Function at 0x41d080
Capabilities:
Create thread
Power down monitor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569171
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0xe3c0]
mov eax, dword [ecx]
call dword [eax + 0x23c]
test eax, eax
je 0x41d366
cmp byte [ebp + 8], 0
mov eax, dword [0x5e25d0]
je 0x41d240
test eax, eax
jne 0x41d0f7
push 0x20
call fcn.0053d643
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00476f90
mov dword [ebp - 4], 0xffffffff
mov dword [0x5e25d0], eax
cmp byte [eax + 0xa], 0
je 0x41d163
call fcn.0041d020
mov esi, eax
mov dword [ebp + 8], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41d163
lea ecx, [ebp + 8]
push ecx
call eax
test eax, eax
js 0x41d163
cmp dword [ebp + 8], 0
je 0x41d163
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41d13b
push 0
call eax
test eax, eax
js 0x41d13b
cmp dword [ebp + 8], 0
setne al
mov byte [esi + 0xf], al
mov eax, dword [esi + 0x18]
mov dword [ebp + 8], 0
test eax, eax
je 0x41d15f
lea ecx, [ebp + 8]
push ecx
call eax
test eax, eax
js 0x41d15f
cmp dword [ebp + 8], 0
setne al
mov byte [esi + 0xa], al
jmp 0x41d163
mov byte [esi + 0xa], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x5e25d0]
test eax, eax
jne 0x41d197
push 0x20
call fcn.0053d643
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00476f90
mov dword [0x5e25d0], eax
cmp byte [eax + 0x10], 0
jne 0x41d1c7
mov cl, byte [eax + 0xb]
test cl, cl
je 0x41d20e
cmp byte [eax + 8], 0
jne 0x41d1c7
cmp byte [eax + 6], 0
jne 0x41d1b6
cmp byte [eax + 7], 0
je 0x41d1bc
cmp byte [eax + 0xa], 0
je 0x41d1c7
cmp cl, 1
jne 0x41d20e
cmp byte [eax + 0xa], 0
jne 0x41d20e
mov ecx, edi
call fcn.0044ca00
test eax, eax
jne 0x41d20e
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x41cea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41d1f4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [edi + 0xe8e1], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 2
push 0xf170
push 0x112
push dword [edi + 0xe400]
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [edi + 0xe8e0], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x41d26b
push 0x20
call fcn.0053d643
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00476f90
mov dword [ebp - 4], 0xffffffff
mov dword [0x5e25d0], eax
cmp byte [eax + 0x10], 0
jne 0x41d29b
mov cl, byte [eax + 0xb]
test cl, cl
je 0x41d2cc
cmp byte [eax + 8], 0
jne 0x41d29b
cmp byte [eax + 6], 0
jne 0x41d28a
cmp byte [eax + 7], 0
je 0x41d290
cmp byte [eax + 0xa], 0
je 0x41d29b
cmp cl, 1
jne 0x41d2cc
cmp byte [eax + 0xa], 0
jne 0x41d2cc
mov ecx, edi
call fcn.0044ca00
test eax, eax
jne 0x41d2cc
push eax
push str.blackscreen
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41d2c3
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [edi + 0xe8e1], 0
jmp 0x41d32f
push 0xffffffffffffffff
push 0xf170
push 0x112
push dword [edi + 0xe400]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
push 1
push 0
push 1
call esi
push 0x28
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0xffffffffffffffff
push 0
push 1
call esi
push 0
push str.blackscreen
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41d328
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [edi + 0xe8e0], 0
mov eax, dword [0x5e25d0]
test eax, eax
jne 0x41d35f
push 0x20
call fcn.0053d643
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.00476f90
mov dword [ebp - 4], 0xffffffff
mov dword [0x5e25d0], eax
mov ecx, eax
call fcn.004772f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4