Function at 0x4061b0
Capabilities:
Check for time delay via gettickcount
Create thread
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d4c8
push 0x40fb28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov edx, 1
mov byte [ebp - 0x2f], dl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x278], str.NVIconBeginEvent
mov dword [ebp - 0x274], 3
mov dword [ebp - 0x270], 0x4254e8
mov esi, 2
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], str.NVIconEndEvent
mov ecx, 4
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], 0x4254ec
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], str.NVModeSwitchEvent
mov dword [ebp - 0x254], 5
mov dword [ebp - 0x250], 0x4254f0
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], str.NVDisplayChangeEvent
mov dword [ebp - 0x244], 7
mov dword [ebp - 0x240], 0x4254fc
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], str.NVSessionChangeEvent
mov dword [ebp - 0x234], 8
mov dword [ebp - 0x230], 0x425500
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], str.NVDFPOff
mov dword [ebp - 0x224], 9
mov dword [ebp - 0x220], 0x425514
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], str.NVDFPOn
mov dword [ebp - 0x214], 0xa
mov dword [ebp - 0x210], 0x425518
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], str.NVScaleEvent
mov dword [ebp - 0x204], 0xb
mov dword [ebp - 0x200], 0x4254f4
mov dword [ebp - 0x1fc], esi
mov eax, str.NOT_A_NAMED_EVENT
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 0x1f0], 0x425750
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1e8], str.NVDXFullScreenEvent
mov dword [ebp - 0x1e4], 0xc
mov dword [ebp - 0x1e0], 0x425508
mov dword [ebp - 0x1dc], esi
mov dword [ebp - 0x1d8], str.NVThermalEvent
mov dword [ebp - 0x1d4], 0xd
mov dword [ebp - 0x1d0], 0x425504
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c8], str.NVPowerConnectorEvent
mov dword [ebp - 0x1c4], 0xe
mov dword [ebp - 0x1c0], 0x42550c
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1b8], str.NVWMDisplayChangeEvent
mov dword [ebp - 0x1b4], 0xf
mov dword [ebp - 0x1b0], 0x425520
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], str.NVWMDeviceChangeEvent
mov dword [ebp - 0x1a4], 0x10
mov dword [ebp - 0x1a0], 0x425524
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], str.NVLidChangeEvent
mov dword [ebp - 0x194], 0x11
mov dword [ebp - 0x190], 0x425528
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x188], str.NVInhibitChangeEvent
mov dword [ebp - 0x184], 0x12
mov dword [ebp - 0x180], 0x425530
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x178], str.NVHotPlugChangeEvent
mov dword [ebp - 0x174], 0x13
mov dword [ebp - 0x170], 0x425534
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], str.NVAGPConfigurationEvent
mov dword [ebp - 0x164], 0x14
mov dword [ebp - 0x160], 0x42552c
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x158], str.NVSmartDimmerEvent
mov dword [ebp - 0x154], 0x15
mov dword [ebp - 0x150], 0x425538
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x148], str.NVCplHotKeyEvent
mov dword [ebp - 0x144], 0x16
mov dword [ebp - 0x140], 0x42551c
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], str.NVFlushUnattachEvent
mov dword [ebp - 0x134], 0x17
mov dword [ebp - 0x130], 0x42553c
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], str.NV_WMIACPI_SilentModeEvent
mov dword [ebp - 0x124], 0x18
mov dword [ebp - 0x120], 0x4254e0
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], str.NVInduceDeviceScanEvent
mov dword [ebp - 0x114], 0x19
mov dword [ebp - 0x110], 0x425540
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], str.NVThermalHistoryOff
mov dword [ebp - 0x104], 0x1a
mov dword [ebp - 0x100], 0x425544
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], str.NVThermalHistoryOn
mov dword [ebp - 0xf4], 0x1b
mov dword [ebp - 0xf0], 0x425548
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], str.NVSetBrightnessRequestEvent
mov dword [ebp - 0xe4], 0x1c
mov dword [ebp - 0xe0], 0x42554c
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 0x1d
mov dword [ebp - 0xd0], 0x425550
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], str.NVGSyncSmartSyncLossEvent
mov dword [ebp - 0xc4], 0x1e
mov dword [ebp - 0xc0], 0x425554
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], str.NVGSyncSmartSyncGainEvent
mov dword [ebp - 0xb4], 0x1f
mov dword [ebp - 0xb0], 0x425558
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], str.NVGSyncSmartStereoLossEvent
mov dword [ebp - 0xa4], 0x20
mov dword [ebp - 0xa0], 0x42555c
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], str.NVGSyncSmartStereoGainEvent
mov dword [ebp - 0x94], 0x21
mov dword [ebp - 0x90], 0x425560
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], str.NVCoppEvent
mov dword [ebp - 0x84], 0x22
mov dword [ebp - 0x80], 0x425564
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], str.NVDpLinkTrainEvent
mov dword [ebp - 0x74], 0x23
mov dword [ebp - 0x70], 0x425568
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov ecx, 8
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x27c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x280], eax
mov dword [0x4298a0], 0x10
mov dword [0x4298a4], esi
xor ecx, ecx
mov eax, dword [0x4298bc]
cmp eax, 1
setle cl
dec ecx
and ecx, 0x48
add ecx, 7
mov dword [0x4298a8], ecx
cmp eax, 3
jl 0x4066f7
mov eax, ecx
or al, 0x80
mov dword [0x4298a8], eax
mov dword [0x4298ac], ebx
mov dword [0x4298b0], ebx
mov dword [0x4298b4], ebx
mov dword [0x4298b8], ebx
push 0x4298c0
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call edi
push 0x4296e0
call edi
push 0x4298e0
call edi
cmp dword [0x425584], ebx
jne 0x40674e
push 0x420d78
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.EnumDisplayDevicesW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x425584], eax
push str.wtsapi32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
mov dword [0x4254c8], eax
cmp eax, ebx
je 0x40678c
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4254d0], eax
cmp eax, ebx
jne 0x40678c
mov edx, dword [0x4254c8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4254c8], ebx
push str.kernel32.dll
call edi
mov dword [0x4254cc], eax
cmp eax, ebx
je 0x4067cc
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4254d4], eax
cmp eax, ebx
jne 0x4067c5
mov eax, dword [0x4254cc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4254cc], ebx
jmp 0x4067cc
call eax
mov dword [0x4254c0], eax
cmp dword [0x4298bc], 1
jle 0x4068ba
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ebx
mov word [ebp - 0x488], bx
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x486]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x488]
push ecx
call fcn.00404b00
add esp, 4
cmp eax, 1
jne 0x40688e
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
cmp eax, 1
jne 0x40688e
mov eax, dword [ebp - 0x288]
cmp eax, ebx
je 0x40688e
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
cmp eax, 1
jne 0x40688e
mov eax, dword [str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE10318]
cmp eax, ebx
je 0x406872
mov edi, 0x42093c
mov ecx, dword [ebp - 0x288]
push ecx
push eax
call fcn.004053f0
add esp, 8
add edi, 4
mov eax, dword [edi]
cmp eax, ebx
jne 0x406859
call fcn.00404bd0
mov eax, dword [ebp - 0x288]
cmp eax, ebx
je 0x40688e
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x288], ebx
push str.RegisterServiceCtrlHandlerExW
mov edi, dword [ebp - 0x284]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp edi, ebx
je 0x4068ba
cmp eax, ebx
je 0x4068ba
push ebx
push fcn.004077d0
push str.NVSvc
call eax
mov dword [0x4254e4], eax
mov eax, dword [0x4254e4]
cmp eax, ebx
jne 0x4068fa
push 0x4078e0
push str.NVSvc
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x4254e4], eax
cmp eax, ebx
jne 0x4068fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4298ac], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00407de0
mov dword [0x4298a4], esi
mov dword [0x4298b8], 0x1f4
push 0x4298a0
mov edx, dword [0x4254e4]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [0x4298a4], 4
mov dword [0x4298b8], ebx
push 0x212
push ebx
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
cmp eax, ebx
je 0x406951
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x40695b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
jmp 0x406961
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
push ebx
push 0x40aad0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
je 0x40697d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x425510], eax
cmp eax, ebx
jne 0x4069aa
call edi
mov dword [0x4298ac], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5ac], 1
xor ecx, ecx
mov dword [ebp - 0x5b0], ecx
cmp dword [ebp - 0x278], ebx
je 0x4069e4
lea eax, [ebp - 0x278]
inc ecx
add eax, 0x10
cmp dword [eax], ebx
jne 0x4069d6
mov dword [ebp - 0x5b0], ecx
call fcn.00404810
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [0x4254b4], ecx
call fcn.00407ec0
mov dword [0x4208a8], eax
cmp dword [0x4254b4], ebx
je 0x406a79
call fcn.00402e00
test eax, eax
je 0x406a2b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404810
xor edx, edx
cmp eax, ebx
setne dl
mov dword [0x4254b4], edx
cmp dword [0x4254b4], ebx
je 0x406a79
call edi
push 0x4298a0
call fcn.004085f0
add esp, 4
test eax, eax
jne 0x406a71
mov dword [0x4298a4], 1
mov dword [0x4298b8], 0x3e8
mov dword [0x4298ac], ebx
push 0x4298a0
mov eax, dword [0x4254e4]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x4254b4], ebx
jne 0x406ac1
push 0x4254dc
lea ecx, [ebp - 0x5b4]
push ecx
call fcn.00405950
call fcn.00402cc0
call fcn.00403150
push ebx
call fcn.00401c40
add esp, 0xc
mov dword [0x420034], eax
call fcn.004081c0
call fcn.00406150
call fcn.00404570
test eax, eax
je 0x406abc
mov dword [ebp - 0x24], 1
call fcn.00408dd0
push 0x4298a0
call fcn.004085f0
add esp, 4
test eax, eax
jne 0x406ae4
push 0x4298a0
mov edx, dword [0x4254e4]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.00404c50
mov dword [ebp - 0x5b8], eax
cmp eax, ebx
je 0x406af8
call fcn.00404d20
call fcn.00401bb0
mov dword [ebp - 0x5bc], eax
cmp eax, 1
jae 0x406b12
mov dword [ebp - 0x5bc], 1
mov eax, dword [0x4298a4]
cmp eax, 3
je 0x407418
cmp eax, 1
je 0x407418
cmp dword [ebp - 0x24], ebx
jne 0x407418
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x5b0], ebx
je 0x406d53
mov dword [ebp - 0x5c0], ebx
mov eax, dword [ebp - 0x5c0]
shl eax, 4
mov esi, dword [ebp + eax - 0x278]
cmp esi, ebx
je 0x406d4b
lea ecx, [ebp + eax - 0x270]
mov dword [ebp - 0x5c4], ecx
cmp dword [ecx], ebx
je 0x406d40
lea edi, [ebp + eax - 0x274]
mov dword [ebp - 0x5c8], edi
cmp dword [edi], 6
jne 0x406b9f
cmp dword [0x4298bc], 1
jle 0x406b9f
dec dword [ebp - 0x5b0]
mov dword [ecx], ebx
inc dword [ebp - 0x5c0]
jmp 0x406b47
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x5cc], eax
test al, 5
jne 0x406bc9
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x5c4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x406ce6
test al, 4
je 0x406ce6
lea edx, [ebp - 0x38]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x406cb6
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x5ec]
rep stosd dword es:[edi], eax
mov eax, 2
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], 5
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x5d0], ecx
lea edx, [ebp - 0x2c]
push edx
push ebx
lea eax, [ebp - 0x5ec]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [ebp - 0x5f0], eax
cmp eax, ebx
jne 0x406cb6
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x406cb6
push 1
mov ecx, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x406cb6
push ebx
mov edx, dword [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x406cb6
mov dword [ebp - 0x5fc], 0xc
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x5f8], ecx
mov dword [ebp - 0x5f4], ebx
push esi
push ebx
push ebx
lea edx, [ebp - 0x5fc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x5c4]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x406cc4
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x406cd2
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x406ce0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x5c8]
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx]
mov eax, dword [eax]
cmp eax, ebx
je 0x406d40
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + ecx*4 - 0x518], eax
mov esi, dword [edi]
mov dword [ebp + ecx*4 - 0x5a8], esi
test byte [ebp - 0x5cc], 2
je 0x406d1d
push eax
push esi
call fcn.00401510
add esp, 8
inc dword [ebp - 0x5ac]
dec dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x5c4]
mov dword [eax], ebx
cmp dword [edi], 5
jne 0x406d40
push 1
call fcn.00402ab0
add esp, 4
inc dword [ebp - 0x5c0]
jmp 0x406b47
cmp dword [ebp - 0x5b0], ebx
jne 0x406d75
cmp dword [ebp - 0x5ac], ebx
je 0x406d75
mov edi, dword [ebp - 0x5b4]
mov dword [ebp - 0x600], edi
cmp edi, 0xffffffff
je 0x406d80
mov dword [ebp - 0x20], 1
jmp 0x406d80
mov edi, 0xfa0
mov dword [ebp - 0x600], edi
cmp dword [0x425574], ebx
je 0x406d9b
cmp edi, 0x3e8
jbe 0x406d9b
mov edi, 0x3e8
mov dword [ebp - 0x600], edi
cmp edi, 0x7530
jbe 0x406dae
mov edi, 0x7530
mov dword [ebp - 0x600], edi
cmp dword [ebp - 0x27c], ebx
jne 0x406dc9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x280]
cmp eax, 0x7530
jb 0x406dfd
mov dword [ebp - 0x27c], 1
call fcn.00408890
call fcn.00408600
cmp dword [0x42559c], ebx
je 0x406df8
cmp edi, 0x3e8
jbe 0x406df8
mov edi, 0x3e8
mov dword [ebp - 0x600], edi
call fcn.00408b70
cmp dword [ebp - 0x5ac], ebx
jne 0x406e1d
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp dword [ebp - 0x5b8], ebx
je 0x406e49
mov edi, 0x7d0
mov dword [ebp - 0x600], edi
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
jne 0x406e4c
mov ecx, dword [ebp - 0x5bc]
push ecx
push edi
call fcn.00405370
add esp, 8
jmp 0x406e4c
mov esi, dword [ebp - 0x1c]
push edi
push ebx
lea edx, [ebp - 0x518]
push edx
mov eax, dword [ebp - 0x5ac]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
mov dword [ebp - 0x604], edi
cmp edi, 0x102
jne 0x406ea3
cmp dword [ebp - 0x20], ebx
je 0x406e7c
call fcn.00407640
cmp dword [0x425574], ebx
je 0x406e92
call fcn.00406080
test eax, eax
jne 0x406e92
call fcn.00406140
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp edi, dword [ebp - 0x5ac]
jae 0x4073d0
mov dword [ebp - 0x5c0], edi
cmp dword [0x4254c4], ebx
je 0x406ed6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x425580]
cmp eax, 0x7d0
jbe 0x406ed6
mov dword [0x4254c4], ebx
mov eax, dword [ebp + edi*4 - 0x5a8]
cmp eax, 0x23
ja case.default.0x406eff
jmp dword [eax*4 + 0x40759c]
mov ecx, dword [0x42556c]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x406eff
jmp dword [eax*4 + 0x40762c]
mov dword [0x4298a4], 3
mov dword [0x4298b8], 0x64
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov dword [ebp - 0x1c], 1
mov dword [0x4298a4], 7
cmp dword [0x4254f0], ebx
je 0x406f4e
push 2
call fcn.00402ab0
add esp, 4
push 0x4298a0
mov edx, dword [0x4254e4]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov dword [ebp - 0x1c], ebx
mov dword [0x4298a4], 4
cmp dword [0x4254f0], ebx
je 0x406f90
push 1
call fcn.00402ab0
add esp, 4
push 0x4298a0
mov eax, dword [0x4254e4]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
push 0x4298a0
mov ecx, dword [0x4254e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
xor edx, edx
cmp eax, 3
sete dl
push edx
call fcn.00401b30
add esp, 4
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x402830
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x403690
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x4039e0
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push 0x42094c
push 0x4037b0
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push 0x425590
push 0x4037b0
jmp 0x4073b1
call fcn.004045c0
mov dword [ebp - 0x604], eax
cmp esi, ebx
jne case.default.0x406eff
call fcn.00402ae0
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
call fcn.00409a20
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push ebx
call fcn.004030d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push 1
call fcn.004030d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push ebx
call fcn.00404ed0
add esp, 4
test eax, eax
je case.default.0x406eff
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push 1
call fcn.00404ed0
add esp, 4
test eax, eax
je case.default.0x406eff
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov eax, dword [ebp + edi*4 - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x4034b0
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x4038c0
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x403b40
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x403bd0
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push 0x420950
push 0x4037b0
jmp 0x4073b1
call fcn.00408550
cmp esi, ebx
jne case.default.0x406eff
cmp dword [0x425574], ebx
je 0x4073b9
call fcn.00406080
test eax, eax
jne 0x4073b9
call fcn.00406140
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
call fcn.00405050
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x403290
jmp 0x4073b1
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x4033a0
jmp 0x4073b1
call fcn.00408cf0
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov dword [ebp - 0x608], ebx
cmp esi, ebx
jne case.default.0x406eff
lea ecx, [ebp - 0x608]
push ecx
call fcn.00404ef0
add esp, 4
test eax, eax
je 0x4073b9
push ebx
push ebx
push ebx
push 0x4038c0
jmp 0x4073b1
push ebx
push ebx
push ebx
push 0x403d80
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov dword [ebp - 0x60c], 1
jmp 0x407359
mov dword [ebp - 0x60c], 2
push ebx
push ebx
lea eax, [ebp - 0x60c]
push eax
push 0x403e10
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov dword [ebp - 0x60c], 4
push ebx
push ebx
lea ecx, [ebp - 0x60c]
push ecx
push 0x403e10
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
mov dword [ebp - 0x60c], 8
push ebx
push ebx
lea edx, [ebp - 0x60c]
push edx
push 0x403e10
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x403e90
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp esi, ebx
jne case.default.0x406eff
push ebx
push ebx
push ebx
push 0x403f40
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp edi, 0xffffffff
jne 0x4073e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b12
cmp dword [0x4254f0], ebx
je 0x407429
push ebx
call fcn.00402ab0
add esp, 4
mov dword [0x4298a4], 3
mov dword [0x4298b4], 1
mov edi, 0x64
mov dword [0x4298b8], edi
push 0x4298a0
mov eax, dword [0x4254e4]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.00409050
call fcn.00408c60
call fcn.004089d0
call fcn.00404930
mov dword [0x4298b8], edi
xor eax, eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5ac], ebx
jle 0x4074da
test al, 7
jne 0x4074af
mov dword [0x4298a4], 3
inc dword [0x4298b4]
push 0x4298a0
mov ecx, dword [0x4254e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [ebp - 0x5c0]
lea edi, [ebp + eax*4 - 0x518]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4074cb
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp eax, dword [ebp - 0x5ac]
jl 0x407483
push 0x4298a0
call fcn.004085f0
add esp, 4
test eax, eax
jne 0x40750d
mov dword [0x4298a4], 1
mov dword [0x4298b8], ebx
push 0x4298a0
mov edx, dword [0x4254e4]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0x4298c0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call edi
push 0x4296e0
call edi
push 0x4298e0
call edi
cmp dword [ebp - 0x24], ebx
je 0x407587
lea eax, [ebp - 0x610]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x61c]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x614], esi
push ebx
push ebx
push ebx
lea edx, [ebp - 0x620]
push edx
push ebx
mov eax, dword [ebp - 0x610]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8