Function at 0x6e43d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6e4691
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x6e4674
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [esi], 0
mov eax, dword [0x70ad24]
cmp dword [eax], 0
jne 0x6e441a
mov ecx, ebx
mov dl, 1
mov eax, dword [0x60e3b0]
call fcn.00467628
mov edx, dword [0x70ad24]
mov dword [edx], eax
mov eax, dword [0x70ad24]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xe8]
mov eax, dword [0x70ad24]
mov eax, dword [eax]
cmp dword [eax + 0x24c], 1
jne 0x6e45ad
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x160]
mov edx, 0x6e46a8
call fcn.00404e30
jne 0x6e447e
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x6e46b4
call fcn.006787bc
push 0x6e46e4
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
xor ecx, ecx
mov dl, 1
call fcn.00677aec
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x164]
mov edx, 0x6e46a8
call fcn.00404e30
jne 0x6e44ed
mov eax, dword [ebx + 0x3e4]
mov edx, 1
call fcn.00482d40
mov eax, dword [ebx + 0x3e4]
call fcn.00482d28
mov edx, dword [0x70c91c]
mov eax, dword [edx + eax*8]
push eax
mov eax, dword [ebx + 0x3e4]
call fcn.00482d28
mov edx, dword [0x70c91c]
mov eax, dword [edx + eax*8 + 4]
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebx + 0x3e4]
call fcn.00482d28
mov edx, eax
mov eax, ebx
call fcn.006defdc
jmp 0x6e4541
mov eax, dword [ebx + 0x3e4]
mov edx, 2
call fcn.00482d40
mov eax, dword [ebx + 0x3e4]
call fcn.00482d28
mov edx, dword [0x70c91c]
mov eax, dword [edx + eax*8]
push eax
mov eax, dword [ebx + 0x3e4]
call fcn.00482d28
mov edx, dword [0x70c91c]
mov eax, dword [edx + eax*8 + 4]
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebx + 0x3e4]
call fcn.00482d28
mov edx, eax
mov eax, ebx
call fcn.006defdc
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov edx, dword [eax + 0x734]
mov eax, dword [ebx + 0x6fc]
call fcn.0044e62c
lea ecx, [ebp - 4]
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov edx, 0x6e4704
call fcn.0068f058
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.006df9d8
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov edx, dword [eax + 0x734]
mov eax, dword [ebx + 0x3dc]
call fcn.0044e62c
mov dword [ebx + 0x8dc], 1
mov eax, dword [0x70ad24]
mov eax, dword [eax]
mov al, byte [eax + 0x361]
mov byte [esi], al
jmp 0x6e465d
push 0x6e4720
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
xor ecx, ecx
mov dl, 1
call fcn.00677aec
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov eax, dword [eax + 0xa74]
mov edx, 0x6e46a8
call fcn.00404e30
jne 0x6e4656
push 0x6e4744
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
xor ecx, ecx
mov dl, 1
call fcn.00677aec
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x38]
test al, al
je 0x6e4614
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x58]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [0x70ae7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
cmp byte [eax + 0x4b], 0
je 0x6e4631
mov edx, dword [0x70ae7c]
xor edx, edx
call fcn.0058e810
call fcn.004dae90
test eax, eax
je 0x6e4646
mov eax, 0xc
call fcn.004daf94
jmp 0x6e464f
push 0
push 5
call sub.user32.dll_ExitWindowsEx
call fcn.00404480
jmp 0x6e467b
mov eax, ebx
call fcn.0046b6bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e467b
mov eax, dword [0x70ad24]
xor edx, edx
mov dword [eax], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e4698
lea eax, [ebp - 4]
call fcn.00404a34
ret