Function at 0x4388f0
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x94], str.STP_LOCKINGAPPS_
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x64], 0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x42
push 0
lea ecx, [ebp - 0x48]
push ecx
call fcn.0043a830
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
push 0
lea eax, [ebp - 0x74]
push eax
call sub.RstrtMgr.DLL_RmStartSession
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4389c3
mov ecx, dword [ebp - 0x6c]
push ecx
push str.Error_RmStartSession__d_n
call fcn.004145f0
add esp, 8
mov eax, 0xfffffc18
sub eax, dword [ebp - 0x6c]
jmp 0x4390ae
lea edx, [ebp - 0x8c]
push edx
mov eax, dword [0x587490]
push eax
call fcn.004379b0
add esp, 8
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x8c]
push ecx
push str.copy_recorded__d_files_r_n
call fcn.004145f0
add esp, 8
cmp dword [ebp - 0x7c], 0
je 0x4389fe
cmp dword [ebp - 0x8c], 0
jne 0x438a2a
cmp dword [ebp - 0x7c], 0
je 0x438a10
mov edx, dword [ebp - 0x7c]
push edx
call fcn.004397f5
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x74], 0xffffffff
mov eax, 0xfffff830
jmp 0x4390ae
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
mov eax, dword [ebp - 0x74]
push eax
call sub.RstrtMgr.DLL_RmRegisterResources
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x438a8f
mov ecx, dword [ebp - 0x6c]
push ecx
push str.Error_RmRegisterResources__d_n
call fcn.004145f0
add esp, 8
cmp dword [ebp - 0x7c], 0
je 0x438a72
mov edx, dword [ebp - 0x7c]
push edx
call fcn.004397f5
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x74], 0xffffffff
mov eax, 0xfffff448
sub eax, dword [ebp - 0x6c]
jmp 0x4390ae
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x88]
push eax
push str.Current_check__d__nAffectedApps__d__nProcInfoNeeded__d_r_n
call fcn.004145f0
add esp, 0x10
lea ecx, [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x64]
push edx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0x74]
push edx
call sub.RstrtMgr.DLL_RmGetList
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xea
jne 0x438ae2
mov dword [ebp - 0x98], 1
jmp 0x438aec
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x6c], 0
jne 0x438afe
mov dword [ebp - 0xc4], 1
jmp 0x438b08
mov dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0xc4]
push eax
push str.ERROR_SUCCESS___d__ERROR_MORE_DATA___d__Result__d__dwRebootReasons__08x_r_n
call fcn.004145f0
add esp, 0x14
cmp dword [ebp - 0x78], 0
jne 0x438b40
mov dword [ebp - 0xb0], str.A_system_restart_is_not_required
jmp 0x438be3
cmp dword [ebp - 0x78], 1
jne 0x438b55
mov dword [ebp - 0xc0], str.The_current_user_does_not_have_sufficient_privileges_to_shut_down_one_or_more_processes
jmp 0x438bd7
cmp dword [ebp - 0x78], 2
jne 0x438b67
mov dword [ebp - 0xa8], str.One_or_more_processes_are_running_in_another_Terminal_Services_session
jmp 0x438bcb
cmp dword [ebp - 0x78], 4
jne 0x438b79
mov dword [ebp - 0xbc], str.A_system_restart_is_needed_because_one_or_more_processes_to_be_shut_down_are_critical_processes
jmp 0x438bbf
cmp dword [ebp - 0x78], 8
jne 0x438b8b
mov dword [ebp - 0xa0], str.A_system_restart_is_needed_because_one_or_more_services_to_be_shut_down_are_critical_services
jmp 0x438bb3
cmp dword [ebp - 0x78], 0x10
jne 0x438b9d
mov dword [ebp - 0xb8], str.A_system_restart_is_needed_because_the_current_process_must_be_shut_down
jmp 0x438ba7
mov dword [ebp - 0xb8], str.unknown
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
push str.RebootReason__08x__s_r_n
call fcn.004145f0
add esp, 0xc
cmp dword [ebp - 0x6c], 0
jne 0x438c03
jmp 0x438c7f
cmp dword [ebp - 0x6c], 0xea
je 0x438c19
mov edx, dword [ebp - 0x6c]
neg edx
mov dword [ebp - 0x84], edx
jmp 0x438c7f
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x64], 0
je 0x438c3b
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.004397f5
add esp, 4
mov dword [ebp - 0x64], 0
imul edx, dword [ebp - 0x80], 0x29c
push edx
call fcn.0043982d
add esp, 4
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x6c], 0xea
jne 0x438c7f
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0x88]
add ecx, 1
mov dword [ebp - 0x88], ecx
cmp dword [ebp - 0xc8], 3
jb 0x438a8f
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x6c], 0
jne 0x438f67
cmp dword [ebp - 0x80], 0
jbe 0x438f67
mov edx, dword [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], 0
jmp 0x438cbc
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x80]
jae 0x438db0
imul edx, dword [ebp - 0x60], 0x29c
add edx, dword [ebp - 0x64]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [edx + ecx + 0xc]
test edx, edx
je 0x438d1e
imul eax, dword [ebp - 0x60], 0x29c
mov ecx, dword [ebp - 0x64]
lea edx, [ecx + eax + 0xc]
push edx
push str.used_by_application:__S_r_n
call fcn.004145f0
add esp, 8
imul eax, dword [ebp - 0x60], 0x29c
mov ecx, dword [ebp - 0x64]
lea edx, [ecx + eax + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x70]
lea edx, [ecx + eax + 0xf]
mov dword [ebp - 0x70], edx
imul eax, dword [ebp - 0x60], 0x29c
add eax, dword [ebp - 0x64]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [eax + edx + 0x20c]
test eax, eax
je 0x438d7a
imul ecx, dword [ebp - 0x60], 0x29c
mov edx, dword [ebp - 0x64]
lea eax, [edx + ecx + 0x20c]
push eax
push str.used_by_service:__S_r_n
call fcn.004145f0
add esp, 8
imul ecx, dword [ebp - 0x60], 0x29c
mov edx, dword [ebp - 0x64]
lea eax, [edx + ecx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x70]
lea edx, [ecx + eax + 0xb]
mov dword [ebp - 0x70], edx
imul eax, dword [ebp - 0x60], 0x29c
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + eax + 0x290]
push edx
imul eax, dword [ebp - 0x60], 0x29c
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + eax + 0x28c]
push edx
push str.__ApplicationType__d__App_Status__d_r_n
call fcn.004145f0
add esp, 0xc
jmp 0x438cb3
mov eax, dword [ebp - 0x70]
add eax, 0x200
push eax
call fcn.0043982d
add esp, 4
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x94]
push edx
push 0x471370
mov eax, dword [ebp - 0x70]
add eax, 2
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x68]
sub eax, ecx
push eax
mov edx, dword [ebp - 0x5c]
push edx
call fcn.00418fd0
add esp, 0x10
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0
jmp 0x438e09
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x80]
jae 0x438f06
imul edx, dword [ebp - 0x60], 0x29c
add edx, dword [ebp - 0x64]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [edx + ecx + 0xc]
test edx, edx
je 0x438e88
cmp dword [ebp - 0x60], 0
je 0x438e42
mov dword [ebp - 0xb4], 0x471374
jmp 0x438e4c
mov dword [ebp - 0xb4], 0x5874ad
imul eax, dword [ebp - 0x60], 0x29c
mov ecx, dword [ebp - 0x64]
lea edx, [ecx + eax + 0xc]
push edx
mov eax, dword [ebp - 0xb4]
push eax
push str._sapplication:__S
mov ecx, dword [ebp - 0x70]
add ecx, 2
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x68]
sub ecx, edx
push ecx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00418fd0
add esp, 0x14
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
imul ecx, dword [ebp - 0x60], 0x29c
add ecx, dword [ebp - 0x64]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ecx + eax + 0x20c]
test ecx, ecx
je 0x438f01
cmp dword [ebp - 0x60], 0
je 0x438eb8
mov dword [ebp - 0x9c], 0x47138c
jmp 0x438ec2
mov dword [ebp - 0x9c], 0x5874ae
imul edx, dword [ebp - 0x60], 0x29c
mov eax, dword [ebp - 0x64]
lea ecx, [eax + edx + 0x20c]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
push str._sservice:__S
mov eax, dword [ebp - 0x70]
add eax, 2
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x68]
sub eax, ecx
push eax
mov edx, dword [ebp - 0x5c]
push edx
call fcn.00418fd0
add esp, 0x14
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
jmp 0x438e00
mov dword [ebp - 0xa4], 1
mov eax, dword [ebp - 0x68]
push eax
push 0
call fcn.0041e2f0
add esp, 8
push 0x24
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.00439480
add esp, 8
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x438f48
mov edx, dword [ebp - 0x5c]
add edx, 1
push edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.004392f0
add esp, 8
mov ecx, dword [ebp - 0x68]
push ecx
push 0
call fcn.0041e2f0
add esp, 8
mov edx, dword [ebp - 0x68]
push edx
call fcn.004397f5
add esp, 4
jmp 0x439041
cmp dword [ebp - 0x84], 0
je 0x439041
mov dword [ebp - 0x70], 0x800
mov eax, dword [ebp - 0x70]
add eax, 0x200
push eax
call fcn.0043982d
add esp, 4
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x94]
push edx
push 0x4713a0
mov eax, dword [ebp - 0x70]
add eax, 2
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x68]
sub eax, ecx
push eax
mov edx, dword [ebp - 0x5c]
push edx
call fcn.00418fd0
add esp, 0x10
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x84]
push eax
push str.Error_finding_locks__code__d
mov ecx, dword [ebp - 0x70]
add ecx, 2
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x68]
sub ecx, edx
push ecx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00418fd0
add esp, 0x10
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x68]
push ecx
push 0
call fcn.0041e2f0
add esp, 8
push 0x24
mov edx, dword [ebp - 0x68]
push edx
call fcn.00439480
add esp, 8
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x439027
mov eax, dword [ebp - 0x5c]
add eax, 1
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.004392f0
add esp, 8
mov edx, dword [ebp - 0x68]
push edx
push 0
call fcn.0041e2f0
add esp, 8
mov eax, dword [ebp - 0x68]
push eax
call fcn.004397f5
add esp, 4
cmp dword [ebp - 0x7c], 0
je 0x439053
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.004397f5
add esp, 4
cmp dword [ebp - 0x64], 0
je 0x43906c
mov edx, dword [ebp - 0x64]
push edx
call fcn.004397f5
add esp, 4
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x74]
push eax
call sub.RstrtMgr.DLL_RmCancelCurrentTask
mov ecx, dword [ebp - 0x74]
push ecx
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x74], 0xffffffff
cmp dword [ebp - 0x84], 0
je 0x43909c
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0xac], edx
jmp 0x4390a8
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret