Function at 0x427100
Capabilities:
Create restart manager session
Enumerate processes that use resource
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b00
call fcn.00445740
mov eax, dword [0x49d310]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1ad0], ecx
sub esp, 0x18
mov ecx, esp
push 0x49eda8
call fcn.004247df
lea eax, [ebp - 0x1b00]
push eax
lea ecx, [ebp - 0x1a63]
call fcn.00440720
push eax
lea eax, [ebp - 0x1ae8]
push eax
lea ecx, [ebp - 0x1a62]
call fcn.00443970
mov dword [ebp - 0x1aac], eax
mov ecx, dword [ebp - 0x1aac]
call fcn.004251bc
mov dword [ebp - 0x1ab0], eax
push dword [ebp - 0x1ab0]
lea ecx, [ebp - 0x1a61]
call fcn.00445100
mov dword [ebp - 0x1aa0], eax
lea ecx, [ebp - 0x1ae8]
call fcn.0042545b
lea ecx, [ebp - 0x1b00]
call fcn.004253b4
push dword [0x49d114]
push dword [ebp - 0x1aa0]
lea ecx, [ebp - 0x1a61]
call fcn.00445010
mov dword [ebp - 0x1ac4], eax
push dword [0x49d110]
push dword [ebp - 0x1aa0]
lea ecx, [ebp - 0x1a61]
call fcn.00445010
mov dword [ebp - 0x1ab4], eax
push 0x42
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.0045fb30
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x1a68]
push eax
call sub.RstrtMgr.DLL_RmStartSession
mov dword [ebp - 0x1a94], eax
cmp dword [ebp - 0x1a94], 0
jne 0x4273b1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1a8c]
push eax
lea ecx, [ebp - 0x1a62]
call fcn.00443970
lea ecx, [ebp - 0x1a8c]
call fcn.004251bc
mov dword [ebp - 0x1a90], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1a90]
push eax
push 1
push dword [ebp - 0x1a68]
call sub.RstrtMgr.DLL_RmRegisterResources
mov dword [ebp - 0x1a94], eax
cmp dword [ebp - 0x1a94], 0
jne 0x42739b
mov dword [ebp - 0x1a6c], 0xa
lea eax, [ebp - 0x1a70]
push eax
lea eax, [ebp - 0x1a60]
push eax
lea eax, [ebp - 0x1a6c]
push eax
lea eax, [ebp - 0x1a74]
push eax
push dword [ebp - 0x1a68]
call sub.RstrtMgr.DLL_RmGetList
mov dword [ebp - 0x1a94], eax
cmp dword [ebp - 0x1a94], 0
jne 0x42739b
and dword [ebp - 0x1a9c], 0
jmp 0x4272b4
mov eax, dword [ebp - 0x1a9c]
inc eax
mov dword [ebp - 0x1a9c], eax
mov eax, dword [ebp - 0x1a9c]
cmp eax, dword [ebp - 0x1a6c]
jae 0x42739b
mov dword [ebp - 0x1abc], 1
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x1ab4]
mov dword [ebp - 0x1ac0], eax
imul eax, dword [ebp - 0x1a9c], 0x29c
push dword [ebp + eax - 0x1a60]
push dword [ebp - 0x1ab8]
push dword [ebp - 0x1abc]
mov eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0x1aa4], eax
mov ecx, dword [ebp - 0x1aa4]
call dword [0x485218]
call dword [ebp - 0x1aa4]
mov dword [ebp - 0x1a98], eax
cmp dword [ebp - 0x1a98], 0
je 0x427396
mov eax, dword [ebp - 0x1ac4]
mov dword [ebp - 0x1ac8], eax
push 0
push dword [ebp - 0x1a98]
mov eax, dword [ebp - 0x1ac8]
mov dword [ebp - 0x1aa8], eax
mov ecx, dword [ebp - 0x1aa8]
call dword [0x485218]
call dword [ebp - 0x1aa8]
push 0
push dword [ebp - 0x1a98]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x42737f
push 0xffffffffffffffff
push dword [ebp - 0x1a98]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1a98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4272a7
push dword [ebp - 0x1a68]
call sub.RstrtMgr.DLL_RmEndSession
lea ecx, [ebp - 0x1a8c]
call fcn.0042545b
and dword [ebp - 0x1acc], 0
lea ecx, [ebp + 8]
call fcn.004253b4
mov eax, dword [ebp - 0x1acc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445680
leave
ret 0x18