Function at 0x40688c
Capabilities:
Create process on windows
Get common file path
Get disk information
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00406d9e
test eax, eax
pop ecx
je 0x406d95
mov esi, 0x94
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.0040a300
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push dword [ebp + 0x10]
xor eax, eax
cmp dword [ebp - 0x94], 2
sete al
mov dword [0x411c28], eax
call fcn.004065c5
cmp dword [0x411aa4], ebx
pop ecx
mov esi, 0x104
jne 0x406a89
push esi
push dword [0x411a9c]
push dword [0x411c24]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x411a9c]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x406923
cmp byte [eax + 1], cl
je 0x406935
cmp cl, bl
je 0x406935
cmp byte [eax + 1], 0x3a
jne 0x406935
mov byte [eax + 3], bl
mov eax, dword [0x411a9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x406a81
push 1
pop edi
push dword [0x411a98]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x411a98]
call fcn.0040832c
pop ecx
push edi
push str._inst_d.exe
push dword [0x411a98]
call fcn.0040a0d0
add eax, dword [0x411a98]
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [0x411a98]
call section..text
add esp, 0x14
cmp eax, 0xffffffff
je 0x4069a1
push eax
call fcn.00401229
or dword [ebp + 8], 0xffffffff
pop ecx
jmp 0x4069b5
push dword [0x411a98]
call fcn.0040104d
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
jne 0x4069c8
inc edi
cmp edi, 0x3e7
jl 0x406948
cmp dword [ebp + 8], 0xffffffff
je 0x406a81
push ebx
push dword [0x411bf8]
call section..text
mov edi, eax
pop ecx
cmp edi, 0xffffffff
pop ecx
je 0x406a78
lea eax, [ebp + 0x10]
push eax
push dword [0x411036]
call fcn.00408374
pop ecx
test eax, eax
pop ecx
je 0x406a22
push dword [0x411036]
push dword [ebp + 0x10]
push edi
call fcn.00401077
push dword [0x411036]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004010cd
lea eax, [ebp + 0x10]
push eax
call fcn.004083d4
add esp, 0x1c
push edi
call fcn.00401229
push dword [ebp + 8]
call fcn.00401229
push str.__S_
push dword [0x411a98]
call fcn.0040a160
push dword [0x411bf8]
push dword [0x411a98]
call fcn.0040a160
push str.___DEL
push dword [0x411a98]
call fcn.0040a160
add esp, 0x20
push dword [ebp + 0x14]
push dword [0x411a98]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x406d90
push dword [ebp + 8]
call fcn.00401229
pop ecx
cmp dword [0x411aa4], ebx
je 0x406aaa
push esi
push dword [0x411a9c]
push dword [0x411c24]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x411a9c]
push ebx
call fcn.004066d8
pop ecx
pop ecx
call fcn.00406f04
test eax, eax
je 0x406d95
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [0x411c04], eax
call esi
mov dword [0x411c00], eax
call fcn.0040702a
test eax, eax
je 0x406ae0
call fcn.00406f6c
test eax, eax
jne 0x406ae8
or eax, 0xffffffff
jmp 0x406d97
xor eax, eax
test byte [0x411bf4], 1
je 0x406af6
push 1
pop eax
push eax
call fcn.00401250
pop ecx
mov edi, eax
push ebx
push 0x406183
push dword [0x411c20]
push edi
push dword [0x411c24]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp eax, ebx
mov dword [0x411c1c], eax
je 0x406c32
test byte [0x411bf4], 1
jne 0x406b7e
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xca0000
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [ebp - 4]
push 4
sub eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x411c20]
call esi
push 5
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x411c1c]
call esi
push 1
push dword [0x411c20]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x411c20]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov cx, word [0x411042]
xor eax, eax
cmp cx, 0xffff
mov dword [0x411c14], eax
je 0x406bb5
movzx eax, cx
mov dword [0x411c14], eax
shl eax, 2
push ebx
push dword [eax + 0x4110fc]
push dword [eax + 0x4110b4]
call fcn.004012f4
add esp, 0xc
cmp word [0x411042], 0xffff
jne 0x406c20
dec eax
je 0x406bf5
dec eax
je 0x406c19
sub eax, 0x3ed
jne 0x406c0d
cmp dword [0x411c14], ebx
jle 0x406c0d
dec dword [0x411c14]
jmp 0x406c0d
cmp dword [0x411c14], 8
jge 0x406c06
inc dword [0x411c14]
jmp 0x406c0d
or dword [0x411c14], 0xffffffff
mov eax, dword [0x411c14]
cmp eax, 0xffffffff
je 0x406c20
jmp 0x406bb5
or dword [0x411c14], 0xffffffff
push dword [0x411c1c]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x411c1c], ebx
push edi
call fcn.0040128c
cmp dword [0x411b34], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
pop ecx
jne 0x406c7c
mov eax, dword [0x411ab8]
cmp eax, ebx
je 0x406c7c
push eax
call fcn.00404327
push dword [0x411a9c]
lea eax, [ebp - 0x2ac]
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x2ac]
push 1
push eax
call edi
cmp dword [0x411ac4], ebx
je 0x406d25
push 8
call fcn.00401250
mov esi, eax
pop ecx
cmp esi, ebx
je 0x406d25
push ebx
push 0x406081
push dword [0x411c20]
push esi
push dword [0x411c24]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push esi
mov dword [ebp + 8], eax
call fcn.0040128c
cmp dword [ebp + 8], 1
pop ecx
jne 0x406d25
cmp dword [0x411b34], ebx
jne 0x406d25
cmp dword [0x411c28], ebx
je 0x406d1c
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x406d25
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 2
lea eax, [ebp - 0x10]
pop esi
mov dword [ebp - 0x10], 1
push ebx
push ebx
push ebx
push eax
push ebx
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
jmp 0x406d1f
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call fcn.00406fe0
cmp dword [0x411b34], ebx
jne 0x406d8b
cmp dword [0x411ac4], ebx
jne 0x406d8b
cmp dword [0x411054], ebx
je 0x406d8b
mov eax, dword [0x411abc]
cmp eax, ebx
je 0x406d8b
push eax
call fcn.00404327
push dword [0x411aa0]
call fcn.00408353
pop ecx
pop ecx
push dword [0x411aa0]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x104
push dword [0x411a98]
push dword [0x411a9c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
push dword [0x411a98]
call edi
call fcn.0040650a
call fcn.00406e8e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10