Function at 0x40b8e0
Capabilities:
Create process on windows
Get disk information
Shutdown system

Disassembly:
sub esp, 0x22c
mov eax, dword [esp + 0x230]
push ebx
xor ebx, ebx
push eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
call fcn.0040bd20
add esp, 4
test eax, eax
jne 0x40b90f
pop ebx
add esp, 0x22c
ret 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push ebx
call esi
push 1
mov dword [0x41f1e4], eax
call esi
mov dword [0x41f1e0], eax
mov ecx, dword [esp + 0x244]
push ecx
call fcn.0040b120
mov eax, dword [0x41efe8]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 4
cmp eax, ebx
je 0x40b96b
mov edx, dword [0x41efdc]
mov eax, dword [0x41f240]
push 0x104
push edx
push eax
call esi
mov ecx, dword [0x41efdc]
push ecx
push ebx
call fcn.0040b340
add esp, 8
cmp dword [0x41f1c8], ebx
jne 0x40b97b
cmp dword [0x41f1c0], ebx
je 0x40b999
call fcn.0040c2b0
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x40bc60
mov eax, dword [0x41f1c8]
cmp eax, ebx
jne 0x40bc10
call fcn.0040c080
test eax, eax
je 0x40bc60
mov eax, dword [0x41efe8]
mov edi, dword [esp + 0x248]
cmp eax, ebx
jne 0x40ba18
cmp dword [0x41efe4], ebx
jne 0x40ba18
mov edx, dword [0x41efdc]
mov eax, dword [0x41f240]
push 0x104
push edx
push eax
call esi
mov eax, dword [0x41efdc]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x40b9e3
cmp byte [eax + 1], cl
je 0x40b9f5
cmp cl, bl
je 0x40b9f5
cmp byte [eax + 1], 0x3a
jne 0x40b9f5
mov byte [eax + 3], bl
mov eax, dword [0x41efdc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x40ba06
cmp eax, 5
jne 0x40ba18
push ebx
push edi
call fcn.0040b570
add esp, 8
test eax, eax
jne 0x40bc59
cmp dword [esp + 0x10], ebx
jne 0x40ba2f
call fcn.0040c2b0
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x40bc60
cmp dword [0x41f270], ebx
je 0x40ba3e
call fcn.00409ff0
jmp 0x40ba61
mov ecx, dword [0x41f18c]
test byte [ecx + 0x14], 2
jne 0x40ba4f
call fcn.00402c00
call fcn.0040c100
test eax, eax
je 0x40bc60
call fcn.004052d0
cmp dword [0x41f268], ebx
jne 0x40baa7
cmp dword [0x41f274], ebx
jne 0x40baa7
mov eax, dword [0x41f004]
cmp eax, ebx
je 0x40baa7
push eax
call fcn.004090c0
mov edx, dword [0x41efdc]
lea eax, [esp + 0x34]
push edx
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x30]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x41f244]
cmp eax, ebx
je 0x40bab8
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x41f26c], ebx
je 0x40bb51
cmp dword [0x41f274], ebx
jne 0x40bb51
cmp dword [0x41f268], ebx
jne 0x40baf4
cmp dword [0x41f1c4], ebx
jne 0x40baf4
call fcn.00403a80
test eax, eax
je 0x40baf4
push 1
push edi
call fcn.0040b570
add esp, 8
cmp dword [0x41f270], ebx
je 0x40bb08
mov edx, dword [0x41f18c]
mov eax, dword [edx]
test ah, ah
jns 0x40bb51
push 8
push 6
call fcn.004039d0
add esp, 8
cmp eax, ebx
je 0x40bb51
cmp byte [eax], bl
je 0x40bb51
mov eax, dword [0x41f248]
mov ecx, dword [0x41f240]
push ebx
push 0x40a830
push eax
push 0x83
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x40bb51
cmp dword [0x41f268], ebx
jne 0x40bb51
mov dword [0x41f26c], 0x10
mov eax, dword [0x41f244]
cmp eax, ebx
je 0x40bbb4
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x41f26c], 0x10
je 0x40bba8
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea edx, [esp + 0x1c]
push ebx
push edx
call esi
test eax, eax
je 0x40bba8
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x18]
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
call ebp
push ebx
push ebx
lea edx, [esp + 0x20]
push ebx
push edx
call esi
test eax, eax
jne 0x40bb8b
pop ebp
mov dword [0x41f244], ebx
mov dword [0x41f248], ebx
cmp dword [0x41f268], ebx
jne 0x40bc68
cmp dword [0x41f26c], ebx
jne 0x40bc68
cmp dword [0x41f1c4], ebx
jne 0x40bc68
cmp dword [0x41f274], ebx
jne 0x40bc68
push 1
push ebx
push 0x3000000
call fcn.00403af0
mov eax, dword [0x41a268]
add esp, 0xc
cmp eax, ebx
je 0x40bc68
push 1
push 1
push 0x4000000
call fcn.00403af0
add esp, 0xc
jmp 0x40bc68
dec eax
push eax
call fcn.0040ae80
push ebx
push ebx
push 0x1000000
call fcn.00403af0
push ebx
push ebx
push 0x2000000
call fcn.00403af0
push ebx
push ebx
push 0x3000000
call fcn.00403af0
mov eax, dword [0x41a268]
add esp, 0x28
cmp eax, ebx
je 0x40bc68
push ebx
push 1
push 0x4000000
call fcn.00403af0
add esp, 0xc
jmp 0x40bc68
call fcn.0040c000
jmp 0x40bc68
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esp + 0x10]
pop edi
cmp eax, ebx
pop esi
je 0x40bc77
call fcn.0040b080
call fcn.0040c000
cmp dword [0x41f26c], 0x10
jne 0x40bce3
cmp dword [0x41f1fc], ebx
je 0x40bcda
lea eax, [esp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40bce3
lea ecx, [esp + 0x10]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebx
push edx
push ebx
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp dword [esp + 4], ebx
jne 0x40bcf3
mov ecx, dword [0x41f274]
mov dword [esp + 4], ecx
cmp dword [0x41f26c], ebx
je 0x40bd03
mov dword [esp + 4], 0xfffffffe
mov eax, dword [esp + 4]
pop ebx
add esp, 0x22c
ret 0x10