Function at 0x488d08
Capabilities:
Shutdown system

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc1c
mov esi, eax
fld qword [esp + 0xc30]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x488f6f
fld qword [esi + 0x18]
fxch st(1)
fucompp
fnstsw ax
sahf
fldz
jb 0x488f6f
fstp st(0)
mov eax, dword [esi + 0x20]
cmp eax, 2
je 0x488e32
cmp eax, 1
jne 0x488f5a
mov eax, dword [0xb20588]
cmp byte [eax + 0x34d4], 0
jne 0x488d72
mov eax, dword [0xb20584]
call fcn.0044d8c0
test al, al
je 0x488f53
mov edi, dword [esi + 0x14]
mov ebx, dword [edi + 0x24]
test ebx, ebx
js 0x488d94
mov eax, dword [0xb20584]
sub esp, 8
xor edx, edx
xor ecx, ecx
push ebx
push dword [edi + 0x20]
call fcn.00453d78
add esp, 8
mov edi, dword [esi + 0x14]
mov ebx, dword [edi + 0x28]
mov ebp, dword [edi + 0x2c]
cmp ebx, 0x80000001
mov eax, ebp
sbb eax, 0xffffffff
jl 0x488dc2
mov eax, dword [0xb20584]
sub esp, 4
xor edx, edx
xor ecx, ecx
push ebp
push ebx
push 1
call fcn.0044ce34
add esp, 4
mov edi, dword [esi + 0x14]
mov eax, dword [edi + 0x30]
call fcn.00438c9c
cmp eax, 7
je 0x488df3
mov edi, dword [0xb20584]
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x30]
call fcn.00438c9c
mov ecx, eax
sub esp, 0xc
xor edx, edx
mov eax, edi
push 0
call fcn.00454718
add esp, 0xc
mov eax, dword [0xb20588]
cmp dword [eax + 0x2ef934], 0
je 0x488e0d
mov eax, dword [0xb20584]
xor edx, edx
call fcn.0044e5e4
mov eax, dword [0xb20584]
mov edi, dword [esi + 0x14]
movzx ecx, byte [edi + 0x35]
movzx edx, byte [edi + 0x34]
movzx edi, byte [edi + 0x36]
sub esp, 0xc
push edi
call fcn.0044ea9c
add esp, 0xc
jmp 0x488f5a
mov eax, dword [0xb20588]
cmp dword [eax + 0x2ef934], 2
jne 0x488f53
mov eax, dword [0xb20584]
xor edx, edx
call fcn.0044e5e4
mov eax, dword [0xb20588]
cmp byte [eax + 0x2b882c], 0
je 0x488e6f
mov eax, dword [0xb20584]
xor edx, edx
mov ecx, 1
call fcn.00460e7c
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x38]
lea ecx, [eax - 3]
cmp ecx, 2
jb 0x488ea0
cmp eax, 2
je 0x488f15
cmp eax, 1
jne 0x488f53
mov eax, dword [0xb20584]
xor edx, edx
call fcn.0044bdcc
jmp 0x488f53
call sub.KERNEL32.DLL_GetCurrentProcess
sub esp, 4
lea ecx, [esp + 0xc]
push ecx
push 0x28
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
add esp, 4
lea eax, [esp + 0x10]
sub esp, 4
push eax
push 0xac52dc
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
add esp, 4
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 2
sub esp, 8
lea eax, [esp + 0x14]
push 0
push 0
push 0
push eax
push 0
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
add esp, 8
mov eax, dword [esi + 0x14]
cmp dword [eax + 0x38], 3
jne 0x488f23
sub esp, 8
push 0
push 1
call sub.KERNEL32.DLL_SetSystemPowerState
add esp, 8
jmp 0x488f53
mov eax, dword [0xb20584]
xor edx, edx
call fcn.00457b4c
jmp 0x488f53
lea edi, [esp + 0x1c]
push str.HDSDR_Recording_Scheduler_has_triggered_shutting_down_this_machine
push 0xac52f0
push 0xbff
push edi
call fcn.00809fc0
add esp, 0x10
sub esp, 0xc
push 0
push 0
push 0x3c
push edi
push 0
call sub.ADVAPI32.DLL_InitiateSystemShutdownA
add esp, 0xc
mov dword [esi + 0x14], 0
mov eax, dword [0xb20584]
movzx edx, byte [eax + 0x2f1980]
mov eax, esi
call fcn.00488a10
fldz
fstp st(0)
add esp, 0xc1c
pop esi
pop edi
pop ebx
pop ebp
ret 8