Function at 0x4418f0
Capabilities:
Copy file
Create process on windows
Delete file
Shutdown system

Disassembly:
sub esp, 0x12c
push esi
push edi
lea eax, [esp + 0x30]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0x4bcc04]
lea edx, [esp + 0x30]
mov esi, eax
push edx
lea eax, [esp + 0x20]
push str.__s_
push eax
mov dword [esp + 0x28], ecx
call fcn.0047b553
add esp, 0xc
lea ecx, [esp + 0x1c]
push str.___R
call fcn.0047e8c0
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x4c5150
call fcn.00447360
push eax
lea ecx, [esp + 0x20]
call fcn.0047e8fc
lea ecx, [esp + 0xc]
call fcn.0047e4e4
mov edx, dword [esp + 0x1c]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push edx
push str.PartitionManager
call fcn.0043cbe0
push 0x4c2e6c
lea ecx, [esp + 0x28]
call fcn.0047e259
push str.restart.log
lea ecx, [esp + 0x14]
call fcn.0047e552
push eax
lea eax, [esp + 0x28]
push 0x4ba270
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0047e779
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.0047e713
lea ecx, [esp + 0xc]
call fcn.0047e4e4
lea ecx, [esp + 0x10]
call fcn.0047e4e4
mov eax, dword [0x4bcc04]
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [esp + 0x14], eax
mov eax, dword [0x4c2e78]
test eax, eax
je 0x441a90
call fcn.00441490
push 0x4c4658
lea ecx, [esp + 0xc]
call fcn.0047e259
push str.BlueScrn_
lea ecx, [esp + 0xc]
call fcn.0047e8c0
push str.restart.log
lea ecx, [esp + 0x14]
call fcn.0047e552
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0047e713
push eax
lea ecx, [esp + 0x18]
call fcn.0047e61d
lea ecx, [esp + 0xc]
call fcn.0047e4e4
lea ecx, [esp + 0x10]
call fcn.0047e4e4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 8]
push eax
call fcn.004413e0
test eax, eax
je 0x441a82
lea ecx, [esp + 8]
push 0x4c2d68
push ecx
call fcn.00441140
test eax, eax
je 0x441a82
lea ecx, [esp + 8]
call fcn.0047e4e4
jmp 0x441cfd
call fcn.00441490
lea ecx, [esp + 8]
jmp 0x441dc5
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x441cfd
call edi
xor edx, edx
mov dl, ah
cmp dl, 0x5a
jae 0x441c6f
lea eax, [esp + 0x30]
push esi
push eax
lea ecx, [esp + 0x10]
call fcn.0047ad56
push 0x5c
lea ecx, [esp + 0xc]
call fcn.0047b1f0
test eax, eax
jle 0x441aee
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.0047b178
push eax
lea ecx, [esp + 0xc]
call fcn.0047e61d
lea ecx, [esp + 0xc]
call fcn.0047e4e4
push 0x5c
lea ecx, [esp + 0xc]
call fcn.0047b1f0
test eax, eax
jle 0x441b1f
lea edx, [esp + 0xc]
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.0047b178
push eax
lea ecx, [esp + 0xc]
call fcn.0047e61d
lea ecx, [esp + 0xc]
call fcn.0047e4e4
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
call fcn.0047e259
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0047e259
push str.dos_
lea ecx, [esp + 0x14]
call fcn.0047e8c0
push str.dos_
lea ecx, [esp + 0x2c]
call fcn.0047e8c0
push str.Restart.pif
lea ecx, [esp + 0x10]
call fcn.0047e552
push eax
lea ecx, [esp + 0x2c]
call fcn.0047e8fc
lea ecx, [esp + 0xc]
call fcn.0047e4e4
push str.dos_
lea ecx, [esp + 0xc]
call fcn.0047e8c0
push str.restart.log
lea ecx, [esp + 0x30]
call fcn.0047e552
push eax
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0047e713
push eax
lea ecx, [esp + 0x18]
call fcn.0047e61d
lea ecx, [esp + 0xc]
call fcn.0047e4e4
lea ecx, [esp + 0x2c]
call fcn.0047e4e4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
push ecx
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x441c54
mov ecx, dword [esp + 0x28]
mov eax, dword [0x4bcc04]
push ecx
lea edx, [esp + 0x10]
push 0x78d
push edx
mov dword [esp + 0x18], eax
call fcn.0047b566
mov eax, dword [esp + 0x18]
add esp, 0xc
push 0
push 0
push 0x4c2178
push eax
call fcn.00441070
lea ecx, [esp + 0xc]
call fcn.0047e4e4
lea ecx, [esp + 0x28]
call fcn.0047e4e4
lea ecx, [esp + 0x10]
call fcn.0047e4e4
lea ecx, [esp + 8]
jmp 0x441dc5
lea ecx, [esp + 0x28]
call fcn.0047e4e4
lea ecx, [esp + 0x10]
call fcn.0047e4e4
lea ecx, [esp + 8]
jmp 0x441e2c
call fcn.00441e70
test eax, eax
jne 0x441cc9
mov ecx, dword [0x4bcc04]
push 0x4c1f78
lea edx, [esp + 0x14]
push 0x797
push edx
mov dword [esp + 0x1c], ecx
call fcn.0047b566
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0x31
push 0x4c2178
push eax
call fcn.00441070
cmp eax, 2
je 0x441dc1
call fcn.00441e70
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0047e4e4
test esi, esi
je 0x441c78
push str.restart.log
lea ecx, [esp + 0x18]
push str.A:_s
push ecx
call fcn.0047b553
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add esp, 0xc
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
push edx
call fcn.0047e259
push str.restart.log
lea ecx, [esp + 0x24]
call fcn.0047b212
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x28]
call fcn.0047b178
push eax
lea ecx, [esp + 0x24]
call fcn.0047e61d
lea ecx, [esp + 0x2c]
call fcn.0047e4e4
mov ecx, 0x4c5150
call fcn.004431c0
push pe_nt_image_headers32
lea ecx, [esp + 0x24]
call fcn.0047e9ab
mov ecx, dword [0x4c5171]
push eax
add ecx, 0x12b
push ecx
call fcn.004669f0
add esp, 0xc
mov ecx, 0x4c5150
call fcn.00444050
lea ecx, [esp + 0x20]
call fcn.0047e9bd
mov eax, dword [0x4c5128]
test eax, eax
je 0x441d97
mov dl, byte [eax + 2]
and dl, 0xf7
mov byte [eax + 2], dl
mov eax, dword [0x4c5128]
and byte [eax + 2], 0xfb
call edi
cmp eax, 0x80000000
jae 0x441dfb
push str.SeShutdownPrivilege
call fcn.004414f0
test eax, eax
jne 0x441dfb
push eax
push eax
push 0x4c2178
push 0x645
call fcn.00441020
jmp 0x441e15
lea ecx, [esp + 0x10]
call fcn.0047e4e4
lea ecx, [esp + 0x14]
call fcn.0047e4e4
lea ecx, [esp + 0x18]
call fcn.0047e4e4
lea ecx, [esp + 0x24]
call fcn.0047e4e4
lea ecx, [esp + 0x1c]
call fcn.0047e4e4
pop edi
xor eax, eax
pop esi
add esp, 0x12c
ret 8
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x441e15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040f5f0
mov eax, dword [esp + 0x138]
test eax, eax
je 0x441e28
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
lea ecx, [esp + 0x20]
call fcn.0047e4e4
lea ecx, [esp + 0x14]
call fcn.0047e4e4
lea ecx, [esp + 0x18]
call fcn.0047e4e4
lea ecx, [esp + 0x24]
call fcn.0047e4e4
lea ecx, [esp + 0x1c]
call fcn.0047e4e4
pop edi
mov eax, 1
pop esi
add esp, 0x12c
ret 8