Function at 0x411930
Capabilities:
Create process on windows
Get disk information
Shutdown system

Disassembly:
sub esp, 0x230
mov eax, dword [esp + 0x234]
push ebx
xor ebx, ebx
push eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
call fcn.00411d80
add esp, 4
test eax, eax
jne 0x41195f
pop ebx
add esp, 0x230
ret 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push ebx
call esi
push 1
mov dword [0x427628], eax
call esi
mov dword [0x427624], eax
mov ecx, dword [esp + 0x248]
push ecx
call fcn.00411150
mov eax, dword [0x427204]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 4
cmp eax, ebx
je 0x4119bb
mov edx, dword [0x4271fc]
mov eax, dword [0x427670]
push 0x104
push edx
push eax
call esi
mov ecx, dword [0x4271fc]
push ecx
push ebx
call fcn.00411380
add esp, 8
cmp dword [0x42760c], ebx
jne 0x4119cb
cmp dword [0x427604], ebx
je 0x4119e9
call fcn.00412260
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x411cef
mov eax, dword [0x42760c]
cmp eax, ebx
jne 0x411c92
call fcn.00412030
test eax, eax
je 0x411cef
cmp dword [0x427604], ebx
je 0x411a2b
mov eax, dword [0x4275b4]
cmp dword [eax + 0x64], ebx
je 0x411a30
mov ecx, dword [eax + 0x68]
lea edx, [esp + 0x14]
push edx
mov edx, dword [eax + 0x64]
push 0x20019
add ecx, eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411cdb
mov eax, dword [0x4275b4]
mov ecx, dword [0x427204]
mov edi, dword [esp + 0x24c]
cmp ecx, ebx
jne 0x411aa0
mov eax, dword [0x4271fc]
mov ecx, dword [0x427670]
push 0x104
push eax
push ecx
call esi
mov eax, dword [0x4271fc]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x411a66
cmp byte [eax + 1], cl
je 0x411a78
cmp cl, bl
je 0x411a78
cmp byte [eax + 1], 0x3a
jne 0x411a78
mov byte [eax + 3], bl
mov eax, dword [0x4271fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x411a89
cmp eax, 5
jne 0x411a9b
push ebx
push edi
call fcn.004115a0
add esp, 8
test eax, eax
jne 0x411ce8
mov eax, dword [0x4275b4]
cmp dword [esp + 0x10], ebx
jne 0x411abc
call fcn.00412260
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x411cef
mov eax, dword [0x4275b4]
cmp dword [0x4276a0], ebx
je 0x411acb
call fcn.0040fda0
jmp 0x411ae8
test byte [eax + 0x14], 2
jne 0x411ad6
call fcn.00402b40
call fcn.004120b0
test eax, eax
je 0x411cef
call fcn.00405030
cmp dword [0x427698], ebx
jne 0x411b31
cmp dword [0x4276a4], ebx
jne 0x411b31
mov eax, dword [0x427220]
cmp eax, ebx
je 0x411b31
push eax
call fcn.0040d560
mov edx, dword [0x4271fc]
add esp, 4
lea eax, [esp + 0x34]
push edx
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x34]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x427674]
cmp eax, ebx
je 0x411b42
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x42769c], ebx
je 0x411bd5
cmp dword [0x4276a4], ebx
jne 0x411bd5
cmp dword [0x427698], ebx
jne 0x411b7a
cmp dword [0x427608], ebx
jne 0x411b7a
call fcn.00403750
test eax, eax
je 0x411b7a
push 1
push edi
call fcn.004115a0
add esp, 8
cmp dword [0x4276a0], ebx
jne 0x411bd5
mov edx, dword [0x427678]
mov eax, dword [0x427670]
push ebx
push 0x4105a0
push edx
push 0x83
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x411bd5
cmp dword [0x427698], ebx
jne 0x411bd5
cmp dword [0x42763c], ebx
je 0x411d2e
lea ecx, [esp + 0x14]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x411cf9
mov eax, dword [0x427674]
cmp eax, ebx
je 0x411c2f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea edx, [esp + 0x20]
push ebx
push edx
call esi
test eax, eax
je 0x411c23
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x1c]
push eax
call edi
lea ecx, [esp + 0x1c]
push ecx
call ebp
push ebx
push ebx
lea edx, [esp + 0x24]
push ebx
push edx
call esi
test eax, eax
jne 0x411c06
pop ebp
mov dword [0x427674], ebx
mov dword [0x427678], ebx
cmp dword [0x427698], ebx
jne 0x411d37
cmp dword [0x42769c], ebx
jne 0x411d37
cmp dword [0x427608], ebx
jne 0x411d37
cmp dword [0x4276a4], ebx
jne 0x411d37
push 1
push ebx
push 0x3000000
call fcn.004037c0
mov eax, dword [0x42203c]
add esp, 0xc
cmp eax, ebx
je 0x411d37
push 1
push 1
push 0x4000000
call fcn.004037c0
add esp, 0xc
jmp 0x411d37
dec eax
push eax
call fcn.00410e50
push ebx
push ebx
push 0x1000000
call fcn.004037c0
push ebx
push ebx
push 0x2000000
call fcn.004037c0
push ebx
push ebx
push 0x3000000
call fcn.004037c0
mov eax, dword [0x42203c]
add esp, 0x28
cmp eax, ebx
je 0x411d37
push ebx
push 1
push 0x4000000
call fcn.004037c0
add esp, 0xc
jmp 0x411d37
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x411d37
call fcn.00411fa0
jmp 0x411d37
mov dword [esp + 0xc], 0xffffffff
jmp 0x411d37
lea ecx, [esp + 0x1c]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push ebx
push edx
push ebx
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [esp + 0x10]
pop edi
cmp eax, ebx
pop esi
je 0x411d46
call fcn.00411080
call fcn.00411fa0
cmp dword [esp + 4], ebx
jne 0x411d5b
mov ecx, dword [0x4276a4]
mov dword [esp + 4], ecx
cmp dword [0x42769c], ebx
je 0x411d6b
mov dword [esp + 4], 0xfffffffe
mov eax, dword [esp + 4]
pop ebx
add esp, 0x230
ret 0x10