Function at 0x402350
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x35c
push ebx
push ebp
mov ebp, dword [esp + 0x368]
push esi
push 0x4105a0
push ebp
mov byte [esp + 0x34], 0
call fcn.004065d0
add esp, 8
test eax, eax
mov al, byte [0x410110]
sete bl
test al, 8
jne 0x4023ff
mov eax, dword [0x40d3f4]
push eax
push 1
push 0x410480
push 0x40fffc
push str.PsShutdownSvc
push str.PSSDNSVC.EXE
push str.PsShutdownSvc
push 0x40d738
push ebp
push 1
call fcn.00401900
add esp, 0x28
test al, al
jne 0x4023ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x52e
je 0x4023f0
test bl, bl
mov eax, str.The_local_system
jne 0x4023ce
mov eax, ebp
push eax
push str._nIf__s_is_already_performing_a_shutdown_operation_you_must_n
push 0x40e858
call fcn.004034a4
push str.abort_it_before_issuing_a_different_command._n_n
push 0x40e858
call fcn.004034a4
add esp, 0x14
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x35c
ret
call fcn.00401440
test bl, bl
mov eax, str.local_system
jne 0x40240f
mov eax, ebp
push eax
push str._rConnecting_with_psshutdown_service_on__s...
push 0x40e858
call fcn.004034a4
add esp, 0xc
mov eax, 0x40d684
test bl, bl
jne 0x40242d
mov eax, ebp
push eax
lea ecx, [esp + 0x268]
push str._spipepsshutdownsvc
push ecx
call fcn.00403452
add esp, 0xc
lea edx, [esp + 0x264]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402496
call fcn.00401440
test bl, bl
mov eax, str.local_system
jne 0x402477
mov eax, ebp
push eax
push str._rError_establishing_communication_with_psshutdown_service_on__s:_n
push 0x40e858
call fcn.004034a4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x402796
call fcn.00401440
mov eax, dword [0x410110]
mov ecx, dword [0x40d3f8]
mov dword [esp + 0x44], eax
mov eax, dword [0x410104]
test eax, eax
mov dword [esp + 0x25c], ecx
jge 0x402503
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x3c]
and eax, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 4
mov ecx, eax
mov eax, dword [esp + 0x3e]
and eax, 0xffff
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, dword [0x410104]
neg edx
shl edx, 2
sub edx, ecx
sub edx, eax
mov dword [esp + 0x150], edx
jmp 0x40250a
mov dword [esp + 0x150], eax
mov al, byte [0x4106a4]
mov ecx, dword [0x410114]
mov byte [esp + 0x48], al
mov eax, dword [0x410108]
test eax, eax
mov dword [esp + 0x258], ecx
jne 0x40252e
mov eax, 0x410118
push 0x104
lea edx, [esp + 0x4d]
push eax
push edx
call fcn.00404450
lea eax, [esp + 0x160]
push eax
call fcn.00402270
add esp, 0x10
lea ecx, [esp + 0x30]
lea edx, [esp + 0x44]
push 0
push ecx
push 0x220
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402599
call fcn.00401440
test bl, bl
mov eax, str.local_system
jne 0x40257a
mov eax, ebp
push eax
push str._rError_communicating_with_psshutdown_service_on__s:_n
push 0x40e858
call fcn.004034a4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x402796
lea eax, [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0x4c]
push 0x220
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4025f8
call fcn.00401440
mov al, byte [0x410110]
mov ecx, str.locked
test al, 1
jne 0x4025cd
mov ecx, str.shutdown
test bl, bl
mov eax, str.local_system
jne 0x4025d8
mov eax, ebp
push ecx
push eax
push str._rError_communicating_with_psshutdown_service_on__s._The_system_may_nnot_have_been__s:_n
push 0x40e858
call fcn.004034a4
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x402796
mov eax, dword [esp + 0x260]
test eax, eax
je 0x4027cc
call fcn.00401440
mov eax, dword [0x410110]
test al, 1
je 0x40262d
mov edx, dword [str.locking]
mov eax, dword [0x40d580]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
jmp 0x402700
test al, 2
je 0x402655
mov ecx, dword [str.rebooting]
mov edx, dword [0x40d574]
mov ax, word [0x40d578]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov word [esp + 0x14], ax
jmp 0x402700
test al, 0x80
je 0x40267b
mov ecx, dword [0x40d564]
mov edx, dword [0x40d568]
mov eax, dword [0x40d56c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jmp 0x402700
test ah, 1
je 0x4026ab
mov ecx, dword [0x40d558]
mov edx, dword [0x40d55c]
mov ax, word [0x40d560]
mov dword [esp + 0xc], ecx
mov cl, byte [0x40d562]
mov dword [esp + 0x10], edx
mov word [esp + 0x14], ax
mov byte [esp + 0x16], cl
jmp 0x402700
test al, 0x10
je 0x4026d8
mov edx, dword [str.powering_off]
mov eax, dword [0x40d54c]
mov ecx, dword [0x40d550]
mov dword [esp + 0xc], edx
mov dl, byte [0x40d554]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], dl
jmp 0x402700
mov eax, dword [0x40d538]
mov ecx, dword [0x40d53c]
mov edx, dword [0x40d540]
mov dword [esp + 0xc], eax
mov ax, word [0x40d544]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov word [esp + 0x18], ax
test bl, bl
mov eax, str.local_system
jne 0x40270b
mov eax, ebp
lea ecx, [esp + 0xc]
push eax
push ecx
push str._rError__s__s:_n
push 0x40e858
call fcn.004034a4
mov eax, dword [0x410110]
mov ecx, dword [esp + 0x270]
add esp, 0x10
test al, 1
je 0x402758
cmp ecx, 1
jne 0x402758
test bl, bl
mov eax, str.The_local_system
jne 0x402743
mov eax, ebp
push eax
push str._s_does_not_support_the_LockWorkStation_API._n_n
push 0x40e858
call fcn.004034a4
add esp, 0xc
jmp 0x40279e
test al, 0x80
jne 0x402761
test ah, 1
je 0x402795
cmp ecx, 1
jne 0x402795
test cl, ah
mov ecx, 0x40d4f0
jne 0x402774
mov ecx, str.hibernation
test bl, bl
mov eax, str.The_local_system
jne 0x40277f
mov eax, ebp
push ecx
push eax
push str._s_does_not_support__s._n_n
push 0x40e858
call fcn.004034a4
add esp, 0x10
jmp 0x40279e
push ecx
call fcn.004013b0
add esp, 4
push str.PSSDNSVC.EXE
push str.PsShutdownSvc
push ebp
push 0
call fcn.004015c0
push 0x40d2d0
call fcn.00403e8d
add esp, 0x14
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x35c
ret
mov eax, dword [0x410110]
test al, 8
je 0x4027f3
test bl, bl
mov eax, str.local_system
jne 0x4027e0
mov eax, ebp
push eax
push str.Shutdown_of__s_aborted._n_n
call fcn.00403e8d
add esp, 8
jmp 0x40293d
test al, 1
je 0x402815
test bl, bl
mov eax, str.The_local_system_is
jne 0x402802
mov eax, ebp
push eax
push str._s_locked._n_n
call fcn.00403e8d
add esp, 8
jmp 0x40293d
test al, 4
je 0x402837
test bl, bl
mov eax, str.local_system
jne 0x402824
mov eax, ebp
push eax
push str.Console_logoff_initiated_on__s._n_n
call fcn.00403e8d
add esp, 8
jmp 0x40293d
test al, 2
je 0x40285f
mov edx, dword [str.reboot]
mov ax, word [0x40d460]
mov cl, byte [0x40d462]
mov dword [esp + 0xc], edx
mov word [esp + 0x10], ax
mov byte [esp + 0x12], cl
jmp 0x4028e5
test al, 0x80
je 0x40287f
mov edx, dword [0x40d450]
mov eax, dword [0x40d454]
mov cx, word [0x40d458]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
jmp 0x4028e0
test ah, 1
je 0x402899
mov edx, dword [0x40d4f0]
mov eax, dword [0x40d4f4]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
jmp 0x4028e5
test al, 0x10
je 0x4028c6
mov ecx, dword [str.powering_off]
mov edx, dword [0x40d54c]
mov eax, dword [0x40d550]
mov dword [esp + 0xc], ecx
mov cl, byte [0x40d554]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], cl
jmp 0x4028e5
mov edx, dword [str.shut_down]
mov eax, dword [0x40d448]
mov cx, word [0x40d44c]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
push edi
mov edi, dword [esp + 0x154]
mov eax, 0x91a2b3c5
mov esi, 0xe10
mul edi
mov ecx, edx
mov eax, edi
xor edx, edx
div esi
mov eax, 0x88888889
shr ecx, 0xb
mul edx
mov esi, edx
mov eax, edi
xor edx, edx
mov edi, 0x3c
shr esi, 5
div edi
test bl, bl
pop edi
mov eax, str.Local_system
jne 0x402927
mov eax, ebp
push edx
push esi
lea edx, [esp + 0x14]
push ecx
push edx
push eax
push str._s_is_scheduled_to__s_in__02d:_02d:_02d._n_n
call fcn.00403e8d
add esp, 0x18
test byte [0x410110], 0xd
je 0x40294b
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x2c]
push str.PSSDNSVC.EXE
push str.PsShutdownSvc
push ebp
push eax
call fcn.004015c0
add esp, 0x10
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x35c
ret