Function at 0x415d1b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1c], ecx
inc ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
call fcn.0042460b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x28], eax
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0043dcfa
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
cmp word [eax], 0x2a
mov byte [ebp - 0xc], 0
je 0x415df2
mov esi, 0x48b5d4
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], 0x8000
call fcn.0040e5ee
cmp byte [ebp - 0xc], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jne 0x415da1
push esi
mov dword [ebp - 8], edi
call ebx
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
jne 0x415f19
add dword [ebp + 8], 2
lea ecx, [ebp + 8]
call fcn.0040e58b
mov ecx, dword [ebp + 8]
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.0040e5a7
add esp, 4
test al, al
jne 0x415eea
lea ecx, [ebp - 0xc]
call fcn.0040e622
cmp dword [ebp - 8], edi
je 0x415de5
push dword [ebp - 8]
call ebx
mov esi, 0x80070057
jmp 0x415fc6
xor ebx, ebx
inc ebx
push 6
lea eax, [ebp + 8]
push eax
push str.force
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x415e0f
or byte [ebp - 0xc], 1
jmp 0x415e88
push 5
push dword [ebp + 8]
push str.svr2
call fcn.004257a3
add esp, 0xc
test al, al
jne 0x415e9a
push 0xa
push dword [ebp + 8]
push str.exitcode
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x415e6a
add dword [ebp + 8], 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], edi
movzx eax, word [eax]
push eax
call fcn.0040e5a7
mov bl, al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0042e410
add esp, 0xc
test bl, bl
je 0x415e88
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x415e88
push 9
lea eax, [ebp + 8]
push eax
push str.explorer
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x415d6e
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
je 0x415def
jmp 0x415d6e
mov esi, 0x48b5d4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [0x48b16c], 8
jne 0x415ec4
or byte [0x48b16c], 8
push 2
push str.SeShutdownPrivilege
call fcn.0040c09f
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x24]
call fcn.0040e5ee
push edi
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
lea ecx, [ebp - 0x24]
call fcn.0040e622
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
jmp 0x415fc6
mov ax, word [ecx]
cmp ax, di
je 0x415f05
cmp ax, 0x30
jb 0x415efe
cmp ax, 0x39
jbe 0x415f05
inc ecx
inc ecx
mov dword [ebp + 8], ecx
jmp 0x415eea
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0042e410
pop ecx
pop ecx
mov dword [ebp + 8], edi
jmp 0x415f55
push dword [ebp + 8]
call fcn.0040a93c
push eax
call fcn.00412d51
pop ecx
mov dword [ebp + 8], eax
cmp word [eax], di
pop ecx
je 0x415dd3
cmp dword [ebp + 8], edi
je 0x415f4d
push edi
push edi
push edi
push 0x10
push dword [ebp + 8]
call fcn.00410b32
add esp, 0x14
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x28], eax
je 0x415f84
cmp dword [ebp - 4], edi
je 0x415f84
push dword [ebp - 4]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x415f84
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x415f7d
mov dword [ebp - 0x24], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], edi
je 0x415fb1
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x415fb1
cmp dword [ebp - 0x20], eax
jne 0x415f9f
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0040ac88
mov eax, dword [ebp - 4]
cmp eax, edi
mov dword [ebp - 0x20], eax
jle 0x415fb1
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x415f35
lea ecx, [ebp - 0xc]
call fcn.0040e622
cmp dword [ebp - 8], edi
je 0x415fc3
push dword [ebp - 8]
call ebx
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.00424686
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4