Function at 0x421040
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x308
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov byte [esp + 0x1b], dl
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x28]
mov ecx, dword [0x42958c]
push ebx
mov byte [esp + 0x17], bl
call fcn.0041e1ec
test al, al
je 0x421099
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], eax
call fcn.00420c81
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x28]
mov ebp, eax
xor eax, eax
test ebp, ebp
cmove esi, eax
call fcn.0041e294
jmp 0x4210a1
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x24]
cmp esi, 0x1e6
jne 0x4211a4
push 0x407a44
push ebx
push 0x4fa
mov esi, 0x407364
mov edi, 0x407a60
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
mov ecx, ebp
call fcn.00423fa2
test al, al
je 0x421425
xor ebx, ebx
lea edx, [esp + 0x38]
inc ebx
mov ecx, 0x32901130
push ebx
call fcn.00420763
lea edx, [esp + 0x38]
mov ecx, 0x429568
call fcn.0041c52c
mov dword [esp + 0x14], eax
test eax, eax
je 0x421189
lea ecx, [esp + 0x9c]
call fcn.00411e92
test byte [esp + 0x9c], 0x20
je 0x421124
or dword [0x429530], 0x10
call fcn.0040b7ef
test byte [0x429530], 0x10
je 0x42113f
push accept
push 0x14
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebx
lea edx, [esp + 0x3c]
mov ecx, 0x1a43533f
call fcn.00420763
lea eax, [esp + 0x38]
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x421173
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
mov cl, bl
call fcn.00420d49
push dword [esp + 0x14]
mov byte [esp + 0x17], bl
call edi
jmp 0x421425
push 0x407a6c
push 2
push 0x525
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
jmp 0x421425
cmp esi, 0xc
jne 0x421425
push 0x407a90
push ebx
push 0x52c
mov esi, 0x407364
mov edi, 0x407a60
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
mov dl, 2
mov ecx, 0x8889347b
call fcn.0042079c
mov dword [esp + 0x24], eax
test eax, eax
je 0x4213fd
xor ebx, ebx
lea edx, [esp + 0x38]
inc ebx
mov ecx, 0x19367401
push ebx
call fcn.00420763
lea ecx, [esp + 0x38]
call fcn.0041c557
test al, al
je 0x42124b
push 0x407ab4
push 0
push 0x535
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
jmp 0x421226
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call fcn.0041d73e
test al, al
je 0x42121b
push 0x407aec
push 0
push 0x537
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
mov eax, dword [0x429534]
push 0x16
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
cmp eax, ebx
jne 0x421298
push 0x407b20
push 0
push 0x53d
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
call fcn.00424584
push 0x407bac
push 0
push 0x53f
push esi
push edi
mov byte [esp + 0x27], al
call fcn.0041a5ac
add esp, 0x14
jmp 0x4213f2
mov edx, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call fcn.0041d73e
test al, al
je 0x421305
lea eax, [esp + 0x14]
push eax
push 0x78f16360
push 0x42999e
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp eax, ebx
jne 0x421305
push dword [ebp]
mov edx, dword [ebp + 8]
mov ecx, fcn.004240e5
call fcn.0041f5bd
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x114]
push eax
mov edx, 0x429590
call fcn.004240e5
push 0x8000
push 0
push dword [esp + 0x1c]
mov byte [esp + 0x1f], al
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, byte [esp + 0x13]
jmp 0x42132a
push dword [ebp]
mov edx, dword [ebp + 4]
mov ecx, fcn.00423c1f
call fcn.0041f5bd
lea edx, [esp + 0x110]
mov ecx, 0x429590
call fcn.00423c1f
mov byte [esp + 0x13], al
cmp al, 1
jne 0x4213f2
lea eax, [esp + 0x28]
xor edx, edx
push eax
push 0
push 0x429590
lea ecx, [esp + 0x11c]
call fcn.0041a152
test eax, eax
setne byte [esp + 0x13]
test eax, eax
je 0x4213f2
push ebx
lea edx, [esp + 0x3c]
mov ecx, 0x1a43533f
call fcn.00420763
lea eax, [esp + 0x38]
push eax
push 0
push ebx
push 0x429568
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [esp + 0x28]
push 0x407bd4
push 0
push 0x566
push esi
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call fcn.0041a5ac
add esp, 0x14
cmp dword [esp + 0x1c], 0
push 0xffffffffffffffff
jne 0x4213b1
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4213c0
push 0
lea eax, [esp + 0x24]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0x407c18
push 0
push 0x569
push esi
push edi
call fcn.0041a5ac
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
cmp dword [esp + 0x1c], 0
je 0x4213e9
push dword [esp + 0x1c]
call esi
push dword [esp + 0x2c]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x24]
call fcn.0041c519
jmp 0x421413
push 0x407c58
push 2
push 0x577
push esi
push edi
call fcn.0041a5ac
add esp, 0x14
cmp byte [esp + 0x1b], 1
jne 0x421425
mov ecx, dword [0x42958c]
call fcn.0041a304
mov ecx, ebp
call fcn.00418601
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret