Function at 0x4030c0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Move file
Shutdown system

Disassembly:
push 0xffffffffffffffff
push 0x404182
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44c
mov dx, word [0x408478]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov word [esp + 0x4c], dx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor esi, esi
stosw word es:[edi], ax
call fcn.00403cb2
lea ecx, [esp + 0x14]
mov dword [esp + 0x464], ebx
call fcn.00403cb2
lea ecx, [esp + 0x24]
mov byte [esp + 0x464], 1
call fcn.00403cb2
lea ecx, [esp + 0x10]
mov byte [esp + 0x464], 2
call fcn.00403cb2
lea ecx, [esp + 0x20]
mov byte [esp + 0x464], 3
call fcn.00403cb2
mov byte [esp + 0x464], 4
call dword [sym.imp.MSVCRT.dll___p___argc]
cmp dword [eax], 1
jle 0x4031be
mov edi, dword [sym.imp.MSVCRT.dll___p___wargv]
push str._AutoStart
call edi
mov eax, dword [eax]
mov ebp, dword [sym.imp.MSVCRT.dll__wcsicmp]
mov ecx, dword [eax + 4]
push ecx
call ebp
add esp, 8
test eax, eax
je 0x4031b5
push 0x4082d8
call edi
mov edx, dword [eax]
mov eax, dword [edx + 4]
push eax
call ebp
add esp, 8
test eax, eax
jne 0x4031ba
mov ebx, 1
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x4c]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4031e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4035ec
lea edx, [esp + 0x4c]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x403257
lea ecx, [esp + 0x20]
mov byte [esp + 0x464], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x464], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x464], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x464], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x464], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 0x7b
jmp 0x403646
mov word [eax], 0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x14]
push str._sProgram.reboot
push ecx
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 0xffffffff
je 0x403375
mov eax, dword [esp + 0x10]
push 4
push 0
push eax
call edi
push 0xffffffffffffffff
push 4
push 0x65
call sub.MFC42u.DLL_AfxMessageBox_1
cmp eax, 6
jne 0x403375
lea ecx, [esp + 0x1c]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0x30]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x1c]
push 0
push 0
lea eax, [esp + 0x34]
push 0x10
push eax
push 0
push ecx
mov dword [esp + 0x44], 1
mov dword [esp + 0x50], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x403313
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x20]
mov byte [esp + 0x464], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x464], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x464], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x464], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x464], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 0xbc2
jmp 0x403646
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push eax
push str.__sVesupd.exe_
push ecx
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x480]
mov eax, dword [esp + 0x47c]
add esp, 0xc
test ebx, ebx
push edx
push eax
push 2
je 0x4033a9
push str._d__s__d__nm
jmp 0x4033ae
push str._d__s__d
lea ecx, [esp + 0x24]
push ecx
call sub.MFC42u.DLL_CString::Format
add esp, 0x14
xor ebx, ebx
cmp esi, 0x522
jne 0x40340f
lea edx, [esp + 0x14]
push 0x408234
lea eax, [esp + 0x20]
push edx
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x468], 5
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x464], 4
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push ecx
push edx
mov ecx, ebp
call fcn.004029a0
jmp 0x403420
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, ebp
call fcn.00402b40
mov esi, eax
cmp esi, 0x80004022
je 0x403432
cmp esi, 0x522
jne 0x403438
inc ebx
cmp ebx, 0xa
jl 0x4033bd
test esi, esi
je 0x4035ec
cmp esi, 0x4c9
je 0x4035df
cmp esi, 0x79
je 0x4035df
cmp esi, 0xbc3
je 0x40348c
cmp esi, 0xbc2
je 0x40351b
push esi
lea edx, [esp + 0x24]
push 0x66
push edx
call sub.MFC42u.DLL_CString::Format_1
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0
push 0
push eax
call sub.MFC42u.DLL_AfxMessageBox
jmp 0x4035ec
mov ecx, dword [ebp + 0xc4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4034a7
mov dword [ebp + 0xc4], 0
lea edx, [esp + 0x4c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4035ec
lea eax, [esp + 0x4c]
push 0x104
lea ecx, [esp + 0x258]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea edx, [esp + 0x260]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 0x14
test eax, eax
je 0x4034f5
mov word [eax], 0
lea eax, [esp + 0x254]
push 5
push eax
lea ecx, [esp + 0x54]
push 0x408478
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4035ec
lea edx, [esp + 0x4c]
lea eax, [esp + 0x10]
push edx
push str._sProgram.reboot
push eax
call sub.MFC42u.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40355b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push 4
push 0
push edx
call edi
push 0xffffffffffffffff
push 4
push 0x65
call sub.MFC42u.DLL_AfxMessageBox_1
cmp eax, 6
jne 0x4035ec
lea eax, [esp + 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x40]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x28]
push 0
push 0
lea edx, [esp + 0x44]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x54], 1
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x4035ec
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4035ec
push 0xffffffffffffffff
push 0
push 0x68
call sub.MFC42u.DLL_AfxMessageBox_1
xor esi, esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x464], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x464], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x464], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x464], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x464], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x458
ret 0xc