Function at 0x40cea0
Capabilities:
Create restart manager session
Enumerate processes that use resource
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ab4
call fcn.004391b0
mov eax, dword [0x44d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
sub esp, 0x18
mov ecx, esp
push 0x44ebfc
call fcn.0040b2e0
lea eax, [ebp - 0x1a88]
push eax
call fcn.0041b680
push eax
lea eax, [ebp - 0x1ab4]
push eax
call fcn.0041fe60
cmp dword [eax + 0x14], 8
jb 0x40ceea
mov eax, dword [eax]
push eax
call fcn.004206f0
mov ecx, dword [ebp - 0x1aa0]
mov esi, eax
cmp ecx, 8
jb 0x40cf32
mov edx, dword [ebp - 0x1ab4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40cf28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d169
push ecx
push edx
call fcn.00420d4c
add esp, 8
mov ecx, dword [ebp - 0x1a74]
xor eax, eax
mov dword [ebp - 0x1aa4], 0
mov dword [ebp - 0x1aa0], 7
mov word [ebp - 0x1ab4], ax
cmp ecx, 0x10
jb 0x40cf89
mov edx, dword [ebp - 0x1a88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40cf7f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d169
push ecx
push edx
call fcn.00420d4c
add esp, 8
push 0xf84eee59
push esi
mov dword [ebp - 0x1a78], 0
mov dword [ebp - 0x1a74], 0xf
mov byte [ebp - 0x1a88], 0
call fcn.004205c0
push 0x4105fc56
push esi
mov dword [ebp - 0x1a98], eax
call fcn.004205c0
mov esi, eax
lea eax, [ebp - 0x50]
push 0x42
push 0
push eax
mov dword [ebp - 0x1a9c], esi
call fcn.00422790
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0
lea eax, [ebp - 0x1a70]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x40d124
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1a88]
push eax
call fcn.0041fe60
cmp dword [ebp - 0x1a74], 8
lea eax, [ebp - 0x1a88]
push 0
cmovae eax, dword [ebp - 0x1a88]
push 0
push 0
push 0
mov dword [ebp - 0x1a94], eax
lea eax, [ebp - 0x1a94]
push eax
push 1
push dword [ebp - 0x1a70]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x40d0dc
lea eax, [ebp - 0x1a8c]
mov dword [ebp - 0x1a6c], 0xa
push eax
lea eax, [ebp - 0x1a68]
push eax
lea eax, [ebp - 0x1a6c]
push eax
lea eax, [ebp - 0x1a90]
push eax
push dword [ebp - 0x1a70]
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x40d0dc
xor edi, edi
cmp dword [ebp - 0x1a6c], edi
jbe 0x40d0dc
lea ebx, [ebp - 0x1a68]
push dword [ebx]
push 0
push 1
call esi
mov esi, eax
test esi, esi
je 0x40d0c7
push 0
push esi
call dword [ebp - 0x1a98]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40d0b5
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x1a9c]
inc edi
add ebx, 0x29c
cmp edi, dword [ebp - 0x1a6c]
jb 0x40d088
push dword [ebp - 0x1a70]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov ecx, dword [ebp - 0x1a74]
cmp ecx, 8
jb 0x40d124
mov edx, dword [ebp - 0x1a88]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40d11a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d16e
push ecx
push edx
call fcn.00420d4c
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x40d154
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40d14a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d173
push ecx
push edx
call fcn.00420d4c
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004208c0
mov esp, ebp
pop ebp
ret 0x18
call fcn.00427422
call fcn.00427422
call fcn.00427422
int3