Function at 0x40a590
Capabilities:
Shutdown system

Disassembly:
mov ecx, dword [0x453488]
sub esp, 0x14
push ebx
xor ebx, ebx
cmp ecx, ebx
je 0x40ac1a
push esi
mov esi, 0xcb
cmp dword [0x45361c], ebx
je 0x40a60e
cmp byte [0x4534ee], bl
je 0x40ac19
push 1
push ebx
push ebx
push ebx
push 2
mov byte [0x4534ee], bl
mov dword [0x453628], ebx
call fcn.00403d60
mov ecx, dword [0x453488]
mov dword [0x45361c], ebx
mov dword [0x454bf4], 1
mov dword [0x454bec], 0xffffffff
mov dword [0x45362c], ebx
mov dword [0x453630], ebx
mov dword [0x453638], 0xa
jmp 0x40a63b
cmp byte [0x454be7], bl
je 0x40a635
mov eax, dword [0x453634]
inc eax
cmp eax, 0xe10
mov dword [0x453634], eax
jle 0x40a63b
mov dword [0x45361c], esi
mov byte [0x4534ee], 1
mov dword [0x453634], ebx
mov eax, dword [ecx + 0x18fc]
test eax, eax
je 0x40a697
mov eax, dword [0x45362c]
cmp eax, 0x64
jne 0x40a68b
cmp dword [0x453630], 2
jne 0x40a682
mov dword [0x45361c], esi
inc eax
pop esi
mov byte [0x4534ee], 1
mov byte [0x454be7], 1
mov dword [0x454c04], 0x191
mov dword [0x45362c], eax
pop ebx
add esp, 0x14
ret
inc dword [0x453630]
or eax, 0xffffffff
inc eax
pop esi
mov dword [0x45362c], eax
pop ebx
add esp, 0x14
ret
push edi
mov dword [0x45362c], ebx
mov dword [0x453630], ebx
mov edi, 4
cmp byte [0x454be5], bl
je 0x40a765
cmp dword [0x45361c], 3
je 0x40a765
cmp dword [0x453840], 0xb4
jge 0x40a6f8
call fcn.00428130
lea esi, [edi - 3]
test al, al
jne 0x40a6e2
cmp dword [0x453840], esi
jge 0x40a6fd
mov eax, dword [0x453308]
mov ecx, dword [eax + 0x994]
cmp ecx, ebx
je 0x40a702
cmp ecx, 0x13
jne 0x40a721
jmp 0x40a702
mov esi, 1
mov eax, dword [0x453308]
mov ecx, dword [0x453488]
mov dword [0x453840], ebx
cmp ecx, ebx
je 0x40a721
push esi
push ebx
push ebx
push ebx
push edi
call fcn.00403d60
mov eax, dword [0x453308]
cmp eax, ebx
je 0x40a76f
push 0x31
push 0x41a
mov ecx, eax
call fcn.00402440
test eax, eax
je 0x40a76a
mov eax, dword [0x453840]
add eax, esi
mov dword [0x453840], eax
cmp eax, esi
jne 0x40a76a
cmp dword [0x453618], ebx
jne 0x40a76a
push esi
push ebx
push ebx
push ebx
push 6
mov dword [0x453618], esi
call fcn.0040a560
add esp, 0x14
jmp 0x40a76a
mov esi, 1
mov eax, dword [0x453308]
mov ecx, dword [0x454bf4]
cmp ecx, 0xf
ja case.default.0x40a934
jmp dword [ecx*4 + 0x40ac20]
mov esi, dword [0x454bec]
cmp esi, ebx
jne 0x40a799
mov dword [0x453638], 0xa
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, esi
sub edx, ecx
jne 0x40ac09
sub dword [0x453638], 1
jne 0x40ac09
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x45361c], ebx
mov dword [0x454bf4], 3
pop ebx
add esp, 0x14
ret
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x454bf4], 2
pop ebx
add esp, 0x14
ret
mov esi, 0xfffffff6
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x454bf4], 3
pop ebx
add esp, 0x14
ret
mov esi, dword [0x454bec]
cmp esi, ebx
jne 0x40a845
push 1
push ebx
push ebx
push ebx
push 1
call fcn.0040a560
add esp, 0x14
jmp case.default.0x40a934
cmp byte [0x454be5], bl
jne 0x40ab7a
mov byte [0x454be7], 1
mov dword [0x454c04], 0x1f5
jmp 0x40ac09
cmp eax, ebx
je case.default.0x40a934
cmp dword [eax + 0x954], esi
jne 0x40a8a7
push esi
push ebx
push ebx
push 5
push 3
mov dword [eax + 0x954], ebx
call fcn.0040a560
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x454bf4], 5
pop ebx
add esp, 0x14
ret
mov dword [eax + 0x5e0], esi
jmp case.default.0x40a934
mov esi, dword [0x454bec]
cmp esi, ebx
jne 0x40a8d6
push 1
push ebx
call fcn.004281f0
push eax
push 2
push 3
call fcn.0040a560
add esp, 0x14
jmp case.default.0x40a934
cmp esi, 1
jl 0x40ac09
cmp dword [eax + 0x950], 2
jne 0x40ac09
push 1
push ebx
call fcn.00428180
add eax, dword [0x45679c]
push eax
push 1
push 3
call fcn.0040a560
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x454bf4], 6
pop ebx
add esp, 0x14
ret
mov ecx, dword [eax + 0x954]
add ecx, 0xfffffffc
cmp ecx, 3
ja case.default.0x40a934
jmp dword [ecx*4 + 0x40ac60]
push esi
push ebx
push ebx
push 0x80
push 3
mov dword [0x45644c], ebx
call fcn.0040a560
mov eax, dword [0x453308]
add esp, 0x14
mov dword [eax + 0x954], ebx
jmp case.default.0x40a934
mov ecx, dword [0x45644c]
push esi
push ebx
push ecx
push 0x84
push 3
call fcn.0040a560
mov edx, dword [0x453308]
mov dword [edx + 0x954], 6
mov eax, dword [0x453308]
add esp, 0x14
mov dword [eax + 0x950], ebx
jmp case.default.0x40a934
cmp dword [eax + 0x950], esi
jl case.default.0x40a934
mov ecx, dword [0x45644c]
push esi
push ebx
push ecx
push 0x85
push 3
call fcn.0040a560
mov edx, dword [0x453308]
mov dword [edx + 0x954], ebx
mov eax, dword [0x453308]
add esp, 0x14
mov dword [eax + 0x950], ebx
jmp case.default.0x40a934
push esi
push ebx
push ebx
push 0x81
push 3
call fcn.0040a560
mov ecx, dword [0x453308]
mov dword [ecx + 0x954], ebx
mov edx, dword [0x453308]
add esp, 0x14
mov dword [edx + 0x950], ebx
jmp case.default.0x40a934
cmp dword [eax + 0x954], 2
jne case.default.0x40a934
mov dword [0x454bec], 0xffffffff
mov dword [0x454bf4], 8
call fcn.004281a0
mov dword [0x453614], eax
jmp case.default.0x40a934
mov esi, dword [0x454bec]
cmp esi, ebx
jne 0x40aa5e
mov eax, dword [0x453614]
push 1
push ebx
push eax
push 3
push 3
call fcn.0040a560
add esp, 0x14
jmp case.default.0x40a934
cmp esi, 1
jl 0x40ac09
cmp dword [eax + 0x950], 3
jne 0x40ac09
push 1
push ebx
call fcn.00428190
push eax
push edi
push 3
call fcn.0040a560
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x454bf4], 0xb
pop ebx
add esp, 0x14
ret
push esi
push ebx
push ebx
push 3
push 3
call fcn.0040a560
push 0xc
call fcn.00428110
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
pop ebx
add esp, 0x14
ret
push esi
push ebx
call fcn.00428190
push eax
push edi
push 3
call fcn.0040a560
push 0xa
call fcn.00428110
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
pop ebx
add esp, 0x14
ret
cmp dword [eax + 0x950], edi
jne case.default.0x40a934
push esi
push ebx
push ebx
push 6
push 3
call fcn.0040a560
push 0xc
call fcn.00428110
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
pop ebx
add esp, 0x14
ret
mov esi, dword [0x454bec]
cmp esi, ebx
jl 0x40ac09
cmp dword [eax + 0x950], edi
jne 0x40ac09
push 1
push ebx
push ebx
push 6
push 3
call fcn.0040a560
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x454bec], esi
pop esi
mov dword [0x454bf4], 0xc
pop ebx
add esp, 0x14
ret
cmp dword [eax + 0x954], 3
jne case.default.0x40a934
or esi, 0xffffffff
inc esi
mov dword [0x454bf4], edi
pop edi
mov dword [0x454bec], esi
pop esi
pop ebx
add esp, 0x14
ret
push esi
push ebx
push ebx
mov ecx, esi
push ebx
push 2
mov word [0x45189c], cx
call fcn.0040a560
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 0xc]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [0x454bf4], 0xe
push ebx
jne 0x40abfb
push 5
jmp 0x40abfd
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, dword [0x454bec]
cmp esi, 0xfde8
jge 0x40ac18
inc esi
mov dword [0x454bec], esi
pop edi
pop esi
pop ebx
add esp, 0x14
ret