Function at 0x40ba90
Capabilities:
Accept command line arguments
Hide graphical window
Shutdown system

Disassembly:
sub esp, 0x430
push ebp
push edi
xor edi, edi
xor ebp, ebp
call fcn.0040ef50
mov eax, dword [esp + 0x43c]
push eax
call fcn.0040bf20
add esp, 4
test eax, eax
jne 0x40bac7
call fcn.0040f290
pop edi
xor eax, eax
pop ebp
add esp, 0x430
ret 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov dword [0x421024], eax
call esi
mov dword [0x421020], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], 0x22
jne 0x40baf6
lea ecx, [esi + 2]
push 0x22
push ecx
jmp 0x40baf9
push 0x20
push esi
call fcn.00411d0f
add esp, 8
test eax, eax
jne 0x40bb09
mov eax, esi
jmp 0x40bb0c
add eax, 2
push eax
call fcn.0040b270
mov al, byte [0x42103a]
add esp, 4
test al, al
je 0x40bb47
mov edx, dword [0x420e5c]
mov eax, dword [0x421088]
push 0x104
push edx
push eax
call dword [0x421138]
mov ecx, dword [0x420e5c]
push ecx
push 0
call fcn.0040b4d0
add esp, 8
mov eax, dword [0x421034]
test eax, eax
jne 0x40bb59
mov al, byte [0x421042]
test al, al
je 0x40bb75
call fcn.0040c4c0
mov edi, eax
test edi, edi
je 0x40be69
mov eax, dword [0x421034]
test eax, eax
jne 0x40be19
call fcn.0040c290
test eax, eax
je 0x40be69
mov al, byte [0x42103a]
mov esi, dword [esp + 0x44c]
test al, al
jne 0x40bc02
mov al, byte [0x421039]
test al, al
jne 0x40bc02
mov edx, dword [0x420e5c]
mov eax, dword [0x421088]
push 0x104
push edx
push eax
call dword [0x421138]
mov eax, dword [0x420e5c]
mov cx, word [eax]
cmp cx, 0x5c
jne 0x40bbc7
cmp word [eax + 2], cx
je 0x40bbde
test cx, cx
je 0x40bbde
cmp word [eax + 2], 0x3a
jne 0x40bbde
mov word [eax + 6], 0
mov eax, dword [0x420e5c]
push eax
call dword [0x421110]
cmp eax, 2
je 0x40bbef
cmp eax, 5
jne 0x40bc02
push 0
push esi
call fcn.0040b740
add esp, 8
test eax, eax
jne 0x40be6c
test edi, edi
jne 0x40bc15
call fcn.0040c4c0
mov edi, eax
test edi, edi
je 0x40be69
mov eax, dword [0x4210b8]
test eax, eax
je 0x40bc25
call fcn.00407810
jmp 0x40bc48
mov ecx, dword [0x420ff8]
test byte [ecx + 0x14], 2
jne 0x40bc36
call fcn.00402170
call fcn.0040c310
test eax, eax
je 0x40be69
call fcn.00408f00
mov eax, dword [0x4210b0]
test eax, eax
jne 0x40bc95
mov eax, dword [0x4210bc]
test eax, eax
jne 0x40bc95
mov eax, dword [0x420e68]
test eax, eax
je 0x40bc95
push 0
push eax
call fcn.00406770
mov edx, dword [0x420e5c]
lea eax, [esp + 0x34]
push edx
push str.desk.cpl_InstallScreenSaver__s
push eax
call fcn.00411f6f
lea ecx, [esp + 0x40]
push 0
push ecx
push str.rundll32.exe
call fcn.00403470
add esp, 0x20
mov eax, dword [0x42108c]
test eax, eax
je 0x40bca7
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4210b4]
test eax, eax
je 0x40bd49
mov eax, dword [0x4210bc]
test eax, eax
jne 0x40bd49
mov eax, dword [0x4210b0]
test eax, eax
jne 0x40bce7
mov al, byte [0x421043]
test al, al
jne 0x40bce7
call fcn.00403fa0
test eax, eax
je 0x40bce7
push 1
push esi
call fcn.0040b740
add esp, 8
mov eax, dword [0x4210b8]
test eax, eax
je 0x40bcfc
mov edx, dword [0x420ff8]
mov eax, dword [edx]
test ah, ah
jns 0x40bd49
push 8
push 6
call fcn.00407970
add esp, 8
test eax, eax
je 0x40bd49
cmp word [eax], 0
je 0x40bd49
mov eax, dword [0x421090]
mov ecx, dword [0x421088]
push 0
push 0x40a890
push eax
push 0x83
push ecx
call dword [0x4211bc]
cmp eax, 1
jne 0x40bd49
mov eax, dword [0x4210b0]
test eax, eax
jne 0x40bd49
mov dword [0x4210b4], 0x10
mov eax, dword [0x42108c]
test eax, eax
je 0x40bdb8
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x4210b4], 0x10
je 0x40bda4
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call dword [0x421180]
test eax, eax
je 0x40bda4
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call dword [0x42117c]
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call dword [0x421180]
test eax, eax
jne 0x40bd7d
mov dword [0x42108c], 0
mov dword [0x421090], 0
mov eax, dword [0x4210b0]
test eax, eax
jne 0x40be6c
mov eax, dword [0x4210b4]
test eax, eax
jne 0x40be6c
mov al, byte [0x421043]
test al, al
jne 0x40be6c
mov eax, dword [0x4210bc]
test eax, eax
jne 0x40be6c
push 1
push 0
push 0x3000000
call fcn.00404000
mov al, byte [0x41c140]
add esp, 0xc
test al, al
je 0x40be6c
push 1
push 1
push 0x4000000
call fcn.00404000
add esp, 0xc
jmp 0x40be6c
dec eax
push eax
call fcn.0040ae30
push 0
push 0
push 0x1000000
call fcn.00404000
push 0
push 0
push 0x2000000
call fcn.00404000
push 0
push 0
push 0x3000000
call fcn.00404000
mov al, byte [0x41c140]
add esp, 0x28
test al, al
je 0x40be6c
push 0
push 1
push 0x4000000
call fcn.00404000
add esp, 0xc
jmp 0x40be6c
or ebp, 0xffffffff
test edi, edi
pop esi
je 0x40be76
call fcn.0040b1d0
call fcn.0040c210
cmp dword [0x4210b4], 0x10
jne 0x40bee9
mov al, byte [0x42104a]
test al, al
je 0x40bedf
lea eax, [esp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40bee9
lea ecx, [esp + 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test ebp, ebp
jne 0x40bef3
mov ebp, dword [0x4210bc]
mov eax, dword [0x4210b4]
test eax, eax
je 0x40bf01
mov ebp, 0xfffffffe
call fcn.0040f290
mov eax, ebp
pop edi
pop ebp
add esp, 0x430
ret 0x10