Function at 0x4031eb
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
cmp dword [ebp + 8], 0
jne 0x403200
jmp 0x4034e5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x21
jne 0x403480
mov edx, dword [ebp + 8]
add edx, 1
push edx
push str.Launching_EZShell_command___s_
call fcn.004027ab
add esp, 8
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x403256
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_toupper]
add esp, 4
mov edx, dword [ebp - 4]
mov byte [edx], al
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x40322c
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
push str.EXIT
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x40329d
push str.Request_to_exit
call fcn.004027ab
add esp, 4
push 0
push 0
push 0x10
mov ecx, 0x4097c8
call fcn.004025ec
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40347e
push str.RUNSTARTUP
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4032e3
mov ecx, dword [0x4098fc]
push ecx
push str.Request_to__re_run_startup_folder___s_
call fcn.004027ab
add esp, 8
cmp dword [0x4098fc], 0
je 0x4032de
mov edx, dword [0x4098fc]
push edx
call fcn.004034ea
add esp, 4
jmp 0x40347e
push str.REBOOT
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x403314
push str.Request_to_reboot_system
call fcn.004027ab
add esp, 4
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40347e
push str.HOTREBOOT
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x403351
push str.Request_to_hot_reboot_system
call fcn.004027ab
add esp, 4
push 0
push 1
push 0x3e8
push str.rundll.exe_user.exe_exitwindowsexec
call fcn.004065bd
add esp, 0x10
jmp 0x40347e
push str.SHUTDOWN
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x403382
push str.Request_to_shutdown_system
call fcn.004027ab
add esp, 4
push 0
push 1
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40347e
push str.SUSPEND
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4033b2
push str.Request_to_suspend_standby_system
call fcn.004027ab
add esp, 4
push 0
push 1
call sub.KERNEL32.dll_SetSystemPowerState
jmp 0x40347e
push str.LOGOFF
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4033e3
push str.Request_to_logoff_current_shell
call fcn.004027ab
add esp, 4
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40347e
push 0x408b78
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x403422
cmp dword [0x4098f0], 0
je 0x403420
push str.Request_to_display_menu
call fcn.004027ab
add esp, 4
push 0
push 0
push 0
push 0
push 0
push 0
call dword [0x4098f0]
jmp 0x40347e
push 4
push str.SHOW
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40347e
push str.Request_to_show_alternate_window
call fcn.004027ab
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x403474
push 9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindowAsync]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4034e5
mov dl, byte [0x409924]
mov byte [ebp - 0x108], dl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
add eax, 1
push eax
push str.Launching_normal_command___s_
call fcn.004027ab
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x408be0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 6
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
mov esp, ebp
pop ebp
ret