Function at 0x1001fb2
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1005274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x1001364
push edi
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
push 0x100135c
lea eax, [ebp - 0x88]
push 0x41
push eax
call sub.msvcrt.dll_swprintf_s
lea eax, [ebp - 0x88]
push eax
push 2
call dword [sym.imp.msvcrt.dll__wsetlocale]
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
mov ebx, dword [ebp + 8]
push ebx
call fcn.0100308c
cmp eax, edi
jne 0x1002034
push 0x64
call fcn.01002930
xor eax, eax
pop ecx
inc eax
jmp 0x10022a3
push esi
push edi
mov esi, section..data
push esi
add eax, 4
push eax
dec ebx
push ebx
call fcn.01002cfe
movzx eax, ax
cmp word [0x10052a0], di
jne 0x100229a
cmp eax, edi
je 0x1002063
test al, 8
je 0x100228e
push 0x10011ac
push esi
call fcn.01002ae2
test al, al
jne 0x1002082
call fcn.01002a43
test eax, eax
jne 0x1002082
push 0xd2
jmp 0x10020c6
push 0x1005780
call fcn.01001dd5
test al, al
je 0x1002295
push 0x10011bc
push esi
call fcn.01002ae2
test al, al
jne 0x10020d0
call fcn.01002a2e
mov dword [ebp - 0x8c], eax
cmp word [0x10052a8], di
jne 0x10020c4
cmp word [0x1005780], di
je 0x10021b0
push 0x6b
call fcn.01002930
jmp 0x1002281
cmp word [0x10052a8], di
je 0x100211e
push 0xa
lea eax, [ebp - 0x90]
push eax
mov esi, 0x1005680
push esi
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, dword [ebp - 0x90]
add esp, 0xc
mov dword [ebp - 0x8c], eax
cmp word [ecx], di
jne 0x1002284
cmp eax, 0xffffffff
je 0x1002284
lea ecx, [ebp - 0x94]
push ecx
push eax
call fcn.01001f11
jmp 0x100219a
movzx eax, word [0x1005680]
push 4
push eax
call dword [sym.imp.msvcrt.dll_iswctype]
pop ecx
pop ecx
mov esi, 0x1005680
test eax, eax
jne 0x100215c
lea eax, [ebp - 0x8c]
push eax
push esi
push dword [0x10052b0]
call sub.WINSTA.dll_LogonIdFromWinStationNameW
test al, al
jne 0x10021d8
push esi
push 0x66
jmp 0x1002287
push 0xa
lea eax, [ebp - 0x90]
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, dword [ebp - 0x90]
add esp, 0xc
mov dword [ebp - 0x8c], eax
cmp word [ecx], di
jne 0x1002284
cmp eax, 0xffffffff
je 0x1002284
push esi
push eax
push dword [0x10052b0]
call sub.WINSTA.dll_WinStationNameFromLogonIdW
test al, al
jne 0x10021d8
push dword [ebp - 0x8c]
push 0x68
call fcn.01002930
jmp 0x1002280
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x10022a0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x6a
call fcn.01002930
pop ecx
pop ecx
jmp 0x1002277
cmp word [0x10052a8], di
je 0x100222c
push 0x1005720
push dword [ebp - 0x94]
push 0x10056e0
cmp word [0x10052ac], di
jne 0x100221d
push 0xd4
call fcn.0100274e
push dword [sym.imp.msvcrt.dll__iob]
call sub.msvcrt.dll_fgetwc
add esp, 0x14
cmp ax, 0x6e
jne 0x1002247
jmp 0x10022a0
push 0xd3
call fcn.0100274e
add esp, 0x10
jmp 0x1002247
cmp word [0x10052a4], di
je 0x1002247
push dword [ebp - 0x8c]
push 0xc8
call fcn.0100274e
pop ecx
pop ecx
push 1
push dword [ebp - 0x8c]
push dword [0x10052b0]
call sub.WINSTA.dll_WinStationReset
test al, al
jne 0x10022a0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push dword [ebp - 0x8c]
push 0x69
call fcn.01002930
add esp, 0xc
push edi
call esi
push eax
call fcn.0100286c
pop ecx
pop ecx
jmp 0x1002295
push esi
push 0x67
call fcn.010029d8
jmp 0x1002295
push 1
call fcn.01001e32
xor eax, eax
inc eax
jmp 0x10022a2
push edi
call fcn.01001e32
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.010040c3
leave
ret