Function at 0x4067cc
Capabilities:
Create process on windows
Get common file path
Get disk information
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00406ceb
test eax, eax
pop ecx
je 0x406ce2
mov esi, 0x94
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.0040a290
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push dword [ebp + 0x10]
xor eax, eax
cmp dword [ebp - 0x94], 2
sete al
mov dword [0x411c54], eax
call fcn.00406505
cmp dword [0x411ad4], ebx
pop ecx
mov esi, 0x104
jne 0x4069c9
push esi
push dword [0x411acc]
push dword [0x411c50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x411acc]
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x406863
cmp byte [eax + 1], cl
je 0x406875
cmp cl, bl
je 0x406875
cmp byte [eax + 1], 0x3a
jne 0x406875
mov byte [eax + 3], bl
mov eax, dword [0x411acc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x4069c1
push 1
pop edi
push dword [0x411ac8]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x411ac8]
call fcn.00408271
pop ecx
push edi
push str._inst_d.exe
push dword [0x411ac8]
call fcn.0040a060
add eax, dword [0x411ac8]
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push dword [0x411ac8]
call section..text
add esp, 0x14
cmp eax, 0xffffffff
je 0x4068e1
push eax
call fcn.00401229
or dword [ebp + 8], 0xffffffff
pop ecx
jmp 0x4068f5
push dword [0x411ac8]
call fcn.0040104d
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 8], eax
jne 0x406908
inc edi
cmp edi, 0x3e7
jl 0x406888
cmp dword [ebp + 8], 0xffffffff
je 0x4069c1
push ebx
push dword [0x411c24]
call section..text
mov edi, eax
pop ecx
cmp edi, 0xffffffff
pop ecx
je 0x4069b8
lea eax, [ebp + 0x10]
push eax
push dword [0x411036]
call fcn.004082b9
pop ecx
test eax, eax
pop ecx
je 0x406962
push dword [0x411036]
push dword [ebp + 0x10]
push edi
call fcn.00401077
push dword [0x411036]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004010cd
lea eax, [ebp + 0x10]
push eax
call fcn.00408319
add esp, 0x1c
push edi
call fcn.00401229
push dword [ebp + 8]
call fcn.00401229
push str.__S_
push dword [0x411ac8]
call fcn.0040a0f0
push dword [0x411c24]
push dword [0x411ac8]
call fcn.0040a0f0
push str.___DEL
push dword [0x411ac8]
call fcn.0040a0f0
add esp, 0x20
push dword [ebp + 0x14]
push dword [0x411ac8]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x406cdd
push dword [ebp + 8]
call fcn.00401229
pop ecx
cmp dword [0x411ad4], ebx
je 0x4069ea
push esi
push dword [0x411acc]
push dword [0x411c50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [0x411acc]
push ebx
call fcn.00406618
pop ecx
pop ecx
call fcn.00406e51
test eax, eax
je 0x406ce2
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [0x411c30], eax
call esi
mov dword [0x411c2c], eax
call fcn.00406f77
test eax, eax
je 0x406a20
call fcn.00406eb9
test eax, eax
jne 0x406a28
or eax, 0xffffffff
jmp 0x406ce4
xor eax, eax
test byte [0x411c20], 1
je 0x406a36
push 1
pop eax
push eax
call fcn.00401250
pop ecx
mov edi, eax
push ebx
push 0x4060cf
push dword [0x411c4c]
push edi
push dword [0x411c50]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp eax, ebx
mov dword [0x411c48], eax
je 0x406b7f
test byte [0x411c20], 1
jne 0x406abe
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
push ebx
lea eax, [ebp - 0x10]
push 0xca0000
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [ebp - 4]
push 4
sub eax, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x411c4c]
call esi
push 5
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x411c48]
call esi
push 1
push dword [0x411c4c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x411c4c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov cx, word [0x411042]
xor eax, eax
cmp cx, 0xffff
mov dword [0x411c40], eax
je 0x406af5
movzx eax, cx
mov dword [0x411c40], eax
shl eax, 2
push ebx
push dword [eax + 0x411104]
push dword [eax + 0x4110bc]
call fcn.004012f4
add esp, 0xc
cmp word [0x411042], 0xffff
jne 0x406b6d
dec eax
je 0x406b42
dec eax
je 0x406b35
sub eax, 0x3ed
jne 0x406b5a
cmp dword [0x411c40], ebx
jle 0x406b5a
dec dword [0x411c40]
jmp 0x406b5a
push 8
pop eax
cmp dword [0x411c40], eax
jge 0x406b66
jmp 0x406af0
cmp dword [0x411c40], 8
jge 0x406b53
inc dword [0x411c40]
jmp 0x406b5a
or dword [0x411c40], 0xffffffff
mov eax, dword [0x411c40]
cmp eax, 0xffffffff
je 0x406b6d
jmp 0x406af5
or dword [0x411c40], 0xffffffff
push dword [0x411c48]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x411c48], ebx
push edi
call fcn.0040128c
cmp dword [0x411b64], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
pop ecx
jne 0x406bc9
mov eax, dword [0x411ae8]
cmp eax, ebx
je 0x406bc9
push eax
call fcn.0040420e
push dword [0x411acc]
lea eax, [ebp - 0x2ac]
push str.rundll32_desk.cpl_InstallScreenSaver__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x2ac]
push 1
push eax
call edi
cmp dword [0x411af4], ebx
je 0x406c72
push 8
call fcn.00401250
mov esi, eax
pop ecx
cmp esi, ebx
je 0x406c72
push ebx
push 0x405fcd
push dword [0x411c4c]
push esi
push dword [0x411c50]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
push esi
mov dword [ebp + 8], eax
call fcn.0040128c
cmp dword [ebp + 8], 1
pop ecx
jne 0x406c72
cmp dword [0x411b64], ebx
jne 0x406c72
cmp dword [0x411c54], ebx
je 0x406c69
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x406c72
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 2
lea eax, [ebp - 0x10]
pop esi
mov dword [ebp - 0x10], 1
push ebx
push ebx
push ebx
push eax
push ebx
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
jmp 0x406c6c
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call fcn.00406f2d
cmp dword [0x411b64], ebx
jne 0x406cd8
cmp dword [0x411af4], ebx
jne 0x406cd8
cmp dword [0x411054], ebx
je 0x406cd8
mov eax, dword [0x411aec]
cmp eax, ebx
je 0x406cd8
push eax
call fcn.0040420e
push dword [0x411ad0]
call fcn.00408298
pop ecx
pop ecx
push dword [0x411ad0]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x104
push dword [0x411ac8]
push dword [0x411acc]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
push dword [0x411ac8]
call edi
call fcn.00406456
call fcn.00406ddb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10