Function at 0x41d16a
Capabilities:
Check mutex on windows
Shutdown system

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x304
push ebx
push esi
push edi
push dword [0x423a0c]
xor ebx, ebx
xor eax, eax
lea esi, [ebp + 0x50]
mov byte [ebp + 0x6f], bl
call fcn.0040a402
test al, al
je 0x41d1b4
mov eax, dword [ebp + 0x54]
push dword [ebp + 0x50]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
call fcn.0041cde5
mov dword [ebp + 0x60], eax
cmp eax, ebx
jne 0x41d1ac
mov dword [ebp + 0x68], ebx
lea eax, [ebp + 0x50]
call fcn.0040a4aa
cmp dword [ebp + 0x68], 0x1e6
jne 0x41d29a
push dword [ebp + 0x60]
call fcn.0040c4a5
test al, al
je 0x41d45b
push 1
lea eax, [ebp - 0x18]
push eax
push 0x32901130
call fcn.0041c946
lea eax, [ebp - 0x18]
push eax
push 1
push 0x4239e8
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
je 0x41d45b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xb7
jne 0x41d218
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x7c], ebx
cmp dword [ebp + 0x7c], ebx
je 0x41d45b
lea eax, [ebp - 0x8c]
push eax
call fcn.0041d56b
test byte [ebp - 0x8c], 0x20
je 0x41d23d
or dword [0x4239b0], 0x10
call fcn.00404ff7
test byte [0x4239b0], 0x10
je 0x41d258
push 0x80000000
push 0x14
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 1
lea eax, [ebp - 0x18]
push eax
push 0x1a43533f
call fcn.0041c946
lea eax, [ebp - 0x18]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
cmp edi, ebx
je 0x41d285
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call esi
push 1
call fcn.0041cea2
push dword [ebp + 0x7c]
mov byte [ebp + 0x6f], 1
call esi
jmp 0x41d45b
cmp dword [ebp + 0x68], 0xc
jne 0x41d45b
push 2
push 0x8889347b
call fcn.0041c97e
mov dword [ebp + 0x5c], eax
cmp eax, ebx
je 0x41d44a
push 1
lea eax, [ebp - 0x18]
push eax
push 0x19367401
call fcn.0041c946
lea eax, [ebp - 0x18]
push eax
call fcn.004089c9
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test al, al
je 0x41d30a
push ebx
push 1
lea eax, [ebp + 0x6f]
push eax
push esi
push 0xffffffffffffffff
mov byte [ebp + 0x6f], bl
call edi
test eax, eax
je 0x41d2fd
cmp byte [ebp + 0x6f], 0xe9
je 0x41d30a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d2e4
mov eax, dword [0x4239b4]
push 0x16
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
cmp eax, 1
jne 0x41d32b
call fcn.0040c874
mov byte [ebp + 0x6f], al
jmp 0x41d442
push ebx
push 1
lea eax, [ebp + 0x6f]
push eax
push esi
push 0xffffffffffffffff
mov byte [ebp + 0x6f], bl
call edi
test eax, eax
je 0x41d398
cmp byte [ebp + 0x6f], 0xe9
jne 0x41d398
lea eax, [ebp + 0x68]
push eax
push 0x78f16360
push 0x423e1e
call esi
cmp eax, 1
jne 0x41d398
mov eax, dword [ebp + 0x60]
push dword [eax]
mov edi, fcn.0040c55c
push dword [eax + 8]
call fcn.0040b607
push dword [ebp + 0x78]
mov ecx, dword [ebp + 0x68]
lea eax, [ebp - 0x294]
mov esi, 0x423a10
push eax
mov edx, esi
call fcn.0040c55c
push 0x8000
push ebx
push dword [ebp + 0x68]
mov byte [ebp + 0x6f], al
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41d3bf
mov eax, dword [ebp + 0x60]
push dword [eax]
mov edi, fcn.0040c1f0
push dword [eax + 4]
call fcn.0040b607
mov esi, 0x423a10
lea edx, [ebp - 0x294]
mov ecx, esi
call fcn.0040c1f0
mov byte [ebp + 0x6f], al
cmp byte [ebp + 0x6f], 1
jne 0x41d442
lea eax, [ebp + 0x4c]
push eax
push ebx
push esi
push ebx
lea eax, [ebp - 0x294]
push eax
call fcn.00406aad
test eax, eax
setne byte [ebp + 0x6f]
cmp byte [ebp + 0x6f], bl
je 0x41d442
push 1
lea eax, [ebp - 0x18]
push eax
push 0x1a43533f
call fcn.0041c946
lea eax, [ebp - 0x18]
push eax
push ebx
push 1
push 0x4239e8
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [ebp + 0x4c]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], edi
push 0xffffffffffffffff
cmp eax, ebx
jne 0x41d41d
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x41d42a
push ebx
lea eax, [ebp + 0x64]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x64], ebx
je 0x41d43a
push dword [ebp + 0x64]
call esi
push dword [ebp + 0x50]
call esi
push edi
call esi
push dword [ebp + 0x5c]
call fcn.004089b9
cmp byte [ebp + 0x7c], 1
jne 0x41d45b
push dword [0x423a0c]
call fcn.00406c4b
push dword [ebp + 0x60]
call fcn.004051e6
mov al, byte [ebp + 0x6f]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8