Function at 0x411ca0
Capabilities:
Shutdown system

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
call fcn.004438e0
mov dword [esp + 0x3c], 0
mov dword [esp], 7
call fcn.00430213
sub esp, 4
test eax, eax
jle 0x411e36
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.0042ffa3
sub esp, 8
call fcn.00443ad0
mov dword [esp], eax
call fcn.004035c0
sub esp, 4
mov ebx, eax
call fcn.00443a30
test ebx, ebx
mov eax, 1
cmovle ebx, eax
call fcn.00443980
call fcn.00443980
lea esi, [ebx - 1]
call fcn.004439d0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], esi
mov dword [esp], 7
call fcn.00430240
sub esp, 0x10
call fcn.00443b50
call fcn.00443a80
mov dword [esp + 4], eax
mov dword [esp], str.WindowsPE
call fcn.00443da0
test eax, eax
je 0x411e50
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.0042ffa3
sub esp, 8
call fcn.00443ad0
mov dword [esp], eax
call fcn.0043ab11
sub esp, 4
mov ebp, eax
mov edi, edx
call fcn.00443a30
xor eax, eax
cmp eax, ebp
sbb eax, edi
jge 0x411e36
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.0042ffa3
sub esp, 8
call fcn.00443ad0
mov dword [esp + 0x4c], eax
mov dword [esp + 4], eax
lea ebp, [esp + 0x4c]
mov dword [esp], ebp
call fcn.00443d50
sub esp, 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x40], 0
mov dword [esp + 4], str.WimGapi.dll
mov dword [esp], 0xffffffff
call fcn.0042fa1f
sub esp, 8
mov edi, eax
test eax, eax
jne 0x411e80
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
call fcn.00443a30
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x34
mov dword [esp + 4], str.PE____.___
mov dword [esp], 0x457870
call fcn.0042cf9d
sub esp, 0xc
cmp eax, 7
jne 0x411d66
jmp 0x411e36
lea eax, [esp + 0x40]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], SysReAllocString
mov eax, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WIMCreateFile
mov dword [esp], edi
call fcn.0042fb31
sub esp, 0x20
mov dword [esp + 8], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 4], str.WIMGetImageCount
mov dword [esp], edi
call fcn.0042fa79
sub esp, 0xc
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.WIMCloseHandle
mov dword [esp], edi
call fcn.0042fa79
sub esp, 0xc
mov dword [esp], edi
call fcn.0042fbaa
sub esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
call fcn.00443a30
mov ecx, dword [esp + 0x28]
test ecx, ecx
jle 0x411e36
mov byte [esp + 0x3b], 0
mov dword [esp + 4], str.Kernel32.dll
mov dword [esp], 0xffffffff
call fcn.0042fa1f
sub esp, 8
mov byte [esp + 0x3b], 0
test eax, eax
jne 0x412440
movzx eax, byte [esp + 0x3b]
cmp al, 1
je 0x412460
mov dword [esp + 4], 0x456a00
lea edi, [esp + 0x3c]
mov dword [esp], edi
call fcn.00443ca0
sub esp, 8
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.0042ffa3
sub esp, 8
call fcn.00443ad0
mov dword [esp + 0x28], eax
call fcn.004439d0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call fcn.00405f60
sub esp, 0x10
call fcn.00443b50
call fcn.00443a80
mov dword [esp + 4], eax
mov dword [esp], 0x45a954
call fcn.00443da0
test eax, eax
jne 0x412480
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0xa
call fcn.0042ffa3
sub esp, 8
call fcn.00443ad0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
call fcn.004438e0
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00443d50
sub esp, 8
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.00443d50
sub esp, 8
mov dword [esp + 0x4c], 0
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00441d70
sub esp, 0xc
call fcn.00443b50
call fcn.00443ad0
mov esi, eax
call fcn.004439d0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00442400
sub esp, 0xc
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.00443b80
sub esp, 8
mov dword [esp], str._create_19B3EFB3_2887_4D9E_B2ED_8F639F0D2967__device__d_Runonce_PE_RAMDISK_SDI
call fcn.00411c10
sub esp, 4
call fcn.00443980
call fcn.00443980
mov dword [esp], str._set_19B3EFB3_2887_4D9E_B2ED_8F639F0D2967_ramdisksdidevice_partition
call fcn.00443c10
sub esp, 4
call fcn.00443980
call fcn.00443980
call fcn.00443980
mov dword [esp + 4], 3
mov dword [esp], 0x45a8d4
call fcn.00443e50
sub esp, 8
call fcn.00443ad0
mov esi, eax
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00404a10
sub esp, 8
call fcn.004439d0
call fcn.00443ad0
mov dword [esp], eax
call fcn.00411c10
sub esp, 4
call fcn.00443a30
mov dword [esp], str._set_19B3EFB3_2887_4D9E_B2ED_8F639F0D2967_ramdisksdipath_WindowsBootDVDPCAT_boot.sdi
call fcn.00411c10
sub esp, 4
mov dword [esp], str._create_125AF0F0_6071_48F5_B9EC_879F2D789937__application_osloader__d_Runonce_PE_PEOS
call fcn.00411c10
sub esp, 4
call fcn.00443980
call fcn.00443980
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_device_ramdisk_
call fcn.00443c10
sub esp, 4
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00441d70
sub esp, 0xc
call fcn.004439d0
mov dword [esp], 0x4538e4
call fcn.00443c10
sub esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00443c10
sub esp, 4
mov dword [esp], str.__19B3EFB3_2887_4D9E_B2ED_8F639F0D2967
call fcn.00443c10
sub esp, 4
call fcn.00443ad0
mov dword [esp], eax
call fcn.00411c10
sub esp, 4
call fcn.00443a30
call fcn.00443980
call fcn.00443980
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_osdevice_ramdisk_
call fcn.00443c10
sub esp, 4
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00441d70
sub esp, 0xc
call fcn.004439d0
mov dword [esp], 0x4538e4
call fcn.00443c10
sub esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00443c10
sub esp, 4
mov dword [esp], str.__19B3EFB3_2887_4D9E_B2ED_8F639F0D2967
call fcn.00443c10
sub esp, 4
call fcn.00443ad0
mov dword [esp], eax
call fcn.00411c10
sub esp, 4
call fcn.00443a30
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
mov dword [esp], 0x45a954
call fcn.00443da0
test eax, eax
je 0x4124f8
mov dword [esp], str._deletevalue_125AF0F0_6071_48F5_B9EC_879F2D789937_path
call fcn.00411c10
sub esp, 4
call fcn.00443980
call fcn.00443980
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_locale
call fcn.00443c10
sub esp, 4
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp], eax
call fcn.004034c0
sub esp, 4
call fcn.004439d0
call fcn.00443ad0
mov dword [esp], eax
call fcn.00411c10
sub esp, 4
call fcn.00443a30
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_detecthal_Yes
call fcn.00411c10
sub esp, 4
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_winpe_Yes
call fcn.00411c10
sub esp, 4
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_SystemRoot_Windows
call fcn.00411c10
sub esp, 4
mov dword [esp], str._bootsequence_125AF0F0_6071_48F5_B9EC_879F2D789937__addfirst
call fcn.00411c10
sub esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
call fcn.00443a30
call fcn.00443980
call fcn.00443980
mov dword [esp], str.Image
call fcn.00443c10
sub esp, 4
call fcn.00443980
call fcn.00443ed0
mov dword [esp + 8], eax
mov dword [esp], ebx
sar ebx, 0x1f
mov dword [esp + 4], ebx
call fcn.00440fa0
sub esp, 0xc
call fcn.004439d0
mov dword [esp], 0x453ec0
call fcn.00443c10
sub esp, 4
call fcn.00443b50
call fcn.00443ad0
mov dword [esp + 8], 0x34
mov dword [esp + 4], eax
mov dword [esp], 0x454c38
call fcn.0042cf9d
sub esp, 0xc
mov ebx, eax
call fcn.00443a30
cmp ebx, 6
jne 0x411e36
call fcn.004438e0
mov dword [esp + 4], 2
mov dword [esp], str.SeShutdownPrivilege
call fcn.0040bd70
sub esp, 8
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], str.Exit
mov dword [esp], 0
call sub.ADVAPI32.dll_InitiateSystemShutdownW
sub esp, 0x14
jmp 0x411e36
lea edx, [esp + 0x3b]
mov dword [esp + 8], edx
mov dword [esp + 4], str.GetFirmwareType
mov dword [esp], eax
call fcn.0042fa79
sub esp, 0xc
jmp 0x411f51
mov dword [esp + 4], 0x455ce0
lea edi, [esp + 0x3c]
mov dword [esp], edi
call fcn.00443ca0
sub esp, 8
jmp 0x411f75
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0043b329
sub esp, 8
mov dword [esp], str.boot_
call fcn.00443c10
sub esp, 4
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0043b465
sub esp, 8
call fcn.004439d0
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00443b80
sub esp, 8
jmp 0x411ff0
call fcn.00443980
call fcn.00443980
mov dword [esp], str._set_125AF0F0_6071_48F5_B9EC_879F2D789937_path
call fcn.00443c10
sub esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00443c10
sub esp, 4
call fcn.00443ad0
mov dword [esp], eax
call fcn.00411c10
sub esp, 4
call fcn.00443a30
jmp 0x4122b3