 0x20
cmp al, 0x6d
jne 0x41b2c4
mov al, byte [edi + esi + 4]
or al, 0x20
cmp al, 0x6f
jne 0x41b2c4
mov al, byte [edi + esi + 5]
or al, 0x20
cmp al, 0x76
jne 0x41b2c4
mov al, byte [edi + esi + 6]
or al, 0x20
cmp al, 0x65
jne 0x41b2c4
mov al, byte [edi + esi + 7]
or al, 0x20
cmp al, 0x77
jne 0x41b2c4
mov al, byte [edi + esi + 8]
or al, 0x20
cmp al, 0x6c
jne 0x41b2c4
mov al, byte [edi + esi + 9]
or al, 0x20
cmp al, 0x73
jne 0x41b2c4
mov al, byte [edi + esi + 0xa]
or al, 0x20
cmp al, 0x70
jne 0x41b2c4
add esi, 0xb
mov dword [ebp - 0x134], 1
jmp 0x41b396
cmp dl, 0x2d
je 0x41b2ce
cmp dl, 0x2f
jne 0x41b2f9
push 6
push str.remote
lea eax, [edi + 1]
add eax, esi
push eax
call fcn.00438096
add esp, 0xc
test eax, eax
jne 0x41b2f9
add esi, 7
mov dword [ebp - 0x138], 1
jmp 0x41b396
mov al, byte [edi + esi]
cmp al, 0x2d
je 0x41b304
cmp al, 0x2f
jne 0x41b321
push 4
push str.exit
lea eax, [edi + 1]
add eax, esi
push eax
call fcn.00438096
add esp, 0xc
test eax, eax
je 0x41b6aa
mov al, byte [edi + esi]
cmp al, 0x2d
je 0x41b32c
cmp al, 0x2f
jne 0x41b39e
mov al, byte [edi + esi + 1]
or al, 0x20
cmp al, 0x77
jne 0x41b39e
add esi, 2
lea eax, [edi + esi]
lea ecx, [ebp - 0x128]
push ecx
push 0x44d990
push eax
call fcn.0040be86
add esp, 0xc
cmp eax, 1
je 0x41b362
mov dword [ebp - 0x128], 5
jmp 0x41b396
cmp byte [edi + esi], 0x20
jg 0x41b379
mov eax, dword [ebp - 0x11c]
cmp esi, eax
jge 0x41b379
inc esi
cmp byte [edi + esi], 0x20
jle 0x41b36e
mov al, byte [edi + esi]
cmp al, 0x20
jle 0x41b396
mov ecx, dword [ebp - 0x11c]
test al, al
je 0x41b396
cmp esi, ecx
jge 0x41b396
inc esi
mov al, byte [edi + esi]
cmp al, 0x20
jg 0x41b386
mov eax, dword [ebp - 0x11c]
jmp 0x41b3a5
mov eax, dword [ebp - 0x11c]
inc esi
cmp esi, eax
jl 0x41b187
cmp dword [ebp - 0x130], ebx
je 0x41b6f4
mov eax, dword [ebp - 0x128]
test eax, eax
jle 0x41b3d0
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x41b6ed
push 0xe6
push 0x4655fe
push 0x44e6a8
lea eax, [edi + 6]
add eax, esi
push eax
call fcn.0041b9ca
add esp, 0x10
xor esi, esi
inc esi
cmp eax, esi
je 0x41b40c
mov eax, 0xa0
jmp 0x41b590
push ebx
mov edi, str..pipecom.kaseya.ipc.rchusr
push edi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x41b428
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b590
push ebx
push 0x40000000
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4656e4], eax
cmp eax, 0xffffffff
je 0x41b41d
mov dword [ebp - 0x15c], 0x419a42
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x13c], edi
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x41b491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [0x4656e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x41b590
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4688e4], eax
test eax, eax
jne 0x41b4b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41b54a
push 0x4688d4
lea eax, [ebp - 0x11c]
push eax
push esi
lea eax, [ebp - 0x11d]
push eax
push dword [0x4656e4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b4b7
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 0x12c], eax
mov ecx, eax
sub ecx, 0x6d
je 0x41b53c
sub ecx, 0x7c
je 0x41b53c
sub ecx, 0x2fc
je 0x41b513
push dword [0x4688e4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [ebp - 0x12c]
jmp 0x41b54a
push ebx
push dword [ebp - 0x124]
push ebx
push 0xfffffffffffffffd
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str..pipecom.kaseya.ipc.rchusr
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4686a0], eax
test eax, eax
jne 0x41b556
call edi
mov ebx, eax
push dword [0x4688e4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [0x4656e4]
call edi
mov eax, ebx
jmp 0x41b590
push 0x4ff
push 0xffffffffffffffff
push ebx
push 0x4688e4
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x41b5e3
cmp eax, esi
je 0x41b5c9
mov esi, 0x102
cmp eax, esi
je 0x41b67f
cmp eax, 0xffffffff
je 0x41b671
call fcn.004157ae
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp - 0x184], 0x12
je 0x41b645
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x41b5a2
jmp 0x41b556
push ebx
lea eax, [ebp - 0x11c]
push eax
push 0x4688d4
push dword [0x4656e4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x41b689
push 0x4688d4
lea eax, [ebp - 0x11c]
push eax
push esi
lea eax, [ebp - 0x11d]
push eax
push dword [0x4656e4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b604
call edi
mov esi, eax
sub eax, 0x6d
je 0x41b67d
sub eax, 0x7c
je 0x41b67d
sub eax, 0x2fc
jne 0x41b67f
xor esi, esi
inc esi
jmp 0x41b556
push dword [0x4656e4]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [0x4688e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x4656e4]
call esi
mov eax, dword [0x4688e8]
jmp 0x41b590
call fcn.004157ae
call edi
jmp 0x41b590
mov esi, ebx
call fcn.004157ae
jmp 0x41b48a
call edi
mov esi, eax
call fcn.004157ae
cmp esi, 0xe9
je 0x41b6a3
cmp esi, 0x6d
jne 0x41b48a
mov esi, ebx
jmp 0x41b48a
call fcn.00402aa2
push eax
call fcn.0040d955
pop ecx
mov esi, eax
cmp esi, 0xffffffff
je 0x41b6ed
mov dword [ebp - 0x16c], 0x3f3
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x16c]
push eax
push esi
call fcn.0040d9bc
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41b590
cmp dword [ebp - 0x134], ebx
je 0x41b703
call fcn.00402430
jmp 0x41b6ed
mov dword [ebp - 0x118], 0x94
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41b751
cmp dword [ebp - 0x108], 2
jne 0x41b751
cmp dword [ebp - 0x114], 5
jb 0x41b751
mov ecx, dword [str.Global_]
mov dword [0x4686c0], ecx
mov eax, dword [0x44e9d8]
mov dword [0x4686c4], eax
mov dword [0x4687c8], ecx
mov dword [0x4687cc], eax
mov edi, 0x4686c0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41b757
mov esi, str.KUsrTskMutex
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0040270e
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0x41b771
sub edx, esi
mov ecx, 0x4686c0
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41b780
mov edi, ecx
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4687c8
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41b79e
mov esi, str.KUsrTskExit
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040270e
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0x41b7b7
sub edx, esi
mov ecx, 0x4687c8
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41b7c6
mov edi, ecx
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41b7f9
cmp dword [ebp - 0x138], ebx
je 0x41b58d
push 0x65
push ebx
lea eax, [ebp - 0x84]
push eax
call fcn.00427a90
push 0x65
lea eax, [ebp - 0x84]
push eax
call fcn.0040ea6f
add esp, 0x14
test eax, eax
jne 0x41b58d
push str.SYSTEM
lea eax, [ebp - 0x84]
push eax
call fcn.0042d363
pop ecx
pop ecx
test eax, eax
je 0x41b58d
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x124]
cmp dword [ebp + 0xc], 0
jne 0x41b8dc
mov dword [ebp - 0x160], 3
mov dword [ebp - 0x15c], 0x417347
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x14c], ebx
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x148], eax
push 1
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], ebx
call fcn.00402ace
mov dword [ebp - 0x13c], eax
mov dword [0x4686a4], esi
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x41b8dc
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x465c14
call fcn.00428a30
add esp, 0xc
jmp 0x41b6ed
push ebx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x88000000
push 0x44f60c
call fcn.00402ace
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4686a0], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x114], 5
jae 0x41b928
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x493e0
jae 0x41b928
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.00408f7f
pop ecx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x41b95f
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41b92f
call fcn.00409042
jmp 0x41b97e
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0041b9a0
mov eax, dword [0x4686b4]
test eax, eax
je 0x41b6ed
push eax
jmp 0x41b6e7