Function at 0x422d20
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b3d28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x4b5110
call dword [sym.imp.AceBoard.dll_public:_int___thiscall_CAceBoard::GetQueueDataSize_void_]
mov esi, eax
test esi, esi
jle 0x422e23
mov edi, dword [sym.imp.AceBoard.dll_public:_int___thiscall_CAceBoard::GetQueueData_unsigned_char__]
nop dword [eax]
lea eax, [ebp - 0x15]
mov ecx, 0x4b5110
push eax
call edi
test eax, eax
je 0x422e1a
mov ecx, dword [0x4b4eb4]
test ecx, ecx
jne 0x422d8d
cmp byte [ebp - 0x15], 0x30
jne 0x422e1a
mov byte [0x4b4db0], 0x30
mov dword [0x4b4eb4], 1
jmp 0x422e1a
mov al, byte [ebp - 0x15]
cmp ecx, 1
jne 0x422db1
mov byte [0x4b4db1], al
movzx eax, al
add eax, 2
mov dword [0x4b4eb4], 2
mov dword [0x4b4eb0], eax
jmp 0x422e1a
mov edx, dword [0x4b4eb0]
mov byte [ecx + 0x4b4db0], al
inc ecx
mov dword [0x4b4eb4], ecx
lea eax, [edx + 2]
cmp ecx, eax
jne 0x422e1a
movzx eax, byte [ecx + 0x4b4daf]
push edx
push 0x4b4db0
push eax
movzx eax, byte [ecx + 0x4b4dae]
push eax
call fcn.00423420
add esp, 0x10
test eax, eax
je 0x422df2
call fcn.00422710
push 0xff
push 0
push 0x4b4db0
call fcn.00451c30
add esp, 0xc
mov dword [0x4b4eb4], 0
mov dword [0x4b4eb0], 0
sub esi, 1
jne 0x422d50
mov ecx, dword [0x4b4ec4]
mov edi, dword [sym.imp.AceBoard.dll_public:_int___thiscall_CAceBoard::CloseAcePort_void_]
test ecx, ecx
je 0x422ec4
cmp byte [0x4b4d09], 0
je 0x4233df
mov ecx, 0x4b5110
mov byte [0x4b4d09], 0
mov dword [0x4b4eec], 0
call edi
push 0x4b00
push 0x4b4da8
mov ecx, 0x4b5110
call dword [sym.imp.AceBoard.dll_public:_int___thiscall_CAceBoard::OpenAcePort_char___unsigned_long_int_]
mov eax, dword [0x4b4ee8]
mov ecx, eax
push 0
push 0
push 0
push ecx
inc eax
push 0
push 2
mov dword [0x4b4ee8], eax
call fcn.004223a0
xor ecx, ecx
mov dword [0x4b60f8], 1
add esp, 0x18
mov dword [0x4b4ec4], ecx
or esi, 0xffffffff
mov dword [0x4b4ef4], ecx
mov dword [0x4b60f4], esi
mov dword [0x4b4ef8], ecx
mov dword [0x4b4f00], 0xa
jmp 0x422f01
cmp byte [0x4b60d9], 0
mov esi, dword [0x4b60f4]
je 0x422ef7
mov eax, dword [0x4b4efc]
inc eax
mov dword [0x4b4efc], eax
cmp eax, 0xe10
jle 0x422f01
mov ecx, 0xcb
mov byte [0x4b4d09], 1
mov dword [0x4b4ec4], ecx
mov dword [0x4b4efc], 0
cmp dword [0x4b4eec], 0
je 0x422f9a
cmp dword [0x4b4ef4], 0x64
jne 0x422f84
cmp dword [0x4b4ef8], 2
jne 0x422f4e
inc dword [0x4b4ef4]
pop edi
mov dword [0x4b4ec4], 0xcb
mov byte [0x4b4d09], 1
mov byte [0x4b60d9], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4b4ee8]
mov ecx, eax
inc dword [0x4b4ef8]
inc eax
push 0
push 0x4b5008
push 0x4b4f08
push ecx
push 0
push 0
mov dword [0x4b4ef4], 0xffffffff
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
inc dword [0x4b4ef4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret
cmp dword [0x4b4eb8], 0
mov dword [0x4b4ef4], 0
mov dword [0x4b4ef8], 0
je 0x423085
cmp ecx, 3
je 0x423085
cmp dword [0x4b5108], 0x78
jl 0x423027
mov eax, dword [0x4b4ee8]
mov ecx, eax
push 0
push 0
push 0
push ecx
inc eax
mov dword [0x4b5108], 0
push 0
push 4
mov dword [0x4b4ee8], eax
call fcn.004223a0
mov eax, dword [0x4b8434]
add esp, 0x18
mov ecx, dword [0x4b4bc0]
mov eax, dword [eax + 0xc]
cmp eax, dword [ecx + 0x22c]
je 0x4230a0
mov dword [ecx + 0x22c], eax
mov esi, dword [0x4b60f4]
mov dword [0x4b4ec0], 0
mov ecx, dword [0x4b4bc0]
test ecx, ecx
je 0x42308b
push 0x1d
push 0x3e8
call fcn.004157b0
test eax, eax
je 0x42307f
mov eax, dword [0x4b5108]
inc eax
mov dword [0x4b5108], eax
cmp eax, 1
jne 0x42307f
cmp dword [0x4b4ec0], 0
jne 0x42307f
push 0
push 0
mov dword [0x4b4ec0], eax
mov eax, dword [0x4b4ee8]
mov ecx, eax
push 0
push ecx
inc eax
push 0
push 6
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
mov esi, dword [0x4b60f4]
mov ecx, dword [0x4b4bc0]
mov eax, dword [0x4b60f8]
cmp eax, 0xb
ja case.default.0x423099
jmp dword [eax*4 + 0x4233f0]
mov esi, dword [0x4b60f4]
jmp 0x42302d
mov edi, dword [0x4b4f00]
test esi, esi
mov eax, 0xa
cmove edi, eax
mov eax, 0x88888889
imul esi
mov dword [0x4b4f00], edi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
shl ecx, 4
sub ecx, eax
mov eax, esi
shl ecx, 2
sub eax, ecx
jne case.default.0x423099
sub edi, 1
mov dword [0x4b4f00], edi
jne case.default.0x423099
mov dword [0x4b4ec4], eax
or esi, 0xffffffff
mov dword [0x4b60f8], 3
jmp 0x4233d8
mov dword [0x4b60f8], 2
or esi, 0xffffffff
jmp 0x4233d8
mov dword [0x4b60f8], 3
mov esi, 0xfffffff6
jmp 0x4233d8
test esi, esi
jne 0x423156
mov eax, dword [0x4b4ee8]
mov ecx, eax
push esi
push esi
push esi
push ecx
inc eax
push esi
push 1
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
jmp 0x4233ca
cmp dword [0x4b4eb8], 0
jne 0x42331e
mov byte [0x4b60d9], 1
jmp case.default.0x423099
test ecx, ecx
je case.default.0x423099
cmp dword [ecx + 0x3e4], 1
jne 0x4231bc
push 0
mov dword [ecx + 0x3e4], 0
mov eax, dword [0x4b4ee8]
mov ecx, eax
push 0
push 0
push ecx
inc eax
push 5
push 3
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
mov dword [0x4b60f8], 5
or esi, 0xffffffff
jmp 0x4233d8
mov dword [ecx + 0x390], 1
jmp 0x4233ca
test esi, esi
jne 0x4231fb
mov eax, dword [0x4b4ee8]
mov ecx, eax
inc eax
mov dword [0x4b4ee8], eax
mov eax, dword [0x4b4bbc]
push dword [eax + 0x1804]
push esi
push esi
push ecx
push 2
push 3
call fcn.004223a0
add esp, 0x18
jmp 0x4233ca
cmp esi, 1
jne case.default.0x423099
mov eax, dword [0x4b4ee8]
mov esi, eax
inc eax
mov dword [0x4b4ee8], eax
call fcn.00448270
add eax, dword [0x4b8640]
push eax
push 0
push 0
push esi
push 1
push 3
call fcn.004223a0
add esp, 0x18
mov dword [0x4b60f8], 6
or esi, 0xffffffff
jmp 0x4233d8
cmp dword [ecx + 0x3e4], 2
jne case.default.0x423099
mov dword [0x4b60f4], 0xffffffff
mov dword [0x4b60f8], 7
call fcn.00448400
mov dword [0x4b4ebc], eax
jmp 0x4233ca
test esi, esi
jne 0x42329b
push dword [0x4b4ebc]
mov eax, dword [0x4b4ee8]
mov ecx, eax
push esi
push esi
push ecx
inc eax
push 3
push 3
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
jmp 0x4233ca
cmp esi, 1
jne case.default.0x423099
mov eax, dword [0x4b4ee8]
mov esi, eax
inc eax
mov dword [0x4b4ee8], eax
call fcn.00448360
push eax
push 0
push 0
push esi
push 4
push 3
call fcn.004223a0
add esp, 0x18
mov dword [0x4b60f8], 8
or esi, 0xffffffff
jmp 0x4233d8
test esi, esi
jne case.default.0x423099
mov eax, dword [0x4b4ee8]
mov ecx, eax
push esi
push esi
push esi
push ecx
inc eax
push 6
push 3
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
mov dword [0x4b60f8], 9
or esi, 0xffffffff
jmp 0x4233d8
cmp dword [ecx + 0x3e4], 3
jne case.default.0x423099
mov dword [0x4b60f8], 4
or esi, 0xffffffff
jmp 0x4233d8
push 0
mov eax, 1
push 0
mov word [0x4b3548], ax
mov eax, dword [0x4b4ee8]
mov edx, eax
push 0
push edx
inc eax
push 0
push 2
mov dword [0x4b4ee8], eax
call fcn.004223a0
add esp, 0x18
mov ecx, 0x4b5110
call edi
mov ecx, 0x4b5118
call fcn.004159a0
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [0x4b60f8], 0xa
push 0
jne 0x4233c2
push 5
jmp 0x4233c4
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, dword [0x4b60f4]
cmp esi, 0xfde8
jge 0x4233df
inc esi
mov dword [0x4b60f4], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044f9e2
mov esp, ebp
pop ebp
ret