Function at 0x408d00
Capabilities:
Create process on windows
Get common file path
Shutdown system

Disassembly:
sub esp, 0x320
push ebx
mov ebx, dword [esp + 0x328]
push ebp
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetMenu]
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x130]
push 0xff
push eax
mov dword [0x418ea8], ebx
call ebp
mov edi, str._syschg.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x130]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x338]
mov ecx, edx
and ecx, 3
cmp eax, 0x801a
rep movsb byte es:[edi], byte [esi]
jg 0x40904b
je 0x409026
cmp eax, 0x8004
jg 0x408eec
je 0x408ed4
cmp eax, 0xb7
jg 0x408e6d
je 0x408e35
sub eax, 0x68
je 0x408e23
sub eax, 0x4d
je 0x408deb
dec eax
jne case.0x409059.32797
push 2
push 0x2710
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov eax, dword [esp + 0x18]
push 8
push 0xb6
push 0xb7
push 0xb5
push eax
call fcn.00408a60
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0x2710
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esp + 0x14]
push eax
push 8
push 0xb5
push 0xb7
push 0xb5
push ecx
call fcn.00408a60
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0x403690
push ebx
push 0x90
jmp 0x4093da
push 3
push 0x2710
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov eax, dword [esp + 0x18]
push 8
push 0xb7
push 0xb7
push 0xb5
push eax
call fcn.00408a60
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
sub eax, 0xe3
je 0x408ec2
dec eax
je 0x408ea4
sub eax, 0x7f1f
jne case.0x409059.32797
mov ecx, dword [0x418f8c]
push 0
push 0x401f50
push ebx
push 0x67
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0x40
push 0x41560c
push 0x415d70
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0x4036f0
push ebx
push 0xda
jmp 0x4093da
push str.ProceModul.dll
call fcn.00407bd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
add eax, 0xffff7ffa
cmp eax, 0x12
ja case.0x409059.32797
xor ecx, ecx
mov cl, byte [eax + 0x409414]
jmp dword [ecx*4 + 0x4093f4]
push 0
push 0x403990
push ebx
push 0x91
jmp 0x4093da
push str.ViewIP.dll
call fcn.00407bd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push str.Testcpu.dll
call fcn.00407bd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
mov eax, dword [0x418f8c]
push 0
push 0x403b40
push ebx
push 0x9a
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
call fcn.004081b0
cmp eax, 0x7d0
jne 0x408fd9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0x18]
mov dword [esp + 0x20], 1
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 0
push 0
lea edx, [esp + 0x28]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
push 0
push edx
push 0
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 5
push 0
push 0
push str.mailto:_webmaster_xasoft.net
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
mov ecx, dword [0x418f8c]
push 0
push 0x404080
push ebx
push 0x9c
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
add eax, 0xffff7fe4
cmp eax, 0x10
ja case.0x409059.32797
jmp dword [eax*4 + 0x409428]
push 0
push 0x402990
push ebx
push 0xa8
jmp 0x4093da
push 5
push 0
push 0
push 0x415e98
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea eax, [esp + 0x30]
push 0xff
push eax
call ebp
mov edi, str.CLEANMGR.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call ebp
mov edi, str.SCANDSKW.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call ebp
mov edi, str.DEFRAG.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call ebp
mov edi, str.REGEDIT.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call ebp
mov edi, str.SCANREGW.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.MSCONFIG.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.SYSEDIT.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
lea ecx, [esp + 0x30]
push 0xff
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.MAGNIFY.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
mov edi, str.hh.exe_readme.chm
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0x402ea0
push ebx
push 0xaa
jmp 0x4093da
mov eax, dword [0x418f8c]
push 0
push 0x404370
push ebx
push 0x9f
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
mov ecx, dword [0x418f8c]
push 0
push 0x4046e0
push ebx
push 0xa3
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0x403290
push ebx
push 0xac
mov edx, dword [0x418f8c]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret