Function at 0x4053e0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x428004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Rstrtmgr.dll
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RmStartSession
push eax
call ebx
test eax, eax
je 0x405689
lea ecx, [ebp - 0x204]
push ecx
push 0
lea ecx, [ebp - 0x208]
push ecx
call eax
test eax, eax
jne 0x405689
push esi
mov esi, dword [ebp - 0x208]
push str.Rstrtmgr.dll
call edi
push str.RmRegisterResources
push eax
call ebx
test eax, eax
je 0x405557
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push esi
call eax
test eax, eax
jne 0x405557
mov esi, dword [ebp - 0x208]
push str.Rstrtmgr.dll
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], eax
call edi
push str.RmGetList
push eax
call ebx
test eax, eax
je 0x405656
lea ecx, [ebp - 0x210]
push ecx
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x214]
push ecx
push esi
call eax
cmp eax, 0xea
jne 0x405656
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x405656
xor ecx, ecx
mov edx, 0x29c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040d6b1
mov esi, eax
add esp, 4
mov dword [ebp - 0x21c], esi
test esi, esi
je 0x40554c
push 0x29c
push 0
push esi
call fcn.0040a6b0
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x214]
mov ecx, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00406c30
add esp, 0x18
test eax, eax
je 0x40556a
push esi
call fcn.0040d6ac
add esp, 4
mov ecx, dword [ebp - 0x208]
call fcn.00406c70
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096d4
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [ebp - 0x20c], ebx
jbe 0x4055ea
mov edi, esi
nop word [eax + eax]
mov eax, dword [edi + 0x28c]
cmp eax, 4
je 0x4055cf
cmp eax, 0x3e8
je 0x4055cf
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x4055cf
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x4055cf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 0x29c
cmp ebx, dword [ebp - 0x20c]
jb 0x405580
mov esi, dword [ebp - 0x21c]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [ebp - 0x208]
push str.Rstrtmgr.dll
mov dword [ebp - 0x21c], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RmShutdown
push eax
call ebx
test eax, eax
je 0x40561b
push 0
push 1
push dword [ebp - 0x21c]
call eax
push esi
call fcn.0040d6ac
mov esi, dword [ebp - 0x208]
add esp, 4
push str.Rstrtmgr.dll
call edi
push str.RmEndSession
push eax
call ebx
test eax, eax
je 0x405640
push esi
call eax
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096d4
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x208]
push str.Rstrtmgr.dll
call edi
push str.RmEndSession
push eax
call ebx
test eax, eax
je 0x405557
push esi
call eax
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004096d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004096d4
mov esp, ebp
pop ebp
ret