Function at 0x409c20
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [0x44dec0], ebx
je 0x40a2c9
push esi
mov esi, 0xcb
cmp dword [0x44e054], ebx
je 0x409c99
cmp byte [0x44df26], bl
je 0x40a2c8
push 1
push ebx
push ebx
push ebx
push 2
mov byte [0x44df26], bl
mov dword [0x44e060], ebx
call fcn.00409bf0
add esp, 0x14
mov dword [0x44e054], ebx
mov dword [0x44f6c4], 1
mov dword [0x44f6bc], 0xffffffff
mov dword [0x44e064], ebx
mov dword [0x44e068], ebx
mov dword [0x44e070], 0xa
jmp 0x409cc6
cmp byte [0x450ed5], bl
je 0x409cc0
mov eax, dword [0x44e06c]
inc eax
cmp eax, 0xe10
mov dword [0x44e06c], eax
jle 0x409cc6
mov dword [0x44e054], esi
mov byte [0x44df26], 1
mov dword [0x44e06c], ebx
mov eax, dword [0x44dec0]
mov ecx, dword [eax + 0x18fc]
test ecx, ecx
je 0x409d27
mov eax, dword [0x44e064]
cmp eax, 0x64
jne 0x409d1b
cmp dword [0x44e068], 2
jne 0x409d12
mov dword [0x44e054], esi
inc eax
pop esi
mov byte [0x44df26], 1
mov byte [0x450ed5], 1
mov dword [0x450ec8], 0x191
mov dword [0x44e064], eax
pop ebx
add esp, 0x14
ret
inc dword [0x44e068]
or eax, 0xffffffff
inc eax
pop esi
mov dword [0x44e064], eax
pop ebx
add esp, 0x14
ret
push edi
mov dword [0x44e064], ebx
mov dword [0x44e068], ebx
mov edi, 4
cmp byte [0x44f6af], bl
je 0x409e09
cmp dword [0x44e054], 3
je 0x409e09
cmp dword [0x44e278], 0x96
jge 0x409d74
call fcn.00424310
lea esi, [edi - 3]
test al, al
jne 0x409dbb
cmp dword [0x44f6b0], esi
jl 0x409dbb
jmp 0x409d79
mov esi, 1
cmp dword [0x44e278], 0x96
mov dword [0x44f6b0], ebx
jl 0x409dae
mov eax, dword [0x44e27c]
add eax, esi
cmp eax, 0x16
mov dword [0x44e278], ebx
mov dword [0x44e27c], eax
jle 0x409dae
mov dword [0x44e27c], ebx
mov dword [0x44e050], ebx
push esi
push ebx
push ebx
push ebx
push edi
call fcn.00409bf0
add esp, 0x14
mov ecx, dword [0x44dd48]
cmp ecx, ebx
je 0x409e14
push 0x31
push 0x384
call fcn.00402510
test eax, eax
je 0x409e0e
mov eax, dword [0x44e278]
add dword [0x44f6b0], esi
add eax, esi
mov dword [0x44e278], eax
cmp eax, esi
jne 0x409e0e
cmp dword [0x44e050], ebx
jne 0x409e0e
push esi
push ebx
push ebx
push ebx
push 6
mov dword [0x44e050], esi
call fcn.00409bf0
add esp, 0x14
jmp 0x409e0e
mov esi, 1
mov ecx, dword [0x44dd48]
mov eax, dword [0x44f6c4]
cmp eax, 0xf
ja case.0x409e22.6
jmp dword [eax*4 + 0x40a2d0]
mov esi, dword [0x44f6bc]
cmp esi, ebx
jne 0x409e3d
mov dword [0x44e070], 0xa
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 4
sub edx, eax
add edx, edx
add edx, edx
mov eax, esi
sub eax, edx
jne 0x40a2b8
sub dword [0x44e070], 1
jne 0x40a2b8
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44e054], ebx
mov dword [0x44f6c4], 3
pop ebx
add esp, 0x14
ret
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 2
pop ebx
add esp, 0x14
ret
mov esi, 0xfffffff6
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 3
pop ebx
add esp, 0x14
ret
mov esi, dword [0x44f6bc]
cmp esi, ebx
jne 0x409ee9
push 1
push ebx
push ebx
push ebx
push 1
call fcn.00409bf0
add esp, 0x14
jmp case.0x409e22.6
cmp byte [0x44f6af], bl
jne 0x40a229
mov byte [0x450ed5], 1
mov dword [0x450ec8], 0x1f5
jmp 0x40a2b8
cmp ecx, ebx
je case.0x409e22.6
cmp dword [ecx + 0x9a8], esi
jne 0x409f4b
push esi
push ebx
push ebx
push 5
push 3
mov dword [ecx + 0x9a8], ebx
call fcn.00409bf0
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 5
pop ebx
add esp, 0x14
ret
mov dword [ecx + 0x63c], esi
jmp case.0x409e22.6
mov esi, dword [0x44f6bc]
cmp esi, ebx
jne 0x409f7a
push 1
push ebx
call fcn.00424300
push eax
push 2
push 3
call fcn.00409bf0
add esp, 0x14
jmp case.0x409e22.6
cmp esi, 1
jl 0x40a2b8
cmp dword [ecx + 0x9a4], 2
jne 0x40a2b8
push 1
push ebx
call fcn.00424360
add eax, dword [0x451284]
push eax
push 1
push 3
call fcn.00409bf0
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 6
pop ebx
add esp, 0x14
ret
mov eax, dword [ecx + 0x9a8]
add eax, 0xfffffffc
cmp eax, edi
ja case.0x409e22.6
jmp dword [eax*4 + 0x40a310]
push esi
push ebx
push ebx
push 0x80
push 3
mov dword [0x4512b0], ebx
call fcn.00409bf0
mov ecx, dword [0x44dd48]
add esp, 0x14
mov dword [ecx + 0x9a8], ebx
jmp case.0x409e22.6
mov edx, dword [0x4512b0]
sub edx, dword [0x4512b4]
push esi
push ebx
push edx
push 0x84
push 3
call fcn.00409bf0
mov eax, dword [0x44dd48]
mov dword [eax + 0x9a8], 6
mov ecx, dword [0x44dd48]
add esp, 0x14
mov dword [ecx + 0x9a4], ebx
jmp case.0x409e22.6
cmp dword [ecx + 0x9a4], 0x84
jne case.0x409e22.6
mov eax, dword [0x4512b8]
add eax, dword [0x4512b0]
push esi
mov dword [0x4512b8], eax
sub eax, dword [0x4512b4]
push ebx
push eax
push 0x85
push 3
call fcn.00409bf0
mov edx, dword [0x44dd48]
mov dword [edx + 0x9a8], ebx
mov eax, dword [0x44dd48]
add esp, 0x14
mov dword [eax + 0x9a4], ebx
jmp case.0x409e22.6
push esi
push ebx
push ebx
push 0x81
push 3
call fcn.00409bf0
mov ecx, dword [0x44dd48]
mov dword [ecx + 0x9a8], ebx
mov edx, dword [0x44dd48]
add esp, 0x14
mov dword [edx + 0x9a4], ebx
jmp case.0x409e22.6
mov esi, dword [0x44f6bc]
cmp esi, ebx
jne 0x40a0ec
mov eax, dword [0x44e04c]
push 1
push ebx
push eax
push 3
push 3
call fcn.00409bf0
add esp, 0x14
jmp case.0x409e22.6
cmp esi, 1
jl 0x40a2b8
cmp dword [ecx + 0x9a4], 3
jne 0x40a2b8
push 1
push ebx
call fcn.00424370
push eax
push edi
push 3
call fcn.00409bf0
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 0xb
pop ebx
add esp, 0x14
ret
push esi
mov dword [ecx + 0x9a4], ebx
mov ecx, dword [0x4512b4]
push ebx
push ecx
push 3
push 3
call fcn.00409bf0
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 0x10
pop ebx
add esp, 0x14
ret
push esi
push ebx
mov dword [ecx + 0x9a4], ebx
call fcn.00424370
push eax
push edi
push 3
call fcn.00409bf0
push 0xa
call fcn.004242e0
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
pop ebx
add esp, 0x14
ret
cmp dword [ecx + 0x9a4], edi
jne case.0x409e22.6
push esi
push ebx
push ebx
push 6
push 3
mov dword [ecx + 0x9a4], ebx
call fcn.00409bf0
push 0xc
call fcn.004242e0
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
pop ebx
add esp, 0x14
ret
mov esi, dword [0x44f6bc]
cmp esi, ebx
jl 0x40a2b8
cmp dword [ecx + 0x9a4], edi
jne 0x40a2b8
push 1
push ebx
push ebx
push 6
push 3
mov dword [ecx + 0x9a4], ebx
call fcn.00409bf0
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x44f6bc], esi
pop esi
mov dword [0x44f6c4], 0xc
pop ebx
add esp, 0x14
ret
cmp dword [ecx + 0x9a8], 3
jne case.0x409e22.6
or esi, 0xffffffff
inc esi
mov dword [0x44f6c4], edi
pop edi
mov dword [0x44f6bc], esi
pop esi
pop ebx
add esp, 0x14
ret
push esi
push ebx
push ebx
mov edx, esi
push ebx
push 2
mov word [0x44c078], dx
call fcn.00409bf0
add esp, 0x14
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x14]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0xc]
push ebx
push ebx
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [0x44f6c4], 0xe
push ebx
jne 0x40a2aa
push 5
jmp 0x40a2ac
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, dword [0x44f6bc]
cmp esi, 0xfde8
jge 0x40a2c7
inc esi
mov dword [0x44f6bc], esi
pop edi
pop esi
pop ebx
add esp, 0x14
ret