Function at 0x415800
Capabilities:
Get file attributes
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x3c], 0x124ea
mov dword [ebp - 0xc], 0x2205
mov dword [ebp - 0x30], 0x6578
mov dword [ebp - 0x24], 0x8575
mov dword [ebp - 0x84], 0x2ca9
mov dword [ebp - 0x74], 0x9352
mov dword [ebp - 0x5c], 0x1222a
mov dword [ebp - 0x28], 0xab2c
mov dword [ebp - 0x70], 0x142a5
mov dword [ebp - 0x18], 0x5bab
mov dword [ebp - 0x88], 0xdc51
mov dword [ebp - 0x20], 0x134e2
mov dword [ebp - 0x68], 0x1271e
mov dword [ebp - 0x1c], 0xbe75
mov dword [ebp - 0x48], 0x2046
mov dword [ebp - 4], 0x12867
mov dword [ebp - 0x38], 0x832c
mov dword [ebp - 0x2c], 0x1282b
mov dword [ebp - 0x14], 0x10dd2
mov dword [ebp - 0x80], 0x9bf8
mov dword [ebp - 0x10], 0x3bde
mov dword [ebp - 0x34], 0x15b68
mov dword [ebp - 8], 0x321d
mov dword [ebp - 0x6c], 0x15b0d
cmp dword [ebp - 0x20], 0x134e3
jge 0x41591c
mov eax, dword [ebp - 4]
or eax, dword [ebp - 0x34]
je 0x415911
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x415911
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x2c]
jne 0x415911
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x24]
jne 0x415911
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 8]
jne 0x415911
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x18]
jne 0x415911
push 0xeaf4
push 0xc16e
push 0x134aa
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
add esp, 0xc
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x4158b7
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x24]
jge 0x415931
mov dword [ebp - 0x40], 1
jmp 0x415938
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1c]
jge 0x415949
mov dword [ebp - 0x44], 1
jmp 0x415950
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x40]
or ecx, dword [ebp - 0x44]
je 0x41598f
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x18]
jne 0x41598f
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp + 8]
jne 0x41598f
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp + 0x14]
jne 0x41598f
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jne 0x41598f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x30]
jne 0x41598f
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0xc]
jge 0x4159a0
mov dword [ebp - 0x4c], 1
jmp 0x4159a7
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jge 0x4159bb
mov dword [ebp - 0x50], 1
jmp 0x4159c2
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x4c]
or ecx, dword [ebp - 0x50]
je 0x415a17
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 8]
jge 0x4159db
mov dword [ebp - 0x54], 1
jmp 0x4159e2
mov dword [ebp - 0x54], 0
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x74]
jge 0x4159f7
mov dword [ebp - 0x58], 1
jmp 0x4159fe
mov dword [ebp - 0x58], 0
mov ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x70]
and edx, dword [ebp - 0xc]
and ecx, edx
je 0x415a17
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x78]
cmp ecx, dword [ebp - 0x7c]
jge 0x415b4e
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x38]
jne 0x415b4e
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 8]
jne 0x415b4e
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x68]
jne 0x415b4e
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x34]
jne 0x415b4e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x38]
jge 0x415b4e
push 0x1d77
push 0x606e
push 0xa7e0
push 0x42f4
push 0x178f0
call dword [sym.imp.KERNEL32.dll_AllocConsole]
add esp, 0x14
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x5c]
jge 0x415aaa
mov dword [ebp - 0x60], 1
jmp 0x415ab1
mov dword [ebp - 0x60], 0
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x80]
jge 0x415ac2
mov dword [ebp - 0x64], 1
jmp 0x415ac9
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x60]
or eax, dword [ebp - 0x64]
je 0x415b4e
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x20]
jge 0x415b4e
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x68]
jne 0x415b4e
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x84]
jne 0x415b4e
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x6c]
jne 0x415b4e
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x70]
jge 0x415b36
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x24]
jne 0x415b36
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x10]
jne 0x415b36
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
jne 0x415b36
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x74]
jne 0x415b36
mov ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp - 8]
jne 0x415b36
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
push 0x16a7d
push 0xe0b0
push 0x5b20
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
mov esp, ebp
pop ebp
ret