Function at 0x41936d
Capabilities:
Check mutex on windows
Shutdown system

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x304
push ebx
push esi
push edi
push dword [0x42361c]
xor ebx, ebx
xor eax, eax
lea esi, [ebp + 0x50]
mov byte [ebp + 0x6f], bl
call fcn.00415cb0
test al, al
je 0x4193b7
mov eax, dword [ebp + 0x54]
push dword [ebp + 0x50]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
call fcn.00418fec
mov dword [ebp + 0x60], eax
cmp eax, ebx
jne 0x4193af
mov dword [ebp + 0x68], ebx
lea eax, [ebp + 0x50]
call fcn.00415d58
cmp dword [ebp + 0x68], 0x1e6
jne 0x41949d
push dword [ebp + 0x60]
call fcn.0040757a
test al, al
je 0x41965f
push 1
lea eax, [ebp - 0x18]
push eax
push 0x32901130
call fcn.00418b4d
lea eax, [ebp - 0x18]
push eax
push 1
push 0x4235f8
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
je 0x41965f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xb7
jne 0x41941b
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x7c], ebx
cmp dword [ebp + 0x7c], ebx
je 0x41965f
lea eax, [ebp - 0x8c]
push eax
call fcn.004108a8
test byte [ebp - 0x8c], 0x20
je 0x419440
or dword [0x4235c0], 0x10
call fcn.0041d6f8
test byte [0x4235c0], 0x10
je 0x41945b
push accept
push 0x14
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 1
lea eax, [ebp - 0x18]
push eax
push 0x1a43533f
call fcn.00418b4d
lea eax, [ebp - 0x18]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
cmp edi, ebx
je 0x419488
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call esi
push 1
call fcn.004190a9
push dword [ebp + 0x7c]
mov byte [ebp + 0x6f], 1
call esi
jmp 0x41965f
cmp dword [ebp + 0x68], 0xc
jne 0x41965f
push 2
push 0x8889347b
call fcn.00418b85
mov dword [ebp + 0x5c], eax
cmp eax, ebx
je 0x41964e
push 1
lea eax, [ebp - 0x18]
push eax
push 0x19367401
call fcn.00418b4d
lea eax, [ebp - 0x18]
push eax
call fcn.00414273
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test al, al
je 0x41950d
push ebx
push 1
lea eax, [ebp + 0x6f]
push eax
push esi
push 0xffffffffffffffff
mov byte [ebp + 0x6f], bl
call edi
test eax, eax
je 0x419500
cmp byte [ebp + 0x6f], 0xe9
je 0x41950d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4194e7
mov eax, dword [0x4235c4]
push 0x16
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
cmp eax, 1
jne 0x41952e
call fcn.00407949
mov byte [ebp + 0x6f], al
jmp 0x419646
push ebx
push 1
lea eax, [ebp + 0x6f]
push eax
push esi
push 0xffffffffffffffff
mov byte [ebp + 0x6f], bl
call edi
test eax, eax
je 0x41959b
cmp byte [ebp + 0x6f], 0xe9
jne 0x41959b
lea eax, [ebp + 0x68]
push eax
push 0x78f16360
push 0x423a2e
call esi
cmp eax, 1
jne 0x41959b
mov eax, dword [ebp + 0x60]
push dword [eax + 4]
mov edi, fcn.00407631
push dword [eax]
call fcn.00416eb5
push dword [ebp + 0x78]
mov ecx, dword [ebp + 0x68]
lea eax, [ebp - 0x294]
mov esi, 0x423620
push eax
mov edx, esi
call fcn.00407631
push 0x8000
push ebx
push dword [ebp + 0x68]
mov byte [ebp + 0x6f], al
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4195c3
mov eax, dword [ebp + 0x60]
push dword [eax + 4]
mov edi, fcn.004072c5
push dword [eax + 8]
call fcn.00416eb5
mov esi, 0x423620
lea edx, [ebp - 0x294]
mov ecx, esi
call fcn.004072c5
mov byte [ebp + 0x6f], al
cmp byte [ebp + 0x6f], 1
jne 0x419646
lea eax, [ebp + 0x4c]
push eax
push ebx
push esi
push ebx
lea eax, [ebp - 0x294]
push eax
call fcn.00412357
test eax, eax
setne byte [ebp + 0x6f]
cmp byte [ebp + 0x6f], bl
je 0x419646
push 1
lea eax, [ebp - 0x18]
push eax
push 0x1a43533f
call fcn.00418b4d
lea eax, [ebp - 0x18]
push eax
push ebx
push 1
push 0x4235f8
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, dword [ebp + 0x4c]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], edi
push 0xffffffffffffffff
cmp eax, ebx
jne 0x419621
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x41962e
push ebx
lea eax, [ebp + 0x64]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x64], ebx
je 0x41963e
push dword [ebp + 0x64]
call esi
push dword [ebp + 0x50]
call esi
push edi
call esi
push dword [ebp + 0x5c]
call fcn.00414263
cmp byte [ebp + 0x7c], 1
jne 0x41965f
push dword [0x42361c]
call fcn.004124f5
push dword [ebp + 0x60]
call fcn.00410a90
mov al, byte [ebp + 0x6f]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8