Function at 0x409e50
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [0x44eec0], ebx
je 0x40a4f9
push esi
mov esi, 0xcb
cmp dword [0x44f054], ebx
je 0x409ec9
cmp byte [0x44ef26], bl
je 0x40a4f8
push 1
push ebx
push ebx
push ebx
push 2
mov byte [0x44ef26], bl
mov dword [0x44f060], ebx
call fcn.00409e20
add esp, 0x14
mov dword [0x44f054], ebx
mov dword [0x4506c4], 1
mov dword [0x4506bc], 0xffffffff
mov dword [0x44f064], ebx
mov dword [0x44f068], ebx
mov dword [0x44f070], 0xa
jmp 0x409ef6
cmp byte [0x451ed5], bl
je 0x409ef0
mov eax, dword [0x44f06c]
inc eax
cmp eax, 0xe10
mov dword [0x44f06c], eax
jle 0x409ef6
mov dword [0x44f054], esi
mov byte [0x44ef26], 1
mov dword [0x44f06c], ebx
mov eax, dword [0x44eec0]
mov ecx, dword [eax + 0x18fc]
test ecx, ecx
je 0x409f57
mov eax, dword [0x44f064]
cmp eax, 0x64
jne 0x409f4b
cmp dword [0x44f068], 2
jne 0x409f42
mov dword [0x44f054], esi
inc eax
pop esi
mov byte [0x44ef26], 1
mov byte [0x451ed5], 1
mov dword [0x451ec8], 0x191
mov dword [0x44f064], eax
pop ebx
add esp, 0x14
ret
inc dword [0x44f068]
or eax, 0xffffffff
inc eax
pop esi
mov dword [0x44f064], eax
pop ebx
add esp, 0x14
ret
push edi
mov dword [0x44f064], ebx
mov dword [0x44f068], ebx
mov edi, 4
cmp byte [0x4506af], bl
je 0x40a039
cmp dword [0x44f054], 3
je 0x40a039
cmp dword [0x44f278], 0x96
jge 0x409fa4
call fcn.004251c0
lea esi, [edi - 3]
test al, al
jne 0x409feb
cmp dword [0x4506b0], esi
jl 0x409feb
jmp 0x409fa9
mov esi, 1
cmp dword [0x44f278], 0x96
mov dword [0x4506b0], ebx
jl 0x409fde
mov eax, dword [0x44f27c]
add eax, esi
cmp eax, 0x16
mov dword [0x44f278], ebx
mov dword [0x44f27c], eax
jle 0x409fde
mov dword [0x44f27c], ebx
mov dword [0x44f050], ebx
push esi
push ebx
push ebx
push ebx
push edi
call fcn.00409e20
add esp, 0x14
mov ecx, dword [0x44ed48]
cmp ecx, ebx
je 0x40a044
push 0x31
push 0x384
call fcn.00402510
test eax, eax
je 0x40a03e
mov eax, dword [0x44f278]
add dword [0x4506b0], esi
add eax, esi
mov dword [0x44f278], eax
cmp eax, esi
jne 0x40a03e
cmp dword [0x44f050], ebx
jne 0x40a03e
push esi
push ebx
push ebx
push ebx
push 6
mov dword [0x44f050], esi
call fcn.00409e20
add esp, 0x14
jmp 0x40a03e
mov esi, 1
mov ecx, dword [0x44ed48]
mov eax, dword [0x4506c4]
cmp eax, 0xf
ja case.0x40a052.6
jmp dword [eax*4 + 0x40a500]
mov esi, dword [0x4506bc]
cmp esi, ebx
jne 0x40a06d
mov dword [0x44f070], 0xa
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 4
sub edx, eax
add edx, edx
add edx, edx
mov eax, esi
sub eax, edx
jne 0x40a4e8
sub dword [0x44f070], 1
jne 0x40a4e8
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x44f054], ebx
mov dword [0x4506c4], 3
pop ebx
add esp, 0x14
ret
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 2
pop ebx
add esp, 0x14
ret
mov esi, 0xfffffff6
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 3
pop ebx
add esp, 0x14
ret
mov esi, dword [0x4506bc]
cmp esi, ebx
jne 0x40a119
push 1
push ebx
push ebx
push ebx
push 1
call fcn.00409e20
add esp, 0x14
jmp case.0x40a052.6
cmp byte [0x4506af], bl
jne 0x40a459
mov byte [0x451ed5], 1
mov dword [0x451ec8], 0x1f5
jmp 0x40a4e8
cmp ecx, ebx
je case.0x40a052.6
cmp dword [ecx + 0x9a8], esi
jne 0x40a17b
push esi
push ebx
push ebx
push 5
push 3
mov dword [ecx + 0x9a8], ebx
call fcn.00409e20
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 5
pop ebx
add esp, 0x14
ret
mov dword [ecx + 0x63c], esi
jmp case.0x40a052.6
mov esi, dword [0x4506bc]
cmp esi, ebx
jne 0x40a1aa
push 1
push ebx
call fcn.004251b0
push eax
push 2
push 3
call fcn.00409e20
add esp, 0x14
jmp case.0x40a052.6
cmp esi, 1
jl 0x40a4e8
cmp dword [ecx + 0x9a4], 2
jne 0x40a4e8
push 1
push ebx
call fcn.00425210
add eax, dword [0x452284]
push eax
push 1
push 3
call fcn.00409e20
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 6
pop ebx
add esp, 0x14
ret
mov eax, dword [ecx + 0x9a8]
add eax, 0xfffffffc
cmp eax, edi
ja case.0x40a052.6
jmp dword [eax*4 + 0x40a540]
push esi
push ebx
push ebx
push 0x80
push 3
mov dword [0x4522b0], ebx
call fcn.00409e20
mov ecx, dword [0x44ed48]
add esp, 0x14
mov dword [ecx + 0x9a8], ebx
jmp case.0x40a052.6
mov edx, dword [0x4522b0]
sub edx, dword [0x4522b4]
push esi
push ebx
push edx
push 0x84
push 3
call fcn.00409e20
mov eax, dword [0x44ed48]
mov dword [eax + 0x9a8], 6
mov ecx, dword [0x44ed48]
add esp, 0x14
mov dword [ecx + 0x9a4], ebx
jmp case.0x40a052.6
cmp dword [ecx + 0x9a4], 0x84
jne case.0x40a052.6
mov eax, dword [0x4522b8]
add eax, dword [0x4522b0]
push esi
mov dword [0x4522b8], eax
sub eax, dword [0x4522b4]
push ebx
push eax
push 0x85
push 3
call fcn.00409e20
mov edx, dword [0x44ed48]
mov dword [edx + 0x9a8], ebx
mov eax, dword [0x44ed48]
add esp, 0x14
mov dword [eax + 0x9a4], ebx
jmp case.0x40a052.6
push esi
push ebx
push ebx
push 0x81
push 3
call fcn.00409e20
mov ecx, dword [0x44ed48]
mov dword [ecx + 0x9a8], ebx
mov edx, dword [0x44ed48]
add esp, 0x14
mov dword [edx + 0x9a4], ebx
jmp case.0x40a052.6
mov esi, dword [0x4506bc]
cmp esi, ebx
jne 0x40a31c
mov eax, dword [0x44f04c]
push 1
push ebx
push eax
push 3
push 3
call fcn.00409e20
add esp, 0x14
jmp case.0x40a052.6
cmp esi, 1
jl 0x40a4e8
cmp dword [ecx + 0x9a4], 3
jne 0x40a4e8
push 1
push ebx
call fcn.00425220
push eax
push edi
push 3
call fcn.00409e20
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 0xb
pop ebx
add esp, 0x14
ret
push esi
mov dword [ecx + 0x9a4], ebx
mov ecx, dword [0x4522b4]
push ebx
push ecx
push 3
push 3
call fcn.00409e20
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 0x10
pop ebx
add esp, 0x14
ret
push esi
push ebx
mov dword [ecx + 0x9a4], ebx
call fcn.00425220
push eax
push edi
push 3
call fcn.00409e20
push 0xa
call fcn.00425190
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
pop ebx
add esp, 0x14
ret
cmp dword [ecx + 0x9a4], edi
jne case.0x40a052.6
push esi
push ebx
push ebx
push 6
push 3
mov dword [ecx + 0x9a4], ebx
call fcn.00409e20
push 0xc
call fcn.00425190
add esp, 0x18
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
pop ebx
add esp, 0x14
ret
mov esi, dword [0x4506bc]
cmp esi, ebx
jl 0x40a4e8
cmp dword [ecx + 0x9a4], edi
jne 0x40a4e8
push 1
push ebx
push ebx
push 6
push 3
mov dword [ecx + 0x9a4], ebx
call fcn.00409e20
add esp, 0x14
or esi, 0xffffffff
inc esi
pop edi
mov dword [0x4506bc], esi
pop esi
mov dword [0x4506c4], 0xc
pop ebx
add esp, 0x14
ret
cmp dword [ecx + 0x9a8], 3
jne case.0x40a052.6
or esi, 0xffffffff
inc esi
mov dword [0x4506c4], edi
pop edi
mov dword [0x4506bc], esi
pop esi
pop ebx
add esp, 0x14
ret
push esi
push ebx
push ebx
mov edx, esi
push ebx
push 2
mov word [0x44d078], dx
call fcn.00409e20
add esp, 0x14
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x14]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0xc]
push ebx
push ebx
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [0x4506c4], 0xe
push ebx
jne 0x40a4da
push 5
jmp 0x40a4dc
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, dword [0x4506bc]
cmp esi, 0xfde8
jge 0x40a4f7
inc esi
mov dword [0x4506bc], esi
pop edi
pop esi
pop ebx
add esp, 0x14
ret