Function at 0x4f9368
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x2c]
push eax
push 0x4f95f8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov byte [ebp - 0x15], 0
test byte [ebp - 8], 8
je 0x4f93cd
mov byte [ebp - 0x15], 1
test byte [ebp - 7], 1
je 0x4f9410
mov eax, 0x32
call fcn.004b3380
cmp byte [ebp - 0x15], 1
cmc
sbb eax, eax
push eax
push 0
call sub.kernel32.dll_SetSystemPowerState
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x14
call sub.kernel32.dll_Sleep_1
mov eax, 0x14
call fcn.004b3380
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jne 0x4f93f1
jmp 0x4f95f2
test byte [ebp - 7], 2
je 0x4f9453
mov eax, 0x32
call fcn.004b3380
cmp byte [ebp - 0x15], 1
cmc
sbb eax, eax
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_SetSystemPowerState
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x14
call sub.kernel32.dll_Sleep_1
mov eax, 0x14
call fcn.004b3380
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jne 0x4f9434
jmp 0x4f95f2
test byte [ebp - 7], 4
je 0x4f9474
push 1
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
jmp 0x4f95f2
test byte [ebp - 7], 8
je 0x4f9495
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
jmp 0x4f95f2
test byte [ebp - 7], 0x10
je 0x4f94d1
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2130], 0
je 0x4f95f2
push 2
mov eax, dword [ebp - 4]
call dword [eax + 0x2130]
jmp 0x4f95f2
test byte [ebp - 7], 0x20
je 0x4f94f2
push 0
push 0xf140
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
jmp 0x4f95f2
test byte [ebp - 7], 0x40
je 0x4f9552
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2243], 0
je 0x4f950f
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0052db78
mov eax, dword [ebp - 4]
mov byte [eax + 0x222a], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x222c], 1
mov eax, dword [ebp + 8]
mov byte [eax], 1
cmp dword [ebp - 0xc], 0
je 0x4f9539
mov dword [ebp - 0xc], 1
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x80cc
mov eax, dword [ebp - 4]
call fcn.0045e0f0
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x16], 0
cmp dword [ebp - 8], 0
jne 0x4f9568
mov dword [ebp - 8], 0x10
cmp byte [ebp - 0x15], 0
je 0x4f9572
or dword [ebp - 0x14], 4
test byte [ebp - 8], 0x10
je 0x4f957c
or dword [ebp - 0x14], 9
test byte [ebp - 8], 0x20
je 0x4f9586
or dword [ebp - 0x14], 1
test byte [ebp - 8], 0x40
je 0x4f9590
or dword [ebp - 0x14], 2
test byte [ebp - 8], 0x80
je 0x4f959e
or dword [ebp - 0x14], 0
mov byte [ebp - 0x16], 1
cmp dword [ebp - 0x14], 0
jg 0x4f95aa
cmp byte [ebp - 0x16], 0
je 0x4f95f2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2243], 0
je 0x4f95c1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0052db78
mov eax, dword [ebp - 4]
mov byte [eax + 0x222a], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x222c], 1
mov eax, dword [ebp + 8]
mov byte [eax], 1
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x4f95ec
call fcn.00403a58
push eax
call sub.user32.dll_ExitWindowsEx
mov esp, ebp
pop ebp
ret 4