Function at 0x407aa3
Capabilities:
Get common file path
Shutdown system

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x42b028]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x30
mov eax, 0x4163d9
call fcn.00415302
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x14], SysStringLen
call dword [sym.imp.K9PCUhelper.dll_public:_void___thiscall_CRegistry::constructor_struct_HKEY____const_const__]
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.SYSTEMCurrentControlSet_services
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x38], 0x2001f
call dword [0x419724]
push 0x41a268
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [0x419724]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
mov edi, dword [sym.imp.K9PCUhelper.dll_enum_PCO_ERROR_CODES___cdecl_STPathAppend_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
push eax
call edi
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x1c]
call dword [0x419844]
push 1
mov byte [ebp - 4], 3
push dword [ebp - 0x20]
lea ecx, [ebp - 0x3c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::Open_struct_HKEY_____wchar_t_const___bool_]
test eax, eax
je 0x407bd3
lea eax, [ebp - 0x1c]
push eax
mov esi, str.ImagePath
push esi
lea ecx, [ebp - 0x3c]
call dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::ReadString_wchar_t_const___class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____]
push 0x41fd50
lea ecx, [ebp - 0x14]
call dword [0x419724]
push ebx
mov byte [ebp - 4], 4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find]
test eax, eax
jge 0x407bc1
lea ecx, [ebp - 0x10]
call dword [0x419844]
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push 0x41fd54
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
push esi
call dword [sym.imp.K9PCUhelper.dll_public:_int___thiscall_CRegistry::WriteString_wchar_t_const___wchar_t_const___bool_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.K9PCUhelper.dll_public:_void___thiscall_CRegistry::Close_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x18]
call dword [0x419844]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push str.winsxspending.xml
lea ecx, [ebp - 0x14]
call dword [0x419724]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 7
call edi
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.K9PCUhelper.dll_enum_PCO_ERROR_CODES___cdecl_DoesPathExists_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
pop ecx
test eax, eax
je 0x407c54
call dword [sym.imp.K9PCUhelper.dll_unsigned_long_int___cdecl__winmajor_void_]
cmp eax, 5
jbe 0x407c54
push 0x12
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x407c9e
lea eax, [ebp - 0x10]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407c73
push dword [ebp - 0x10]
call fcn.00407a20
push 0x10
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call sub.mfc90u.dll_AfxGetThread
cmp eax, ebx
je 0x407c8f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x407c91
xor eax, eax
push ebx
push ebx
push 0x10
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call dword [sym.imp.K9PCUhelper.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00414918
add ebp, 0x20c
leave
ret