Function at 0x43e9e0
Capabilities:
Get hostname
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x50], 0x10
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x43ea68
xor esi, esi
cmp esi, 0x10
jae 0x43ea22
inc esi
cmp byte [esi + 0x4f8af0], 0
jne 0x43ea13
lea eax, [esi + 1]
cmp eax, 0x10
jbe 0x43ea51
push 0x14a
push str.ymemory
push str.YPANIC:_s:_d_n
push 0x14a
push str.ymemory
call fcn.00409950
add esp, 0x14
mov byte [ebp - 0x28], 0
jmp 0x43ea68
push esi
lea eax, [ebp - 0x28]
push 0x4f8af0
push eax
call fcn.00444290
add esp, 0xc
mov byte [ebp + esi - 0x28], 0
xor esi, esi
nop word [eax + eax]
cmp esi, 0x12
jae 0x43ea7f
inc esi
cmp byte [esi + 0x4fb6ec], 0
jne 0x43ea70
lea eax, [esi + 1]
cmp eax, 0x12
jbe 0x43eab0
push 0x14a
push str.ymemory
push str.YPANIC:_s:_d_n
push 0x14a
push str.ymemory
call fcn.00409950
add esp, 0x14
mov byte [ebp - 0x18], 0
xor ecx, ecx
jmp 0x43eadd
push esi
lea eax, [ebp - 0x18]
push 0x4fb6ec
push eax
call fcn.00444290
xor ecx, ecx
mov byte [ebp + esi - 0x18], 0
add esp, 0xc
cmp byte [ebp - 0x18], cl
je 0x43eadd
nop
cmp ecx, 0x12
jae 0x43eadd
inc ecx
cmp byte [ebp + ecx - 0x18], 0
jne 0x43ead0
lea eax, [ecx + 1]
cmp eax, 0x12
jbe 0x43eb08
push 0x162
push str.ymemory
push str.YPANIC:_s:_d_n
push 0x162
push str.ymemory
call fcn.00409950
add esp, 0x14
jmp 0x43eb22
lea eax, [ebp - 0x28]
mov edx, 0x12
push 0x12
push eax
lea eax, [ebp - 0x18]
sub edx, ecx
add ecx, eax
call fcn.0041c8a0
add esp, 8
lea eax, [ebp - 0x58]
push eax
push str.SeShutdownPrivilege
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x43eca4
lea eax, [ebp - 0x4c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43eca4
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x48], 1
push eax
push 0x10
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
push eax
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [ebp - 0x58]
or dword [ebp - 0x2c], 2
push 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x38], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x43ebc6
mov ecx, str.Shutdown:_problem_setting_privileges_n
call fcn.00436650
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, str.Shutdown_in_progress_n
call fcn.00436650
push 1
push 0
push 3
push str.Virtual_hub_is_rebooting_your_computer
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x43eca4
cmp eax, 0x35
jne 0x43ec33
mov ecx, str.Shutdown:_failed_with_code
call fcn.00436650
xor ecx, ecx
call fcn.004365b0
lea ecx, [esi + 0x35]
call fcn.004365b0
mov ecx, str.._Retrying_shutdown_without_providing_a_network_path_n
call fcn.00436650
push 1
push esi
push 3
push str.Virtual_hub_is_rebooting_your_computer
push esi
jmp 0x43ec6d
cmp eax, 5
jne 0x43ec77
mov ecx, str.Shutdown:_failed_with_code
call fcn.00436650
xor ecx, ecx
call fcn.004365b0
mov ecx, 5
call fcn.004365b0
mov ecx, str.._Retrying_shutdown_with_127.0.0.1_n
call fcn.00436650
push 1
push 0
push 3
push str.Virtual_hub_is_rebooting_your_computer
push str.127.0.0.1
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne 0x43eca4
mov ecx, str.Shutdown:_failed_with_code
call fcn.00436650
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, esi
shr ecx, 0x10
call fcn.004365b0
mov ecx, esi
call fcn.004365b0
mov ecx, 0x4f97b0
call fcn.00436650
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004423fe
mov esp, ebp
pop ebp
ret