Function at 0x40b260
Capabilities:
Find taskbar
Query environment variable
Shutdown system

Disassembly:
sub esp, 0xa30
mov eax, dword [0x477b14]
push ebp
push esi
mov esi, dword [esp + 0xa3c]
mov dword [esp + 0xa34], eax
mov al, byte [esi + 0x200]
cmp al, 0xd
je 0x40b293
cmp al, 0xf
je 0x40b293
push 0xffffffffffffffff
call fcn.0040ad20
add esp, 4
mov al, byte [esi + 0x200]
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
movzx ecx, al
dec ecx
cmp ecx, 0x31
ja case.default.0x40b2ad
push edi
jmp dword [ecx*4 + 0x40bcf0]
mov eax, dword [esi + 0x1ec]
test eax, eax
je case.0x40b2ad.2
push 0x104
lea ecx, [esp + 0x22c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x22c]
push eax
call fcn.00420c30
add esp, 8
mov eax, dword [esi + 0x1fc]
test eax, eax
push 0
push 0
jne 0x40b310
lea ecx, [esp + 0x28]
push 0x466680
push ecx
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
push 0
lea edx, [esp + 0x2c]
push edx
push esi
call fcn.004086f0
add esp, 4
push eax
push esi
call fcn.00416c50
add esp, 0x18
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1ec]
test eax, eax
je case.0x40b2ad.2
push 0x104
lea ecx, [esp + 0x434]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x434]
push eax
call fcn.00420c30
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
je case.0x40b2ad.2
push 0x466d90
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je case.0x40b2ad.2
mov ax, word [esp + 0x20]
cmp ax, 0x2e
jne 0x40b3e2
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00421940
mov eax, dword [esi + 0x1f0]
add esp, 8
test eax, eax
jne 0x40b3c2
mov eax, 0x466680
movzx edx, byte [esi + 0x1f4]
push edx
push 1
push eax
lea eax, [esp + 0x234]
push eax
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
cmp ax, 0x3f
jne 0x40b405
lea ecx, [esp + 0x22]
push 0
push ecx
call fcn.004458f5
add esp, 4
push eax
call fcn.0040c5e0
add esp, 8
jmp case.0x40b2ad.2
lea edx, [esp + 0x20]
push edx
call fcn.00420910
add esp, 4
test eax, eax
jne 0x40b4af
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x63c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea edx, [esp + 0x648]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x240]
push 0x104
push eax
call fcn.00421ce0
add esp, 0x20
test eax, eax
mov eax, dword [esi + 0x1f0]
je 0x40b489
test eax, eax
jne 0x40b469
mov eax, 0x466680
movzx ecx, byte [esi + 0x1f4]
push ecx
push 1
push eax
lea edx, [esp + 0x234]
push edx
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
test eax, eax
jne 0x40b492
mov eax, 0x466680
movzx ecx, byte [esi + 0x1f4]
push ecx
push 1
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
cmp eax, 1
jne 0x40b5be
lea eax, [esp + 0x20]
push eax
call fcn.00420880
add esp, 4
test eax, eax
je 0x40b4f3
mov eax, dword [esi + 0x1f0]
test eax, eax
jne 0x40b4d8
mov eax, 0x466680
movzx ecx, byte [esi + 0x1f4]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00408780
add esp, 0xc
jmp case.0x40b2ad.2
lea eax, [esp + 0x20]
push eax
call fcn.00420820
add esp, 4
test eax, eax
jne 0x40b2eb
lea ecx, [esp + 0x20]
push ecx
call fcn.004208d0
add esp, 4
test eax, eax
jne 0x40b2eb
lea edx, [esp + 0x20]
push edx
call edi
cmp word [esp + eax*2 + 0x1e], 0x5c
lea eax, [esp + eax*2 + 0x1e]
je 0x40b539
sub eax, 2
cmp word [eax], 0x5c
jne 0x40b530
add eax, 2
push eax
lea eax, [esp + 0x63c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea ecx, [esp + 0x648]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [esp + 0x240]
push 0x104
push edx
call fcn.00421ce0
add esp, 0x20
test eax, eax
je case.0x40b2ad.2
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 0x1f0]
test eax, eax
jne 0x40b59e
mov eax, 0x466680
movzx edx, byte [esi + 0x1f4]
push edx
push 1
push eax
lea eax, [esp + 0x234]
push eax
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1f0]
test eax, eax
jne 0x40b5cd
mov eax, 0x466680
movzx ecx, byte [esi + 0x1f4]
push ecx
push 1
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1ec]
test eax, eax
je case.0x40b2ad.2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.0x40b2ad.2
mov eax, dword [esi + 0x1ec]
push 0
push 0
push 0x466680
push eax
call fcn.00421b00
add esp, 0x10
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40b644
mov ecx, dword [0x47c354]
push 0x11
push ecx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 0x11
push 0x466680
jmp 0x40b317
mov edx, dword [0x47c354]
push 1
push edx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40b689
mov eax, dword [0x47c354]
push 5
push eax
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 5
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40b6b9
mov ecx, dword [0x47c354]
push 0x12
push ecx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 0x12
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40b6e9
mov edx, dword [0x47c354]
push 3
push edx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 3
push 0x466680
jmp 0x40b317
mov eax, dword [0x47c354]
push 0xa
push eax
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1f0]
test eax, eax
je case.0x40b2ad.2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.0x40b2ad.2
mov ecx, dword [esi + 0x1f0]
push ecx
call fcn.004085f0
add esp, 4
test eax, eax
je 0x40b754
mov edx, dword [esi + 0x1f0]
push 1
push edx
call fcn.0040af90
add esp, 8
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1f0]
push eax
call fcn.00408040
push eax
call fcn.0040b160
add esp, 8
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1f0]
test eax, eax
je case.0x40b2ad.2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.0x40b2ad.2
mov ecx, dword [esi + 0x1f0]
push ecx
call fcn.004085f0
add esp, 4
test eax, eax
je 0x40b7b4
mov edx, dword [esi + 0x1f0]
push 0
push edx
call fcn.0040af90
add esp, 8
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1f0]
push eax
call fcn.00408040
push eax
call fcn.0040ac60
add esp, 8
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1f0]
test eax, eax
je case.0x40b2ad.2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je case.0x40b2ad.2
mov ecx, dword [esi + 0x1f0]
push ecx
push 0x47c380
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [0x47c354]
push 0
push 0x47c380
push 0x418
push edx
call ebp
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1fc]
test eax, eax
push 0
jne 0x40b836
mov eax, dword [0x47c354]
push eax
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0x10
push 0x466680
jmp 0x40b317
push 0
push 0xf140
push 0x112
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x40b2ad.2
call fcn.00401780
jmp case.0x40b2ad.2
call fcn.004086c0
jmp case.0x40b2ad.2
test byte [0x49222c], 0x10
je 0x40b8e9
lea ecx, [esp + 0xc]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.0x40b2ad.2
lea edx, [esp + 0x14]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.0x40b2ad.2
mov al, byte [esi + 0x200]
cmp al, 0x10
push 0
jne 0x40b8fc
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp case.0x40b2ad.2
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp case.0x40b2ad.2
test dword [0x49222c], 0x1011
je 0x40b93d
push 0x466680
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push 0x192
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x40b2ad.2
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40b96c
mov edx, dword [0x47c354]
push 0xb
push edx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 0xb
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40b99b
mov eax, dword [0x47c354]
push 2
push eax
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 2
push 0x466680
jmp 0x40b317
call fcn.004086a0
jmp case.0x40b2ad.2
push 0x11
call fcn.00420700
add esp, 4
test eax, eax
jne case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 0
push 0x40d
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je case.0x40b2ad.2
mov ecx, dword [esi + 0x1ec]
push 0x467184
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
push 0
jne 0x40ba31
push 3
push 0x2707
push edi
call ebp
jmp case.0x40b2ad.2
push 4
push 0x2707
push edi
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 7
push 0x2707
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 8
push 0x2707
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 6
push 0x2707
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 5
push 0x2707
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 2
push 0x2707
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 1
push 0x2707
push eax
call ebp
jmp case.0x40b2ad.2
push 0x46718c
push 0x46718c
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.0x40b2ad.2
push 0
push 0
push 0x40c
push eax
call ebp
jmp case.0x40b2ad.2
call fcn.00408640
jmp case.0x40b2ad.2
call fcn.00408670
jmp case.0x40b2ad.2
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40bb93
mov edx, dword [0x47c354]
push 6
push edx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 6
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40bbc2
mov eax, dword [0x47c354]
push 4
push eax
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 4
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40bbf2
mov ecx, dword [0x47c354]
push 8
push ecx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 8
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40bc1f
mov edx, dword [0x47c354]
push 0x14
push edx
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 0x14
push 0x466680
jmp 0x40b317
mov eax, dword [esi + 0x1fc]
test eax, eax
jne 0x40bc4b
mov eax, dword [0x47c354]
push 0x22
push eax
call fcn.00421e70
add esp, 8
jmp case.0x40b2ad.2
push 0
push 0
push 0x22
push 0x466680
jmp 0x40b317
cmp dword [esi + 0x574], 0xffffffff
push esi
je 0x40bc6f
call fcn.00418d50
add esp, 4
jmp case.0x40b2ad.2
call fcn.00419570
add esp, 4
jmp case.0x40b2ad.2
call fcn.00427550
jmp case.0x40b2ad.2
call fcn.00424650
jmp case.0x40b2ad.2
call fcn.00424a80
jmp case.0x40b2ad.2
call fcn.00424d50
pop edi
movzx eax, byte [esi + 0x200]
dec eax
cmp eax, 0x1d
ja case.0x40bca8.2
movzx ecx, byte [eax + 0x40bdc0]
jmp dword [ecx*4 + 0x40bdb8]
mov eax, dword [esi + 0x1f8]
test eax, eax
je case.0x40bca8.2
mov edx, dword [0x47c354]
push 0xb
push 0
push 0x40d
push edx
call ebp
push 0
push 0x466a40
push esi
call fcn.004042e0
mov ecx, dword [esp + 0xa40]
add esp, 0xc
pop esi
pop ebp
call fcn.00444c27
add esp, 0xa30
ret