Function at 0x4280a8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd0]
mov ecx, 0x34
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov dword [ebp - 0xd0], ecx
cmp dword [ebp - 0xd0], 0x30
ja case.0x427d39.2
mov edx, dword [ebp - 0xd0]
movzx eax, byte [edx + 0x42814c]
jmp dword [eax*4 + 0x428110]
mov esi, esp
push 1
mov eax, dword [ebp - 8]
add eax, 0xa04c
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp esi, esp
call fcn.00414979
jmp case.0x427d39.2
movsx eax, byte [0x44576c]
cmp eax, 0x31
jne 0x427db7
push 0
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x4142a8
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x44576d]
cmp eax, 0x31
jne 0x427e14
push 1
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x414ac3
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x44576e]
cmp eax, 0x31
jne 0x427e71
push 0
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x414424
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x44576f]
cmp eax, 0x31
jne 0x427ece
push 0
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x4149fb
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x445770]
cmp eax, 0x31
jne 0x427f2b
push 1
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x414947
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x445771]
cmp eax, 0x31
jne 0x427f88
push 0
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x414672
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x445772]
cmp eax, 0x31
jne 0x427fe5
push 0
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xa8]
push edx
push 0x414307
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
jmp case.0x427d39.2
movsx eax, byte [0x445773]
cmp eax, 0x31
jne 0x42804d
push 1
push 0
push 0
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x41409b
push 0
push 0
call fcn.00414ccb
add esp, 0x1c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa044]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x404], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xa044]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xa044], eax
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00414979
jmp case.0x427d39.2
movsx eax, byte [0x445775]
cmp eax, 0x31
jne 0x42806f
push 1
mov eax, dword [ebp + 8]
add eax, 1
push eax
call fcn.0041400a
add esp, 8
jmp case.0x427d39.2
movsx eax, byte [0x445775]
cmp eax, 0x31
jne 0x428091
push 0
mov eax, dword [ebp + 8]
add eax, 1
push eax
call fcn.0041400a
add esp, 8
jmp case.0x427d39.2
movsx eax, byte [0x445774]
cmp eax, 0x31
jne 0x4280a6
call fcn.00414393
jmp case.0x427d39.2
push 1
push str.SeShutdownPrivilege
call fcn.00414b90
add esp, 8
mov esi, esp
push 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp esi, esp
call fcn.00414979
push 0
push str.SeShutdownPrivilege
call fcn.00414b90
add esp, 8
jmp case.0x427d39.2
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
call fcn.00414627
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.00414979
mov esp, ebp
pop ebp
ret 8