Function at 0x413000
Capabilities:
Create process on windows
Get disk information
Shutdown system

Disassembly:
sub esp, 0x230
mov eax, dword [esp + 0x234]
push ebx
xor ebx, ebx
push eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
call fcn.00413480
add esp, 4
test eax, eax
jne 0x41302f
pop ebx
add esp, 0x230
ret 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push ebx
call esi
push 1
mov dword [0x42ba1c], eax
call esi
mov dword [0x42ba18], eax
mov ecx, dword [esp + 0x248]
push ecx
call fcn.00412830
mov eax, dword [0x42b5fc]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 4
cmp eax, ebx
je 0x41308b
mov edx, dword [0x42b5f0]
mov eax, dword [0x42ba78]
push 0x104
push edx
push eax
call esi
mov ecx, dword [0x42b5f0]
push ecx
push ebx
call fcn.00412a60
add esp, 8
cmp dword [0x42ba00], ebx
jne 0x41309b
cmp dword [0x42b9f8], ebx
je 0x4130b9
call fcn.00413a50
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x4133cc
mov eax, dword [0x42ba00]
cmp eax, ebx
jne 0x41336f
call fcn.00413820
test eax, eax
je 0x4133cc
cmp dword [0x42b9f8], ebx
je 0x4130fb
mov eax, dword [0x42b9ac]
cmp dword [eax + 0x64], ebx
je 0x413100
mov ecx, dword [eax + 0x68]
lea edx, [esp + 0x14]
push edx
mov edx, dword [eax + 0x64]
push 0x20019
add ecx, eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4133b8
mov eax, dword [0x42b9ac]
mov ecx, dword [0x42b5fc]
mov edi, dword [esp + 0x24c]
cmp ecx, ebx
jne 0x413178
cmp dword [0x42b5f8], ebx
jne 0x413178
mov eax, dword [0x42b5f0]
mov ecx, dword [0x42ba78]
push 0x104
push eax
push ecx
call esi
mov eax, dword [0x42b5f0]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x41313e
cmp byte [eax + 1], cl
je 0x413150
cmp cl, bl
je 0x413150
cmp byte [eax + 1], 0x3a
jne 0x413150
mov byte [eax + 3], bl
mov eax, dword [0x42b5f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x413161
cmp eax, 5
jne 0x413173
push ebx
push edi
call fcn.00412c90
add esp, 8
test eax, eax
jne 0x4133c5
mov eax, dword [0x42b9ac]
cmp dword [esp + 0x10], ebx
jne 0x413194
call fcn.00413a50
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x4133cc
mov eax, dword [0x42b9ac]
cmp dword [0x42baa8], ebx
je 0x4131a3
call fcn.00411390
jmp 0x4131c0
test byte [eax + 0x14], 2
jne 0x4131ae
call fcn.00402ba0
call fcn.004138a0
test eax, eax
je 0x4133cc
call fcn.004054d0
cmp dword [0x42baa0], ebx
jne 0x413206
cmp dword [0x42baac], ebx
jne 0x413206
mov eax, dword [0x42b618]
cmp eax, ebx
je 0x413206
push eax
call fcn.0040ea60
mov edx, dword [0x42b5f0]
lea eax, [esp + 0x38]
push edx
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x34]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x42ba7c]
cmp eax, ebx
je 0x413217
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x42baa4], ebx
je 0x4132b0
cmp dword [0x42baac], ebx
jne 0x4132b0
cmp dword [0x42baa0], ebx
jne 0x413253
cmp dword [0x42b9fc], ebx
jne 0x413253
call fcn.00403b20
test eax, eax
je 0x413253
push 1
push edi
call fcn.00412c90
add esp, 8
cmp dword [0x42baa8], ebx
je 0x413267
mov edx, dword [0x42b9ac]
mov eax, dword [edx]
test ah, ah
jns 0x4132b0
push 8
push 6
call fcn.00403970
add esp, 8
cmp eax, ebx
je 0x4132b0
cmp byte [eax], bl
je 0x4132b0
mov eax, dword [0x42ba80]
mov ecx, dword [0x42ba78]
push ebx
push 0x411b20
push eax
push 0x83
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x4132b0
cmp dword [0x42baa0], ebx
jne 0x4132b0
mov dword [0x42baa4], 0x10
mov eax, dword [0x42ba7c]
cmp eax, ebx
je 0x413313
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x42baa4], 0x10
je 0x413307
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea edx, [esp + 0x20]
push ebx
push edx
call esi
test eax, eax
je 0x413307
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x1c]
push eax
call edi
lea ecx, [esp + 0x1c]
push ecx
call ebp
push ebx
push ebx
lea edx, [esp + 0x24]
push ebx
push edx
call esi
test eax, eax
jne 0x4132ea
pop ebp
mov dword [0x42ba7c], ebx
mov dword [0x42ba80], ebx
cmp dword [0x42baa0], ebx
jne 0x4133d4
cmp dword [0x42baa4], ebx
jne 0x4133d4
cmp dword [0x42b9fc], ebx
jne 0x4133d4
cmp dword [0x42baac], ebx
jne 0x4133d4
push 1
push ebx
push 0x3000000
call fcn.00403bb0
mov eax, dword [0x42603c]
add esp, 0xc
cmp eax, ebx
je 0x4133d4
push 1
push 1
push 0x4000000
call fcn.00403bb0
add esp, 0xc
jmp 0x4133d4
dec eax
push eax
call fcn.00412410
push ebx
push ebx
push 0x1000000
call fcn.00403bb0
push ebx
push ebx
push 0x2000000
call fcn.00403bb0
push ebx
push ebx
push 0x3000000
call fcn.00403bb0
mov eax, dword [0x42603c]
add esp, 0x28
cmp eax, ebx
je 0x4133d4
push ebx
push 1
push 0x4000000
call fcn.00403bb0
add esp, 0xc
jmp 0x4133d4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4133d4
call fcn.00413780
jmp 0x4133d4
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esp + 0x10]
pop edi
cmp eax, ebx
pop esi
je 0x4133e3
call fcn.00412760
call fcn.00413780
cmp dword [0x42baa4], 0x10
jne 0x41344f
cmp dword [0x42ba34], ebx
je 0x413446
lea ecx, [esp + 0xc]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41344f
lea edx, [esp + 0x14]
push edx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push ebx
push eax
push ebx
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp dword [esp + 4], ebx
jne 0x41345f
mov edx, dword [0x42baac]
mov dword [esp + 4], edx
cmp dword [0x42baa4], ebx
je 0x41346f
mov dword [esp + 4], 0xfffffffe
mov eax, dword [esp + 4]
pop ebx
add esp, 0x230
ret 0x10