Function at 0x426d1a
Capabilities:
Terminate process

Disassembly:
mov eax, 0x4e8fcd
call fcn.004b48a0
sub esp, 0x30
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x30], ecx
inc edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], ebx
call fcn.00449480
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x30]
push edi
mov dword [ebp - 0x3c], eax
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.00454330
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], eax
mov byte [ebp - 0x1c], bl
jmp 0x426e0c
push 6
lea eax, [ebp + 8]
push eax
push str.force
call fcn.0044b960
add esp, 0xc
test al, al
je 0x426d8e
or byte [ebp - 0x1c], 1
jmp 0x426e09
push 5
push dword [ebp + 8]
push 0x4f5b68
call fcn.004449d0
add esp, 0xc
test al, al
jne 0x426e96
push 0xa
push dword [ebp + 8]
push str.exitcode
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x426def
add dword [ebp + 8], 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
movzx eax, word [eax]
push eax
call fcn.00423b98
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0044ce90
add esp, 0xc
cmp byte [ebp - 0xd], bl
je 0x426e09
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
jmp 0x426e09
push 9
lea eax, [ebp + 8]
push eax
push str.explorer
call fcn.0044b960
add esp, 0xc
test al, al
je 0x426e16
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
je 0x426d71
mov esi, 0x51d5ec
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], 0x8000
call fcn.00423c1d
cmp byte [ebp - 0x1c], bl
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 2
jne 0x426e4c
push esi
mov dword [ebp - 0x18], ebx
call edi
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
jne 0x426f13
add dword [ebp + 8], 2
lea ecx, [ebp + 8]
call fcn.0041edaf
mov ecx, dword [ebp + 8]
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.00423b98
add esp, 4
test al, al
jne 0x426ee4
lea ecx, [ebp - 0x1c]
call fcn.00423c51
cmp dword [ebp - 0x18], ebx
je 0x426e8c
push dword [ebp - 0x18]
call edi
mov ebx, 0x80070057
jmp 0x426fc0
mov esi, 0x51d5ec
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [0x51d638], 8
jne 0x426ec0
or byte [0x51d638], 8
push 2
push str.SeShutdownPrivilege
call fcn.004226a0
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x38]
call fcn.00423c1d
push ebx
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
lea ecx, [ebp - 0x38]
call fcn.00423c51
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x426fc0
mov ax, word [ecx]
cmp ax, bx
je 0x426eff
cmp ax, 0x30
jb 0x426ef8
cmp ax, 0x39
jbe 0x426eff
inc ecx
inc ecx
mov dword [ebp + 8], ecx
jmp 0x426ee4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0044ce90
pop ecx
pop ecx
mov dword [ebp + 8], ebx
jmp 0x426f4f
push dword [ebp + 8]
call fcn.004201fa
push eax
call fcn.00422077
pop ecx
mov dword [ebp + 8], eax
cmp word [eax], bx
pop ecx
je 0x426e7a
cmp dword [ebp + 8], ebx
je 0x426f47
push ebx
push ebx
push ebx
push 0x10
push dword [ebp + 8]
call fcn.00426786
add esp, 0x14
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3c], eax
je 0x426f7e
cmp dword [ebp - 0x14], ebx
je 0x426f7e
push dword [ebp - 0x14]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x426f7e
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x426f77
mov dword [ebp - 0x38], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], ebx
je 0x426fab
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x426fab
cmp dword [ebp - 0x34], eax
jne 0x426f99
mov ecx, dword [ebp - 0x30]
push 1
call fcn.0042072b
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x34], eax
jle 0x426fab
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jg 0x426f2f
lea ecx, [ebp - 0x1c]
call fcn.00423c51
cmp dword [ebp - 0x18], ebx
je 0x426fbd
push dword [ebp - 0x18]
call edi
mov ebx, dword [ebp - 0x38]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443880
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4