Function at 0x405250
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x423004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Rstrtmgr.dll
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RmStartSession
push eax
call ebx
test eax, eax
je 0x40552b
lea ecx, [ebp - 0x204]
push ecx
push 0
lea ecx, [ebp - 0x208]
push ecx
call eax
test eax, eax
jne 0x40552b
push esi
mov esi, dword [ebp - 0x208]
push str.Rstrtmgr.dll
call edi
push str.RmRegisterResources
push eax
call ebx
test eax, eax
je 0x405515
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push esi
call eax
test eax, eax
jne 0x405515
mov esi, dword [ebp - 0x208]
push str.Rstrtmgr.dll
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], eax
call edi
push str.RmGetList
push eax
call ebx
test eax, eax
je 0x4054e3
lea ecx, [ebp - 0x210]
push ecx
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x214]
push ecx
push esi
call eax
cmp eax, 0xea
jne 0x4054e3
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x4054e3
xor ecx, ecx
mov edx, 0x29c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040c23e
mov esi, eax
add esp, 4
mov dword [ebp - 0x21c], esi
test esi, esi
jne 0x405392
mov ecx, dword [ebp - 0x208]
call fcn.00406460
lea eax, [esi - 4]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040822b
mov esp, ebp
pop ebp
ret
push 0x29c
push 0
push esi
call fcn.00409260
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x214]
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00406420
add esp, 0x18
test eax, eax
je 0x4053fc
push esi
call fcn.0040c239
mov ecx, dword [ebp - 0x208]
add esp, 4
call fcn.00406460
pop esi
pop edi
mov eax, 0xfffffffb
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040822b
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [ebp - 0x20c], ebx
jbe 0x40547a
mov edi, esi
nop dword [eax + eax]
mov eax, dword [edi + 0x28c]
cmp eax, 4
je 0x40545f
cmp eax, 0x3e8
je 0x40545f
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x40545f
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x40545f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 0x29c
cmp ebx, dword [ebp - 0x20c]
jb 0x405410
mov esi, dword [ebp - 0x21c]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [ebp - 0x208]
push str.Rstrtmgr.dll
mov dword [ebp - 0x21c], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RmShutdown
push eax
call ebx
test eax, eax
je 0x4054ab
push 0
push 1
push dword [ebp - 0x21c]
call eax
push esi
call fcn.0040c239
mov esi, dword [ebp - 0x208]
add esp, 4
push str.Rstrtmgr.dll
call edi
push str.RmEndSession
push eax
call ebx
test eax, eax
je 0x4054d0
push esi
call eax
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040822b
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x208]
push str.Rstrtmgr.dll
call edi
push str.RmEndSession
push eax
call ebx
test eax, eax
je 0x4054ff
push esi
call eax
pop esi
pop edi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040822b
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040822b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop ebx
call fcn.0040822b
mov esp, ebp
pop ebp
ret