Function at 0x409d00
Capabilities:
Shutdown system

Disassembly:
mov ecx, dword [0x461078]
sub esp, 0x1c
push ebx
push ebp
xor ebx, ebx
push esi
push edi
cmp ecx, ebx
je 0x40a383
mov esi, 0xcb
cmp dword [0x461ce4], ebx
je 0x409d7d
cmp byte [0x461bd1], bl
je 0x40a383
push ebx
push ebx
push 2
mov byte [0x461bd1], bl
mov dword [0x461ce8], ebx
call fcn.00402bc0
mov ecx, dword [0x461078]
mov dword [0x461ce4], ebx
mov dword [0x461f10], 1
mov dword [0x461f0c], 0xffffffff
mov dword [0x461cec], ebx
mov dword [0x461cf0], ebx
mov dword [0x461cf8], 0xa
jmp 0x409daa
cmp byte [0x463744], bl
je 0x409da4
mov eax, dword [0x461cf4]
inc eax
cmp eax, 0xe10
mov dword [0x461cf4], eax
jle 0x409daa
mov dword [0x461ce4], esi
mov byte [0x461bd1], 1
mov dword [0x461cf4], ebx
mov eax, dword [ecx + 0x18fc]
test eax, eax
je 0x409e0a
mov eax, dword [0x461cec]
cmp eax, 0x64
jne 0x409dfc
cmp dword [0x461cf0], 2
jne 0x409df3
inc eax
mov dword [0x461ce4], esi
mov byte [0x461bd1], 1
mov byte [0x463744], 1
mov dword [0x461f14], 0x191
mov dword [0x461cec], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
inc dword [0x461cf0]
or eax, 0xffffffff
inc eax
mov dword [0x461cec], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov dword [0x461cec], ebx
mov dword [0x461cf0], ebx
mov ebp, 4
cmp byte [0x461bd3], bl
je 0x409ee7
cmp dword [0x461ce4], 3
je 0x409ee7
mov eax, dword [0x461cfc]
cmp eax, 0x96
jge 0x409e51
cmp byte [0x463769], bl
jne 0x409e8e
cmp dword [0x461f04], 1
jl 0x409e8e
cmp eax, 0x96
mov dword [0x461f04], ebx
jl 0x409e80
mov eax, dword [0x461f00]
inc eax
cmp eax, 0x16
mov dword [0x461cfc], ebx
mov dword [0x461f00], eax
jle 0x409e80
mov dword [0x461f00], ebx
mov dword [0x461ce0], ebx
mov ecx, dword [0x461078]
push ebx
push ebx
push ebp
call fcn.00402bc0
mov edi, dword [0x46100c]
cmp edi, ebx
je 0x409f08
push 0x384
mov esi, 0x31
call fcn.00401cb0
test eax, eax
je 0x409ee7
mov eax, dword [0x461cfc]
mov ecx, 1
add dword [0x461f04], ecx
add eax, ecx
mov dword [0x461cfc], eax
cmp eax, ecx
jne 0x409ee7
cmp dword [0x461ce0], ebx
jne 0x409ee7
mov dword [0x461ce0], ecx
mov ecx, dword [0x461078]
cmp ecx, ebx
je 0x409eed
push ebx
push ebx
push 6
call fcn.00402bc0
mov ecx, dword [0x461078]
mov edi, dword [0x46100c]
mov eax, dword [0x461f10]
cmp eax, 0xf
ja case.0x409f01.6
jmp dword [eax*4 + 0x40a38c]
mov ecx, dword [0x461078]
jmp 0x409ef3
mov esi, dword [0x461f0c]
cmp esi, ebx
jne 0x409f24
mov dword [0x461cf8], 0xa
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, esi
sub edx, ecx
jne 0x40a374
sub dword [0x461cf8], 1
jne 0x40a374
mov dword [0x461ce4], ebx
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 3
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 2
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov esi, dword [0x461f0c]
cmp esi, ebx
jne 0x409fb7
cmp ecx, ebx
je 0x40a37c
push ebx
push ebx
push 1
call fcn.00402bc0
jmp case.0x409f01.6
cmp byte [0x461bd3], bl
jne 0x40a2d3
mov byte [0x463744], 1
mov dword [0x461f14], 0x1f5
jmp 0x40a374
cmp edi, ebx
je case.0x409f01.6
mov eax, 1
cmp dword [edi + 0x444], eax
jne 0x40a01e
mov dword [edi + 0x444], ebx
cmp ecx, ebx
je 0x40a002
push ebx
push 5
push 3
call fcn.00402bc0
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 5
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov dword [edi + 0x408], eax
jmp case.0x409f01.6
mov esi, dword [0x461f0c]
cmp esi, ebx
jne 0x40a067
cmp ecx, ebx
je 0x40a37c
mov edx, dword [0x45f904]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3e8
push eax
push 2
push 3
call fcn.00402bc0
jmp case.0x409f01.6
cmp esi, 1
jl 0x40a374
cmp dword [edi + 0x440], 2
jne 0x40a374
cmp ecx, ebx
je 0x40a098
mov edx, dword [0x463ad0]
mov eax, dword [0x463acc]
add eax, edx
push eax
push 1
push 3
call fcn.00402bc0
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 6
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [edi + 0x444]
add eax, 0xfffffffc
cmp eax, ebp
ja case.0x409f01.6
jmp dword [eax*4 + 0x40a3cc]
mov dword [0x463aec], ebx
cmp ecx, ebx
je 0x40a0e9
push ebx
push 0x80
push 3
call fcn.00402bc0
mov edi, dword [0x46100c]
mov dword [edi + 0x444], ebx
jmp case.0x409f01.6
cmp ecx, ebx
je 0x40a111
mov edx, dword [0x463aec]
push edx
push 0x84
push 3
call fcn.00402bc0
mov edi, dword [0x46100c]
mov dword [edi + 0x444], 6
mov dword [edi + 0x440], ebx
jmp case.0x409f01.6
cmp dword [edi + 0x440], 0x84
jne case.0x409f01.6
cmp ecx, ebx
je 0x40a152
mov eax, dword [0x463af4]
push eax
push 0x85
push 3
call fcn.00402bc0
mov edi, dword [0x46100c]
mov dword [edi + 0x444], ebx
mov dword [edi + 0x440], ebx
jmp case.0x409f01.6
cmp ecx, ebx
je 0x40a152
push ebx
push 0x81
jmp 0x40a145
mov esi, dword [0x461f0c]
cmp esi, ebx
jne 0x40a196
cmp ecx, ebx
je 0x40a37c
mov edx, dword [0x461bdc]
push edx
push 3
push 3
call fcn.00402bc0
jmp case.0x409f01.6
cmp esi, 1
jl 0x40a374
cmp dword [edi + 0x440], 3
jne 0x40a374
cmp ecx, ebx
je 0x40a1be
mov eax, dword [0x463ac0]
push eax
push ebp
push 3
call fcn.00402bc0
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 0xb
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp ecx, ebx
je 0x40a1ee
mov edx, dword [0x463aec]
push edx
push 3
push 3
call fcn.00402bc0
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 0x10
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp ecx, ebx
je 0x40a221
mov eax, dword [0x463ac0]
push eax
push ebp
push 3
call fcn.00402bc0
mov eax, dword [0x461f10]
or esi, 0xffffffff
inc esi
mov dword [0x463748], eax
mov dword [0x461f10], 0xa
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp dword [edi + 0x440], ebp
jne case.0x409f01.6
cmp ecx, ebx
je 0x40a261
push ebx
push 6
push 3
call fcn.00402bc0
mov eax, dword [0x461f10]
or esi, 0xffffffff
inc esi
mov dword [0x463748], eax
mov dword [0x461f10], 0xc
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov esi, dword [0x461f0c]
cmp esi, ebx
jl 0x40a374
cmp dword [edi + 0x440], ebp
jne 0x40a374
cmp ecx, ebx
je 0x40a2aa
push ebx
push 6
push 3
call fcn.00402bc0
or esi, 0xffffffff
inc esi
mov dword [0x461f10], 0xc
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
cmp dword [edi + 0x444], 3
jne case.0x409f01.6
or esi, 0xffffffff
inc esi
mov dword [0x461f10], ebp
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ecx, 1
mov word [0x463778], cx
call fcn.00428a90
mov ecx, dword [0x461078]
cmp ecx, ebx
je 0x40a30f
push ebx
push ebx
push 2
call fcn.00402bc0
lea edx, [esp + 0x14]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [0x461f10], 0xe
push ebx
jne 0x40a366
push 5
jmp 0x40a368
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, dword [0x461f0c]
cmp esi, 0xfde8
jge 0x40a383
inc esi
mov dword [0x461f0c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret