Function at 0x1115e0a0
Capabilities:
Check for time delay via gettickcount
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111e8431
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ecx + 0x24]
mov edx, dword [ebx + 0x5f4]
mov edi, dword [ebp + 8]
xor eax, eax
cmp dword [0x1127aa48], 0xd0003
mov esi, dword [ebp + 0x10]
setl al
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebx + 0x5f8]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
dec eax
and eax, 0xc
add eax, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
push eax
push ecx
push edi
push str.NT::reboot_what_d__disconn_d__ccmode_d__bClientLoggingOff_d__bUserLoggingOff_d__n
call fcn.111bd7b0
add esp, 0x18
cmp edi, 3
jne 0x1115e181
cmp dword [0x1127aa48], 0xd0003
jl 0x1115e181
cmp dword [ebx + 0x594], 0
jne 0x1115e77b
mov edx, dword [0x1127aa74]
test edx, edx
jne 0x1115e77b
cmp dword [ebx + 0x5f4], edx
jne 0x1115e77b
cmp dword [ebx + 0x5f8], edx
jne 0x1115e77b
mov esi, dword [ebp - 0x28]
push 1
call fcn.11148cc0
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x1115e77b
mov dword [0x1127abe8], 1
jmp 0x1115e77b
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push 1
call edx
cmp dword [ebx + 0x594], 0
jne 0x1115e77b
mov eax, dword [0x1127aa74]
test eax, eax
jne 0x1115e77b
cmp edi, 3
jne 0x1115e234
mov esi, dword [ebp - 0x28]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x1c]
push 1
mov ecx, esi
call eax
test eax, eax
je 0x1115e77b
mov ecx, esi
call fcn.11150950
test eax, eax
je 0x1115e15e
cmp dword [ebx + 0x4d4], 0
je 0x1115e219
cmp dword [0x1127aa48], 0xc0003
jl 0x1115e219
push str.nsm_gina_lock
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
test edi, edi
je 0x1115e219
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x4c8], 1
jmp 0x1115e168
mov edx, dword [esi]
mov eax, dword [edx + 0xa0]
mov ecx, esi
call eax
mov dword [ebx + 0x4c8], 1
jmp 0x1115e168
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
or eax, 1
test byte [ebp + 0x14], 1
mov dword [ebp - 0x24], eax
je 0x1115e279
cmp dword [ebp + 0xc], 0
jne 0x1115e279
mov ecx, dword [ebx + 0xc64]
test ecx, ecx
je 0x1115e263
mov edx, eax
sub edx, ecx
cmp edx, 0x2710
jbe 0x1115e279
push str.Reboot_not_forcing_n
mov dword [ebp - 0x2c], 0
call fcn.111bd7b0
add esp, 4
jmp 0x1115e2d1
mov ecx, dword [ebx + 0xc64]
test ecx, ecx
je 0x1115e2bc
mov edx, eax
sub edx, ecx
cmp edx, 0x2710
ja 0x1115e2bc
cmp dword [ebp - 0x2c], 0x10
jne 0x1115e2bc
mov ecx, dword [0x1127aa68]
push 0
push 0
push str.DisableForceExit
push str.Client
call fcn.110bbc00
test eax, eax
mov eax, dword [ebp - 0x24]
jne 0x1115e2bc
mov dword [ebp - 0x2c], 4
cmp dword [0x1127acfc], 0
je 0x1115e2d4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x4c]
push 0
call edx
mov eax, dword [ebp - 0x24]
test esi, esi
jns 0x1115e2df
mov dword [ebp - 0x2c], 4
mov dword [ebx + 0xc64], eax
cmp edi, 1
je 0x1115e4e4
cmp edi, 4
je 0x1115e4e4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
push 0
push 0
call edx
test eax, eax
je 0x1115e77b
mov dword [ebx + 0x5f4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x29e4129f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov word [ebx + 0x88], cx
test cx, cx
jne 0x1115e347
mov eax, 1
mov word [ebx + 0x88], ax
mov ecx, dword [0x1127aa60]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
push 0
push 0
push 0x30000106
call eax
call fcn.1109d390
mov ecx, dword [0x1127aa5c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
cmp dword [0x1127aa48], 0xc0003
jl 0x1115e3b0
push str.nsm_gina_logoff
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebx, eax
test ebx, ebx
je 0x1115e3b0
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov eax, dword [edx + 0xa0]
call eax
jmp 0x1115e77b
test esi, esi
jle 0x1115e4a9
push esi
lea ecx, [ebp - 0x64]
push 0x484
push ecx
call fcn.11153980
add esp, 0xc
push 0
mov ecx, eax
mov dword [ebp - 4], 8
call fcn.1102f630
push eax
call fcn.111b7990
mov ebx, eax
add esp, 8
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xa
call fcn.1113cd80
call fcn.111b8750
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x24], eax
call fcn.11063020
mov eax, ebx
mov byte [ebp - 4], 0xb
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1115e410
sub eax, edx
sar eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
lea edx, [eax + 2]
jmp 0x1115e430
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1115e430
sub eax, edx
push 0
lea edx, [ebp - 0x40]
push edx
sar eax, 1
push esi
mov ebx, eax
call fcn.111bbe50
mov edx, dword [ebp - 0x30]
neg eax
sbb eax, eax
and eax, 0x180000
push eax
mov eax, dword [ebp - 0x28]
lea ecx, [eax + eax]
push ecx
mov ecx, dword [ebp - 0x24]
push edx
lea eax, [ebx + ebx]
push eax
push ecx
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0xa4]
call fcn.11148930
push 0
shl edi, 0x10
or edi, esi
push edi
push 0x11149bb0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x1115e49d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x30]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, dword [ebp - 0x2c]
push esi
push str.Logoff__forceflagsx_x_n
call fcn.111bd7b0
add esp, 8
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1115e77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExitWindowsEx___ret_false__gle_d_n
call fcn.111bd7b0
add esp, 8
jmp 0x1115e77b
lea eax, [ebp - 0x34]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1115e77b
lea ecx, [ebp - 0x1c]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x34]
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
push 0
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x28]
push 1
push 0
call fcn.1115d5e0
cmp edi, 4
jne 0x1115e663
test esi, esi
jle 0x1115e63b
push esi
lea ecx, [ebp - 0x54]
push 0x482
push ecx
call fcn.11153980
add esp, 0xc
push 0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1102f630
push eax
call fcn.111b7990
mov ebx, eax
add esp, 8
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.1113cd80
call fcn.111b8750
mov edi, eax
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x24], edi
call fcn.11063020
mov eax, ebx
mov byte [ebp - 4], 3
lea edx, [eax + 2]
jmp 0x1115e5b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1115e5b0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x30], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1115e5c7
sub eax, edx
push 0
lea edx, [ebp - 0x38]
push edx
sar eax, 1
push esi
mov edi, eax
call fcn.111bbe50
neg eax
sbb eax, eax
and eax, 0x180000
push eax
mov eax, dword [ebp - 0x30]
lea ecx, [eax + eax]
mov eax, dword [ebp - 0x24]
push ecx
push ebx
lea edx, [edi + edi]
push edx
push eax
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0xd4]
call fcn.11148930
push 0
or esi, 0x40000
push esi
push 0x11149bb0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov eax, dword [ebp - 0xd4]
test eax, eax
je 0x1115e632
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [0x1127aa48], 0x180003
mov eax, dword [ebp - 0x2c]
jl 0x1115e64f
or eax, 0x400000
push 0x40000
or eax, 8
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1115e77b
test esi, esi
jle 0x1115e759
push esi
lea ecx, [ebp - 0x74]
push 0x483
push ecx
call fcn.11153980
add esp, 0xc
push 0
mov ecx, eax
mov dword [ebp - 4], 4
call fcn.1102f630
push eax
call fcn.111b7990
mov ebx, eax
add esp, 8
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 6
call fcn.1113cd80
call fcn.111b8750
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x30], eax
call fcn.11063020
mov eax, ebx
mov byte [ebp - 4], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1115e6c3
sub eax, edx
sar eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
lea edx, [eax + 2]
jmp 0x1115e6e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1115e6e0
sub eax, edx
push 0
lea edx, [ebp - 0x3c]
push edx
sar eax, 1
push esi
mov ebx, eax
call fcn.111bbe50
mov edx, dword [ebp - 0x24]
neg eax
sbb eax, eax
and eax, 0x180000
push eax
mov eax, dword [ebp - 0x28]
lea ecx, [eax + eax]
push ecx
mov ecx, dword [ebp - 0x30]
push edx
lea eax, [ebx + ebx]
push eax
push ecx
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x104]
call fcn.11148930
push 0
shl edi, 0x10
or edi, esi
push edi
push 0x11149bb0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x1115e74d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x24]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, dword [ebp - 0x2c]
push esi
push str.Reboot__forceflagsx_x_n
call fcn.111bd7b0
add esp, 8
push 0
or esi, 2
push esi
push 0x11149bf0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 0x10