Function at 0x41716a
Capabilities:
Shutdown system

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x308
push ebx
push esi
push edi
push dword [0x42478c]
xor ebx, ebx
xor eax, eax
lea esi, [ebp + 0x58]
mov byte [ebp + 0x6f], bl
call fcn.0040daff
test al, al
je 0x4171b4
mov eax, dword [ebp + 0x5c]
push dword [ebp + 0x58]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
call fcn.00416e02
mov dword [ebp + 0x64], eax
cmp eax, ebx
jne 0x4171ac
mov dword [ebp + 0x68], ebx
lea eax, [ebp + 0x58]
call fcn.0040dba7
cmp dword [ebp + 0x68], 0x1e6
jne 0x41728b
push dword [ebp + 0x64]
call fcn.0041ba35
test al, al
je 0x41744d
push 1
lea eax, [ebp - 0x1c]
push eax
push 0x32901130
call fcn.00416964
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x424768
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, ebx
je 0x417200
call fcn.0040c034
mov dword [ebp + 0x68], eax
jmp 0x417203
mov dword [ebp + 0x68], ebx
cmp dword [ebp + 0x68], ebx
je 0x41744d
lea eax, [ebp - 0x90]
push eax
call fcn.0040ef5c
test byte [ebp - 0x90], 0x20
je 0x417228
or dword [0x424730], 0x10
call fcn.004175e6
test byte [0x424730], 0x10
je 0x417243
push 0x80000000
push 0x14
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 1
lea eax, [ebp - 0x1c]
push eax
push 0x1a43533f
call fcn.00416964
lea eax, [ebp - 0x1c]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, ebx
je 0x417276
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call esi
push 1
call fcn.00416ebf
push dword [ebp + 0x68]
mov byte [ebp + 0x6f], 1
call esi
jmp 0x41744d
cmp dword [ebp + 0x68], 0xc
jne 0x41744d
push 2
push 0x8889347b
call fcn.0041699c
mov dword [ebp + 0x68], eax
cmp eax, ebx
je 0x41743c
push 1
lea eax, [ebp - 0x1c]
push eax
push 0x19367401
call fcn.00416964
lea eax, [ebp - 0x1c]
push eax
call fcn.0040c051
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test al, al
je 0x4172fb
push ebx
push 1
lea eax, [ebp + 0x6f]
push eax
push esi
push 0xffffffffffffffff
mov byte [ebp + 0x6f], bl
call edi
test eax, eax
je 0x4172ee
cmp byte [ebp + 0x6f], 0xe9
je 0x4172fb
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4172d5
mov eax, dword [0x424734]
push 0x16
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
cmp eax, 1
jne 0x41731c
call fcn.0041be04
mov byte [ebp + 0x6f], al
jmp 0x417434
push ebx
push 1
lea eax, [ebp + 0x6f]
push eax
push esi
push 0xffffffffffffffff
mov byte [ebp + 0x6f], bl
call edi
test eax, eax
je 0x41738a
cmp byte [ebp + 0x6f], 0xe9
jne 0x41738a
lea eax, [ebp + 0x60]
push eax
push 0x78f16360
push 0x424b9e
call esi
cmp eax, 1
jne 0x41738a
mov eax, dword [ebp + 0x64]
push dword [eax + 8]
mov edi, fcn.0041baec
push dword [eax + 4]
call fcn.0040ecbd
push dword [ebp + 0x78]
mov ecx, dword [ebp + 0x60]
lea eax, [ebp - 0x298]
mov esi, 0x424790
push eax
mov edx, esi
call fcn.0041baec
push 0x8000
push ebx
push dword [ebp + 0x60]
mov byte [ebp + 0x6f], al
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4173b1
mov eax, dword [ebp + 0x64]
push dword [eax + 8]
mov edi, fcn.0041b77b
push dword [eax]
call fcn.0040ecbd
mov esi, 0x424790
lea edx, [ebp - 0x298]
mov ecx, esi
call fcn.0041b77b
mov byte [ebp + 0x6f], al
cmp byte [ebp + 0x6f], 1
jne 0x417434
lea eax, [ebp + 0x48]
push eax
push ebx
push esi
push ebx
lea eax, [ebp - 0x298]
push eax
call fcn.00409fcc
test eax, eax
setne byte [ebp + 0x6f]
cmp byte [ebp + 0x6f], bl
je 0x417434
push 1
lea eax, [ebp - 0x1c]
push eax
push 0x1a43533f
call fcn.00416964
lea eax, [ebp - 0x1c]
push eax
push ebx
push 1
push 0x424768
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [ebp + 0x48]
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], edi
push 0xffffffffffffffff
cmp eax, ebx
jne 0x41740f
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x41741c
push ebx
lea eax, [ebp + 0x5c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x5c], ebx
je 0x41742c
push dword [ebp + 0x5c]
call esi
push dword [ebp + 0x4c]
call esi
push edi
call esi
push dword [ebp + 0x68]
call fcn.0040c024
cmp byte [ebp + 0x7c], 1
jne 0x41744d
push dword [0x42478c]
call fcn.0040a16a
push dword [ebp + 0x64]
call fcn.0040871d
mov al, byte [ebp + 0x6f]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8