Function at 0x4061b0
Capabilities:
Check for time delay via gettickcount
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c4b8
push 0x40f0d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov edx, 1
mov byte [ebp - 0x2f], dl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x278], str.NVIconBeginEvent
mov dword [ebp - 0x274], 3
mov dword [ebp - 0x270], 0x424318
mov esi, 2
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], str.NVIconEndEvent
mov ecx, 4
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], 0x42431c
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], str.NVModeSwitchEvent
mov dword [ebp - 0x254], 5
mov dword [ebp - 0x250], 0x424320
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], str.NVDisplayChangeEvent
mov dword [ebp - 0x244], 7
mov dword [ebp - 0x240], 0x42432c
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], str.NVSessionChangeEvent
mov dword [ebp - 0x234], 8
mov dword [ebp - 0x230], 0x424330
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], str.NVDFPOff
mov dword [ebp - 0x224], 9
mov dword [ebp - 0x220], 0x424344
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], str.NVDFPOn
mov dword [ebp - 0x214], 0xa
mov dword [ebp - 0x210], 0x424348
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], str.NVScaleEvent
mov dword [ebp - 0x204], 0xb
mov dword [ebp - 0x200], 0x424324
mov dword [ebp - 0x1fc], esi
mov eax, str.NOT_A_NAMED_EVENT
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 0x1f0], 0x424580
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1e8], str.NVDXFullScreenEvent
mov dword [ebp - 0x1e4], 0xc
mov dword [ebp - 0x1e0], 0x424338
mov dword [ebp - 0x1dc], esi
mov dword [ebp - 0x1d8], str.NVThermalEvent
mov dword [ebp - 0x1d4], 0xd
mov dword [ebp - 0x1d0], 0x424334
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c8], str.NVPowerConnectorEvent
mov dword [ebp - 0x1c4], 0xe
mov dword [ebp - 0x1c0], 0x42433c
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1b8], str.NVWMDisplayChangeEvent
mov dword [ebp - 0x1b4], 0xf
mov dword [ebp - 0x1b0], 0x424350
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], str.NVWMDeviceChangeEvent
mov dword [ebp - 0x1a4], 0x10
mov dword [ebp - 0x1a0], 0x424354
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], str.NVLidChangeEvent
mov dword [ebp - 0x194], 0x11
mov dword [ebp - 0x190], 0x424358
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x188], str.NVInhibitChangeEvent
mov dword [ebp - 0x184], 0x12
mov dword [ebp - 0x180], 0x424360
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x178], str.NVHotPlugChangeEvent
mov dword [ebp - 0x174], 0x13
mov dword [ebp - 0x170], 0x424364
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], str.NVAGPConfigurationEvent
mov dword [ebp - 0x164], 0x14
mov dword [ebp - 0x160], 0x42435c
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x158], str.NVSmartDimmerEvent
mov dword [ebp - 0x154], 0x15
mov dword [ebp - 0x150], 0x424368
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x148], str.NVCplHotKeyEvent
mov dword [ebp - 0x144], 0x16
mov dword [ebp - 0x140], 0x42434c
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], str.NVFlushUnattachEvent
mov dword [ebp - 0x134], 0x17
mov dword [ebp - 0x130], 0x42436c
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], str.NV_WMIACPI_SilentModeEvent
mov dword [ebp - 0x124], 0x18
mov dword [ebp - 0x120], 0x424310
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], str.NVInduceDeviceScanEvent
mov dword [ebp - 0x114], 0x19
mov dword [ebp - 0x110], 0x424370
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], str.NVThermalHistoryOff
mov dword [ebp - 0x104], 0x1a
mov dword [ebp - 0x100], 0x424374
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], str.NVThermalHistoryOn
mov dword [ebp - 0xf4], 0x1b
mov dword [ebp - 0xf0], 0x424378
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], str.NVSetBrightnessRequestEvent
mov dword [ebp - 0xe4], 0x1c
mov dword [ebp - 0xe0], 0x42437c
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 0x1d
mov dword [ebp - 0xd0], 0x424380
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], str.NVGSyncSmartSyncLossEvent
mov dword [ebp - 0xc4], 0x1e
mov dword [ebp - 0xc0], 0x424384
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], str.NVGSyncSmartSyncGainEvent
mov dword [ebp - 0xb4], 0x1f
mov dword [ebp - 0xb0], 0x424388
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], str.NVGSyncSmartStereoLossEvent
mov dword [ebp - 0xa4], 0x20
mov dword [ebp - 0xa0], 0x42438c
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], str.NVGSyncSmartStereoGainEvent
mov dword [ebp - 0x94], 0x21
mov dword [ebp - 0x90], 0x424390
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], str.NVCoppEvent
mov dword [ebp - 0x84], 0x22
mov dword [ebp - 0x80], 0x424394
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], str.NVDpLinkTrainEvent
mov dword [ebp - 0x74], 0x23
mov dword [ebp - 0x70], 0x424398
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov ecx, 8
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x27c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x280], eax
mov dword [0x4286c0], 0x10
mov dword [0x4286c4], esi
xor ecx, ecx
mov eax, dword [0x4286dc]
cmp eax, 1
setle cl
dec ecx
and ecx, 0x48
add ecx, 7
mov dword [0x4286c8], ecx
cmp eax, 3
jl 0x4066f7
mov eax, ecx
or al, 0x80
mov dword [0x4286c8], eax
mov dword [0x4286cc], ebx
mov dword [0x4286d0], ebx
mov dword [0x4286d4], ebx
mov dword [0x4286d8], ebx
push 0x4286e0
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call edi
push 0x428500
call edi
push 0x428700
call edi
cmp dword [0x4243b4], ebx
jne 0x40674e
push 0x41fd78
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.EnumDisplayDevicesW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4243b4], eax
push str.wtsapi32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
mov dword [0x4242f8], eax
cmp eax, ebx
je 0x40678c
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x424300], eax
cmp eax, ebx
jne 0x40678c
mov edx, dword [0x4242f8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4242f8], ebx
push str.kernel32.dll
call edi
mov dword [0x4242fc], eax
cmp eax, ebx
je 0x4067cc
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x424304], eax
cmp eax, ebx
jne 0x4067c5
mov eax, dword [0x4242fc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4242fc], ebx
jmp 0x4067cc
call eax
mov dword [0x4242f0], eax
cmp dword [0x4286dc], 1
jle 0x4068ba
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ebx
mov word [ebp - 0x488], bx
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x486]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x488]
push ecx
call fcn.00404b00
add esp, 4
cmp eax, 1
jne 0x40688e
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
cmp eax, 1
jne 0x40688e
mov eax, dword [ebp - 0x288]
cmp eax, ebx
je 0x40688e
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
cmp eax, 1
jne 0x40688e
mov eax, dword [str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE10318]
cmp eax, ebx
je 0x406872
mov edi, 0x41f93c
mov ecx, dword [ebp - 0x288]
push ecx
push eax
call fcn.004053f0
add esp, 8
add edi, 4
mov eax, dword [edi]
cmp eax, ebx
jne 0x406859
call fcn.00404bd0
mov eax, dword [ebp - 0x288]
cmp eax, ebx
je 0x40688e
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x288], ebx
push str.RegisterServiceCtrlHandlerExW
mov edi, dword [ebp - 0x284]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp edi, ebx
je 0x4068ba
cmp eax, ebx
je 0x4068ba
push ebx
push fcn.004077b0
push str.NVSvc
call eax
mov dword [0x424314], eax
mov eax, dword [0x424314]
cmp eax, ebx
jne 0x4068fa
push 0x4078c0
push str.NVSvc
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x424314], eax
cmp eax, ebx
jne 0x4068fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4286cc], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00407dc0
mov dword [0x4286c4], esi
mov dword [0x4286d8], 0x1f4
push 0x4286c0
mov edx, dword [0x424314]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [0x4286c4], 4
mov dword [0x4286d8], ebx
push 0x212
push ebx
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
cmp eax, ebx
je 0x406951
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x40695b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
jmp 0x406961
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x424340], eax
cmp eax, ebx
jne 0x40698e
call edi
mov dword [0x4286cc], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5ac], 1
xor ecx, ecx
mov dword [ebp - 0x5b0], ecx
cmp dword [ebp - 0x278], ebx
je 0x4069c8
lea eax, [ebp - 0x278]
inc ecx
add eax, 0x10
cmp dword [eax], ebx
jne 0x4069ba
mov dword [ebp - 0x5b0], ecx
call fcn.00404810
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [0x4242e4], ecx
call fcn.00407ea0
mov dword [0x41f8a8], eax
cmp dword [0x4242e4], ebx
je 0x406a5d
call fcn.00402e00
test eax, eax
je 0x406a0f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404810
xor edx, edx
cmp eax, ebx
setne dl
mov dword [0x4242e4], edx
cmp dword [0x4242e4], ebx
je 0x406a5d
call edi
push 0x4286c0
call fcn.004085d0
add esp, 4
test eax, eax
jne 0x406a55
mov dword [0x4286c4], 1
mov dword [0x4286d8], 0x3e8
mov dword [0x4286cc], ebx
push 0x4286c0
mov eax, dword [0x424314]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x4242e4], ebx
jne 0x406aa5
push 0x42430c
lea ecx, [ebp - 0x5b4]
push ecx
call fcn.00405950
call fcn.00402cc0
call fcn.00403150
push ebx
call fcn.00401c40
add esp, 0xc
mov dword [0x41f034], eax
call fcn.004081a0
call fcn.00406150
call fcn.00404570
test eax, eax
je 0x406aa0
mov dword [ebp - 0x24], 1
call fcn.00408db0
push 0x4286c0
call fcn.004085d0
add esp, 4
test eax, eax
jne 0x406ac8
push 0x4286c0
mov edx, dword [0x424314]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.00404c50
mov dword [ebp - 0x5b8], eax
cmp eax, ebx
je 0x406adc
call fcn.00404d20
call fcn.00401bb0
mov dword [ebp - 0x5bc], eax
cmp eax, 1
jae 0x406af6
mov dword [ebp - 0x5bc], 1
mov eax, dword [0x4286c4]
cmp eax, 3
je 0x4073fc
cmp eax, 1
je 0x4073fc
cmp dword [ebp - 0x24], ebx
jne 0x4073fc
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x5b0], ebx
je 0x406d37
mov dword [ebp - 0x5c0], ebx
mov eax, dword [ebp - 0x5c0]
shl eax, 4
mov esi, dword [ebp + eax - 0x278]
cmp esi, ebx
je 0x406d2f
lea ecx, [ebp + eax - 0x270]
mov dword [ebp - 0x5c4], ecx
cmp dword [ecx], ebx
je 0x406d24
lea edi, [ebp + eax - 0x274]
mov dword [ebp - 0x5c8], edi
cmp dword [edi], 6
jne 0x406b83
cmp dword [0x4286dc], 1
jle 0x406b83
dec dword [ebp - 0x5b0]
mov dword [ecx], ebx
inc dword [ebp - 0x5c0]
jmp 0x406b2b
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x5cc], eax
test al, 5
jne 0x406bad
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x5c4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x406cca
test al, 4
je 0x406cca
lea edx, [ebp - 0x38]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x406c9a
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x5ec]
rep stosd dword es:[edi], eax
mov eax, 2
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], 5
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x5d0], ecx
lea edx, [ebp - 0x2c]
push edx
push ebx
lea eax, [ebp - 0x5ec]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [ebp - 0x5f0], eax
cmp eax, ebx
jne 0x406c9a
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x406c9a
push 1
mov ecx, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x406c9a
push ebx
mov edx, dword [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x406c9a
mov dword [ebp - 0x5fc], 0xc
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x5f8], ecx
mov dword [ebp - 0x5f4], ebx
push esi
push ebx
push ebx
lea edx, [ebp - 0x5fc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x5c4]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x406ca8
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x406cb6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x406cc4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x5c8]
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx]
mov eax, dword [eax]
cmp eax, ebx
je 0x406d24
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + ecx*4 - 0x518], eax
mov esi, dword [edi]
mov dword [ebp + ecx*4 - 0x5a8], esi
test byte [ebp - 0x5cc], 2
je 0x406d01
push eax
push esi
call fcn.00401510
add esp, 8
inc dword [ebp - 0x5ac]
dec dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x5c4]
mov dword [eax], ebx
cmp dword [edi], 5
jne 0x406d24
push 1
call fcn.00402ab0
add esp, 4
inc dword [ebp - 0x5c0]
jmp 0x406b2b
cmp dword [ebp - 0x5b0], ebx
jne 0x406d59
cmp dword [ebp - 0x5ac], ebx
je 0x406d59
mov edi, dword [ebp - 0x5b4]
mov dword [ebp - 0x600], edi
cmp edi, 0xffffffff
je 0x406d64
mov dword [ebp - 0x20], 1
jmp 0x406d64
mov edi, 0xfa0
mov dword [ebp - 0x600], edi
cmp dword [0x4243a4], ebx
je 0x406d7f
cmp edi, 0x3e8
jbe 0x406d7f
mov edi, 0x3e8
mov dword [ebp - 0x600], edi
cmp edi, 0x7530
jbe 0x406d92
mov edi, 0x7530
mov dword [ebp - 0x600], edi
cmp dword [ebp - 0x27c], ebx
jne 0x406dad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x280]
cmp eax, 0x7530
jb 0x406de1
mov dword [ebp - 0x27c], 1
call fcn.00408870
call fcn.004085e0
cmp dword [0x4243cc], ebx
je 0x406ddc
cmp edi, 0x3e8
jbe 0x406ddc
mov edi, 0x3e8
mov dword [ebp - 0x600], edi
call fcn.00408b50
cmp dword [ebp - 0x5ac], ebx
jne 0x406e01
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp dword [ebp - 0x5b8], ebx
je 0x406e2d
mov edi, 0x7d0
mov dword [ebp - 0x600], edi
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
jne 0x406e30
mov ecx, dword [ebp - 0x5bc]
push ecx
push edi
call fcn.00405370
add esp, 8
jmp 0x406e30
mov esi, dword [ebp - 0x1c]
push edi
push ebx
lea edx, [ebp - 0x518]
push edx
mov eax, dword [ebp - 0x5ac]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
mov dword [ebp - 0x604], edi
cmp edi, 0x102
jne 0x406e87
cmp dword [ebp - 0x20], ebx
je 0x406e60
call fcn.00407620
cmp dword [0x4243a4], ebx
je 0x406e76
call fcn.00406080
test eax, eax
jne 0x406e76
call fcn.00406140
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp edi, dword [ebp - 0x5ac]
jae 0x4073b4
mov dword [ebp - 0x5c0], edi
cmp dword [0x4242f4], ebx
je 0x406eba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4243b0]
cmp eax, 0x7d0
jbe 0x406eba
mov dword [0x4242f4], ebx
mov eax, dword [ebp + edi*4 - 0x5a8]
cmp eax, 0x23
ja case.default.0x406ee3
jmp dword [eax*4 + 0x407580]
mov ecx, dword [0x42439c]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x406ee3
jmp dword [eax*4 + 0x407610]
mov dword [0x4286c4], 3
mov dword [0x4286d8], 0x64
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov dword [ebp - 0x1c], 1
mov dword [0x4286c4], 7
cmp dword [0x424320], ebx
je 0x406f32
push 2
call fcn.00402ab0
add esp, 4
push 0x4286c0
mov edx, dword [0x424314]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov dword [ebp - 0x1c], ebx
mov dword [0x4286c4], 4
cmp dword [0x424320], ebx
je 0x406f74
push 1
call fcn.00402ab0
add esp, 4
push 0x4286c0
mov eax, dword [0x424314]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
push 0x4286c0
mov ecx, dword [0x424314]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
xor edx, edx
cmp eax, 3
sete dl
push edx
call fcn.00401b30
add esp, 4
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x402830
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x403690
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x4039e0
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push 0x41f94c
push 0x4037b0
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push 0x4243c0
push 0x4037b0
jmp 0x407395
call fcn.004045c0
mov dword [ebp - 0x604], eax
cmp esi, ebx
jne case.default.0x406ee3
call fcn.00402ae0
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
call fcn.00409a00
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push ebx
call fcn.004030d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push 1
call fcn.004030d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push ebx
call fcn.00404ed0
add esp, 4
test eax, eax
je case.default.0x406ee3
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push 1
call fcn.00404ed0
add esp, 4
test eax, eax
je case.default.0x406ee3
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov eax, dword [ebp + edi*4 - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x4034b0
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x4038c0
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x403b40
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x403bd0
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push 0x41f950
push 0x4037b0
jmp 0x407395
call fcn.00408530
cmp esi, ebx
jne case.default.0x406ee3
cmp dword [0x4243a4], ebx
je 0x40739d
call fcn.00406080
test eax, eax
jne 0x40739d
call fcn.00406140
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
call fcn.00405050
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x403290
jmp 0x407395
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x4033a0
jmp 0x407395
call fcn.00408cd0
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov dword [ebp - 0x608], ebx
cmp esi, ebx
jne case.default.0x406ee3
lea ecx, [ebp - 0x608]
push ecx
call fcn.00404ef0
add esp, 4
test eax, eax
je 0x40739d
push ebx
push ebx
push ebx
push 0x4038c0
jmp 0x407395
push ebx
push ebx
push ebx
push 0x403d80
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov dword [ebp - 0x60c], 1
jmp 0x40733d
mov dword [ebp - 0x60c], 2
push ebx
push ebx
lea eax, [ebp - 0x60c]
push eax
push 0x403e10
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov dword [ebp - 0x60c], 4
push ebx
push ebx
lea ecx, [ebp - 0x60c]
push ecx
push 0x403e10
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
mov dword [ebp - 0x60c], 8
push ebx
push ebx
lea edx, [ebp - 0x60c]
push edx
push 0x403e10
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x403e90
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp esi, ebx
jne case.default.0x406ee3
push ebx
push ebx
push ebx
push 0x403f40
call fcn.004031c0
add esp, 0x10
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp edi, 0xffffffff
jne 0x4073c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406af6
cmp dword [0x424320], ebx
je 0x40740d
push ebx
call fcn.00402ab0
add esp, 4
mov dword [0x4286c4], 3
mov dword [0x4286d4], 1
mov edi, 0x64
mov dword [0x4286d8], edi
push 0x4286c0
mov eax, dword [0x424314]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.00409030
call fcn.00408c40
call fcn.004089b0
call fcn.00404930
mov dword [0x4286d8], edi
xor eax, eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5ac], ebx
jle 0x4074be
test al, 7
jne 0x407493
mov dword [0x4286c4], 3
inc dword [0x4286d4]
push 0x4286c0
mov ecx, dword [0x424314]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [ebp - 0x5c0]
lea edi, [ebp + eax*4 - 0x518]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4074af
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp eax, dword [ebp - 0x5ac]
jl 0x407467
push 0x4286c0
call fcn.004085d0
add esp, 4
test eax, eax
jne 0x4074f1
mov dword [0x4286c4], 1
mov dword [0x4286d8], ebx
push 0x4286c0
mov edx, dword [0x424314]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0x4286e0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call edi
push 0x428500
call edi
push 0x428700
call edi
cmp dword [ebp - 0x24], ebx
je 0x40756b
lea eax, [ebp - 0x610]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x61c]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x614], esi
push ebx
push ebx
push ebx
lea edx, [ebp - 0x620]
push edx
push ebx
mov eax, dword [ebp - 0x610]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8