Function at 0x41532a
Capabilities:
Check for time delay via gettickcount
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov al, byte [0x4b3003]
or byte [0x4b3003], 0x80
mov byte [ebp - 1], al
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, dword [ebp + 0xc]
setne al
mov dword [ebp + 8], eax
mov eax, esi
and al, 0x70
neg al
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, esi
and al, 0x72
neg al
sbb eax, eax
neg eax
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], eax
je 0x415376
mov byte [ebp + 0xf], 1
jmp 0x415380
mov eax, esi
shr eax, 5
and al, 2
mov byte [ebp + 0xf], al
push edi
mov edi, esi
shr edi, 0xe
and edi, 1
call fcn.0040de7c
mov dword [ebp - 0xc], eax
shrd eax, edx, 0x10
push str.ASNT5SHUTDOWN
mov dword [ebp - 0xc], eax
shr edx, 0x10
call fcn.0040e72c
pop ecx
xor ecx, ecx
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x4153b8
mov eax, esi
not eax
inc ecx
and eax, ecx
jmp 0x4153bc
xor eax, eax
inc eax
inc ecx
cmp eax, ebx
je 0x4153d1
cmp dword [ebp - 0x18], ebx
je 0x4153d1
cmp dword [ebp - 0xc], 0x60002
mov dword [ebp - 8], ecx
jae 0x4153d4
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x4153e2
cmp dword [ebp - 0x10], ebx
je 0x4153e2
mov dword [ebp - 0xc], ecx
jmp 0x4153e9
cmp edi, ebx
mov dword [ebp - 0xc], ebx
jne 0x4153f1
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], ecx
jne 0x4153f4
mov dword [ebp - 0x10], ebx
push 0x12c
lea ecx, [ebp - 0x1c]
call fcn.00437072
movzx eax, byte [ebp + 0xf]
push eax
push dword [ebp - 0x18]
movzx eax, byte [ebp - 1]
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 0x20]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
push str._nBoot_0x_X__0x_X____S___Main0x_X__d_op__d__d:0x_X__d__d:_d_
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp - 0x1c]
call fcn.0040c4dd
and esi, 0xfffffffe
push esi
push dword [ebp + 0x10]
call fcn.0040e615
add esp, 0x40
push 2
push str.SeShutdownPrivilege
call fcn.0040fac5
push 2
push str.SeRemoteShutdownPrivilege
call fcn.0040fac5
add esp, 0x10
cmp dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
je 0x415531
push dword [ebp + 8]
push 1
push ebx
push 0x497994
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 8], ebx
call esi
mov edi, eax
add edi, 0x2710
call esi
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jle 0x415526
cmp byte [0x4ae290], bl
jle 0x415526
cmp ecx, ebx
jbe 0x415516
cmp ecx, 0x7d0
jbe 0x4154bc
mov ecx, 0x3e8
jmp 0x4154c4
cmp ecx, 0x64
jbe 0x4154c4
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x415516
cmp dword [ebp + 8], ebx
jg 0x4154e7
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x41551e
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41551e
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp + 8], ebx
jle 0x415516
dec dword [ebp + 8]
cmp byte [0x4ae290], bl
jg 0x4154d8
mov dword [ebp + 8], ebx
jmp 0x415493
push str.___next
call fcn.0040c4dd
pop ecx
cmp dword [ebp - 0xc], ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov edi, 0xffff
je 0x415551
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push ebx
push 1
push 0x16
push edi
call esi
cmp dword [ebp - 0x10], ebx
je 0x415574
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push ebx
push ebx
push 0x10
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push ebx
push ebx
push 2
push edi
call esi
cmp dword [ebp - 0x18], ebx
pop edi
je 0x4155a9
push str.NtShutdownSystem
push str.NTDLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
inc ecx
cmp eax, ebx
je 0x4155a7
xor ecx, ecx
cmp byte [ebp + 0xf], 1
setne cl
inc ecx
push ecx
call eax
mov ecx, eax
mov ebx, ecx
lea ecx, [ebp - 0x1c]
call fcn.00431c4c
pop esi
mov eax, ebx
pop ebx
leave
ret