Function at 0x408210
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push edi
push str.Handle_command
mov eax, dword [ebx]
push 0xcf
push 4
call dword [eax + 4]
mov eax, dword [ebp + 8]
sub eax, edi
je 0x408643
dec eax
je 0x408264
dec eax
je 0x4084a5
push 0x651
push str.E:_nsmsrc_nsm11301130ctl32pcirisvr.cpp
push str.FALSE
call fcn.00403830
add esp, 0xc
jmp 0x408734
mov eax, dword [0x420eec]
cmp eax, edi
je 0x40828f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x420eec], edi
mov ecx, dword [ebx + 0x2c4]
push ecx
call fcn.0040f9ad
add esp, 4
mov dword [ebx + 0x2c4], edi
mov esi, dword [ebp + 0xc]
cmp esi, 0x3ed
jne 0x408302
mov esi, dword [ebx + 0x284]
mov ecx, ebx
dec esi
mov eax, esi
mov dword [ebx + 0x284], esi
push eax
push 0x20000002
call fcn.0040aab0
mov eax, dword [ebx + 0x284]
mov esi, dword [ebx]
push edi
push edi
lea edx, [ebp - 0xc]
push 0xa
push edx
push eax
call fcn.004116f8
add esp, 0xc
mov ecx, ebx
push eax
push 0xd8
push 4
call dword [esi + 4]
mov ecx, ebx
call fcn.00406aa0
test eax, eax
jne 0x408734
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x29c]
push 3
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
cmp esi, 1
jne 0x40831d
mov ecx, ebx
call fcn.00408d40
mov edx, dword [ebx]
push edi
push edi
push str.Command_1_:_Button_pressed_in_dialog
push 0xcf
push 4
mov ecx, ebx
call dword [edx + 4]
push str.PCIRISVR_NoRestartRequired
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, ebx
mov esi, eax
call fcn.00408f10
test esi, esi
mov edi, eax
je 0x408371
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40836a
mov dword [ebx + 0x294], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x420eec]
test eax, eax
je 0x40839e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
xor esi, esi
mov dword [0x420eec], esi
mov eax, dword [ebx + 0x2c4]
push eax
call fcn.0040f9ad
add esp, 4
mov dword [ebx + 0x2c4], esi
test edi, edi
jne 0x4083b5
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
jmp 0x408734
mov eax, dword [ebx + 0x2b4]
mov esi, 1
test eax, eax
je 0x4083d1
mov ecx, ebx
mov dword [ebx + 0x2a4], esi
call fcn.00406aa0
mov ecx, ebx
call fcn.0040c720
mov ecx, dword [ebx + 0x290]
mov edx, dword [ebx + 0x294]
push eax
push ecx
push edx
push str.m_bNoRestart:__d_m_bAutoRestart:__d__GetLoggedOnUserCount:__d
push ebx
call fcn.00406270
mov eax, dword [ebx + 0x360]
add esp, 0x14
push 0x14
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40841e
mov eax, dword [ebx + 0x28c]
mov dword [ebx + 0x364], esi
cmp eax, esi
jge 0x40841e
mov dword [ebx + 0x28c], esi
mov eax, dword [ebx + 0x294]
test eax, eax
jne 0x408495
mov eax, dword [ebx + 0x290]
test eax, eax
je 0x40843d
mov ecx, ebx
call fcn.0040c720
test eax, eax
jle 0x408495
mov eax, dword [ebx + 0x358]
test eax, eax
je 0x408470
push 0
call fcn.00408190
add esp, 4
cmp eax, 4
je 0x408470
mov eax, dword [ebx + 0x364]
test eax, eax
jne 0x408470
push 4
push 0x20000012
mov ecx, ebx
call fcn.0040aab0
jmp 0x4084aa
push 0
call fcn.00408190
add esp, 4
cmp eax, 6
mov ecx, ebx
jb 0x40848b
call fcn.0040c270
jmp 0x408734
call fcn.00409d20
jmp 0x408734
push 3
push 0x20000012
mov ecx, ebx
call fcn.0040aab0
jmp 0x4084aa
mov esi, 1
mov eax, dword [0x420eec]
test eax, eax
je 0x4084d3
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebx + 0x2c4]
push ecx
call fcn.0040f9ad
add esp, 4
mov dword [ebx + 0x2c4], 0
mov al, byte [ebx + 0x35c]
test al, al
jne 0x408622
mov eax, dword [ebx + 0x358]
test eax, eax
je 0x408508
push 0
call fcn.00408190
add esp, 4
cmp eax, 4
je 0x408508
mov eax, dword [ebx + 0x364]
test eax, eax
je 0x408622
mov eax, dword [ebx + 0x290]
test eax, eax
je 0x40851d
mov ecx, ebx
call fcn.0040c720
test eax, eax
je 0x40853e
mov eax, dword [ebx + 0x28c]
test eax, eax
je 0x408530
cmp dword [ebp + 0xc], 0x3eb
je 0x40853e
mov eax, dword [ebx + 0x364]
test eax, eax
je 0x408622
lea edx, [ebp + 0xc]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40856c
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [ebp + 0xc]
push 0
push 0
lea ecx, [ebp - 0x10]
push 0
mov dword [ebp - 0x10], esi
push ecx
mov esi, 2
push 0
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [ebx + 0x2b4]
push 0
neg eax
sbb eax, eax
mov ecx, ebx
and eax, 0xbfffffed
add eax, 0x40000016
push eax
call fcn.0040aab0
mov edx, dword [ebx]
push 0
push 0
push 0
push pe_nt_image_headers32
push 4
mov ecx, ebx
call dword [edx + 4]
mov eax, dword [ebx + 0x2b4]
test eax, eax
jne 0x4085e1
mov ecx, ebx
call fcn.00405c60
mov eax, dword [ebx + 0xa4]
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call fcn.00408190
add esp, 4
cmp eax, 5
jb 0x408619
lea ecx, [ebx + 0x7e]
push str.Winlogon
push ecx
call fcn.004014c0
add esp, 8
test eax, eax
jne 0x408619
mov esi, 6
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebx + 0x2b4]
test eax, eax
jne 0x408734
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
jmp 0x408734
mov eax, dword [ebx + 0xa8]
cmp eax, edi
mov eax, dword [ebx + 0x2a4]
je 0x40867c
cmp eax, edi
jne 0x408680
push 0x2e
push ebx
call fcn.0040bff0
add esp, 8
mov ecx, ebx
call fcn.0040b9b0
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
jmp 0x408734
cmp eax, edi
je 0x4086c1
lea edx, [ebx + 0x2c8]
push edx
push 0x12
push ebx
call fcn.0040bff0
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
push edi
push edi
push edi
push 0xd2
push 4
call dword [eax + 4]
mov ecx, ebx
call fcn.0040bd30
mov ecx, ebx
call fcn.00406de0
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
jmp 0x408734
mov ecx, ebx
call fcn.004089b0
test eax, eax
je 0x40872d
lea ecx, [ebp - 0x114]
push 0x104
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x41c0d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.0040a360
mov ecx, ebx
call fcn.00409fa0
mov ecx, ebx
call fcn.00405c60
jmp 0x408734
mov ecx, ebx
call fcn.00408bb0
mov edx, dword [ebx]
push 0
push 0
push str.Handled_command
push 0xcf
push 4
mov ecx, ebx
call dword [edx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8