Function at 0x406220
Capabilities:
Check for time delay via gettickcount
Create thread
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e4d8
push 0x410ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov edx, 1
mov byte [ebp - 0x2f], dl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x278], str.NVIconBeginEvent
mov dword [ebp - 0x274], 3
mov dword [ebp - 0x270], 0x42696c
mov esi, 2
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], str.NVIconEndEvent
mov ecx, 4
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], 0x426970
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], str.NVModeSwitchEvent
mov dword [ebp - 0x254], 5
mov dword [ebp - 0x250], 0x426974
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], str.NVDisplayChangeEvent
mov dword [ebp - 0x244], 7
mov dword [ebp - 0x240], 0x426980
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], str.NVSessionChangeEvent
mov dword [ebp - 0x234], 8
mov dword [ebp - 0x230], 0x426984
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], str.NVDFPOff
mov dword [ebp - 0x224], 9
mov dword [ebp - 0x220], 0x426998
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], str.NVDFPOn
mov dword [ebp - 0x214], 0xa
mov dword [ebp - 0x210], 0x42699c
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], str.NVScaleEvent
mov dword [ebp - 0x204], 0xb
mov dword [ebp - 0x200], 0x426978
mov dword [ebp - 0x1fc], esi
mov eax, str.NOT_A_NAMED_EVENT
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 0x1f0], 0x426bd0
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1e8], str.NVDXFullScreenEvent
mov dword [ebp - 0x1e4], 0xc
mov dword [ebp - 0x1e0], 0x42698c
mov dword [ebp - 0x1dc], esi
mov dword [ebp - 0x1d8], str.NVThermalEvent
mov dword [ebp - 0x1d4], 0xd
mov dword [ebp - 0x1d0], 0x426988
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c8], str.NVPowerConnectorEvent
mov dword [ebp - 0x1c4], 0xe
mov dword [ebp - 0x1c0], 0x426990
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1b8], str.NVWMDisplayChangeEvent
mov dword [ebp - 0x1b4], 0xf
mov dword [ebp - 0x1b0], 0x4269a4
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], str.NVWMDeviceChangeEvent
mov dword [ebp - 0x1a4], 0x10
mov dword [ebp - 0x1a0], 0x4269a8
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], str.NVLidChangeEvent
mov dword [ebp - 0x194], 0x11
mov dword [ebp - 0x190], 0x4269ac
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x188], str.NVInhibitChangeEvent
mov dword [ebp - 0x184], 0x12
mov dword [ebp - 0x180], 0x4269b4
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x178], str.NVHotPlugChangeEvent
mov dword [ebp - 0x174], 0x13
mov dword [ebp - 0x170], 0x4269b8
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], str.NVAGPConfigurationEvent
mov dword [ebp - 0x164], 0x14
mov dword [ebp - 0x160], 0x4269b0
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x158], str.NVSmartDimmerEvent
mov dword [ebp - 0x154], 0x15
mov dword [ebp - 0x150], 0x4269bc
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x148], str.NVCplHotKeyEvent
mov dword [ebp - 0x144], 0x16
mov dword [ebp - 0x140], 0x4269a0
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], str.NVFlushUnattachEvent
mov dword [ebp - 0x134], 0x17
mov dword [ebp - 0x130], 0x4269c0
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], str.NV_WMIACPI_SilentModeEvent
mov dword [ebp - 0x124], 0x18
mov dword [ebp - 0x120], 0x426964
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], str.NVInduceDeviceScanEvent
mov dword [ebp - 0x114], 0x19
mov dword [ebp - 0x110], 0x4269c4
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], str.NVThermalHistoryOff
mov dword [ebp - 0x104], 0x1a
mov dword [ebp - 0x100], 0x4269c8
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], str.NVThermalHistoryOn
mov dword [ebp - 0xf4], 0x1b
mov dword [ebp - 0xf0], 0x4269cc
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], str.NVSetBrightnessRequestEvent
mov dword [ebp - 0xe4], 0x1c
mov dword [ebp - 0xe0], 0x4269d0
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 0x1d
mov dword [ebp - 0xd0], 0x4269d4
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], str.NVGSyncSmartSyncLossEvent
mov dword [ebp - 0xc4], 0x1e
mov dword [ebp - 0xc0], 0x4269d8
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], str.NVGSyncSmartSyncGainEvent
mov dword [ebp - 0xb4], 0x1f
mov dword [ebp - 0xb0], 0x4269dc
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], str.NVGSyncSmartStereoLossEvent
mov dword [ebp - 0xa4], 0x20
mov dword [ebp - 0xa0], 0x4269e0
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], str.NVGSyncSmartStereoGainEvent
mov dword [ebp - 0x94], 0x21
mov dword [ebp - 0x90], 0x4269e4
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], str.NVCoppEvent
mov dword [ebp - 0x84], 0x22
mov dword [ebp - 0x80], 0x4269e8
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], str.NVDpLinkTrainEvent
mov dword [ebp - 0x74], 0x23
mov dword [ebp - 0x70], 0x4269ec
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov ecx, 8
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x27c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x280], eax
mov dword [0x42b520], 0x10
mov dword [0x42b524], esi
xor ecx, ecx
mov eax, dword [0x42b53c]
cmp eax, 1
setle cl
dec ecx
and ecx, 0x48
add ecx, 7
mov dword [0x42b528], ecx
cmp eax, 3
jl 0x406767
mov eax, ecx
or al, 0x80
mov dword [0x42b528], eax
mov dword [0x42b52c], ebx
mov dword [0x42b530], ebx
mov dword [0x42b534], ebx
mov dword [0x42b538], ebx
push 0x42b540
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call edi
push 0x42b360
call edi
push 0x42b560
call edi
cmp dword [0x426a08], ebx
jne 0x4067be
push 0x421dcc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.EnumDisplayDevicesW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x426a08], eax
push str.wtsapi32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
mov dword [0x42694c], eax
cmp eax, ebx
je 0x4067fc
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x426954], eax
cmp eax, ebx
jne 0x4067fc
mov edx, dword [0x42694c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x42694c], ebx
push str.kernel32.dll
call edi
mov dword [0x426950], eax
cmp eax, ebx
je 0x40683c
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x426958], eax
cmp eax, ebx
jne 0x406835
mov eax, dword [0x426950]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x426950], ebx
jmp 0x40683c
call eax
mov dword [0x426944], eax
cmp dword [0x42b53c], 1
jle 0x40692a
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x288], ebx
mov word [ebp - 0x488], bx
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x486]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x488]
push ecx
call fcn.00404b20
add esp, 4
cmp eax, 1
jne 0x4068fe
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
cmp eax, 1
jne 0x4068fe
mov eax, dword [ebp - 0x288]
cmp eax, ebx
je 0x4068fe
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
cmp eax, 1
jne 0x4068fe
mov eax, dword [str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE10318]
cmp eax, ebx
je 0x4068e2
mov edi, 0x42195c
mov ecx, dword [ebp - 0x288]
push ecx
push eax
call fcn.00405410
add esp, 8
add edi, 4
mov eax, dword [edi]
cmp eax, ebx
jne 0x4068c9
call fcn.00404bf0
mov eax, dword [ebp - 0x288]
cmp eax, ebx
je 0x4068fe
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x288], ebx
push str.RegisterServiceCtrlHandlerExW
mov edi, dword [ebp - 0x284]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp edi, ebx
je 0x40692a
cmp eax, ebx
je 0x40692a
push ebx
push fcn.00407840
push str.NVSvc
call eax
mov dword [0x426968], eax
mov eax, dword [0x426968]
cmp eax, ebx
jne 0x40696a
push 0x407950
push str.NVSvc
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x426968], eax
cmp eax, ebx
jne 0x40696a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x42b52c], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00407e50
mov dword [0x42b524], esi
mov dword [0x42b538], 0x1f4
push 0x42b520
mov edx, dword [0x426968]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [0x42b524], 4
mov dword [0x42b538], ebx
push 0x212
push ebx
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
cmp eax, ebx
je 0x4069c1
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x4069cb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
jmp 0x4069d1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
push ebx
push 0x40bbf0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
je 0x4069ed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x426994], eax
cmp eax, ebx
jne 0x406a1a
call edi
mov dword [0x42b52c], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5ac], 1
xor ecx, ecx
mov dword [ebp - 0x5b0], ecx
cmp dword [ebp - 0x278], ebx
je 0x406a54
lea eax, [ebp - 0x278]
inc ecx
add eax, 0x10
cmp dword [eax], ebx
jne 0x406a46
mov dword [ebp - 0x5b0], ecx
call fcn.00404830
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [0x426938], ecx
call fcn.00407f30
mov dword [0x4218c8], eax
cmp dword [0x426938], ebx
je 0x406ae9
call fcn.00402e00
test eax, eax
je 0x406a9b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404830
xor edx, edx
cmp eax, ebx
setne dl
mov dword [0x426938], edx
cmp dword [0x426938], ebx
je 0x406ae9
call edi
push 0x42b520
call fcn.00408650
add esp, 4
test eax, eax
jne 0x406ae1
mov dword [0x42b524], 1
mov dword [0x42b538], 0x3e8
mov dword [0x42b52c], ebx
push 0x42b520
mov eax, dword [0x426968]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x426938], ebx
jne 0x406b36
call fcn.004061d0
push 0x426960
lea ecx, [ebp - 0x5b4]
push ecx
call fcn.00405970
call fcn.00402cc0
call fcn.00403170
push ebx
call fcn.00401c40
add esp, 0xc
mov dword [0x421034], eax
call fcn.00408230
call fcn.00406170
call fcn.00404590
test eax, eax
je 0x406b31
mov dword [ebp - 0x24], 1
call fcn.00408e30
push 0x42b520
call fcn.00408650
add esp, 4
test eax, eax
jne 0x406b59
push 0x42b520
mov edx, dword [0x426968]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.00404c70
mov dword [ebp - 0x5b8], eax
cmp eax, ebx
je 0x406b6d
call fcn.00404d40
call fcn.00401bb0
mov dword [ebp - 0x5bc], eax
cmp eax, 1
jae 0x406b87
mov dword [ebp - 0x5bc], 1
mov eax, dword [0x42b524]
cmp eax, 3
je 0x40748d
cmp eax, 1
je 0x40748d
cmp dword [ebp - 0x24], ebx
jne 0x40748d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x5b0], ebx
je 0x406dc8
mov dword [ebp - 0x5c0], ebx
mov eax, dword [ebp - 0x5c0]
shl eax, 4
mov esi, dword [ebp + eax - 0x278]
cmp esi, ebx
je 0x406dc0
lea ecx, [ebp + eax - 0x270]
mov dword [ebp - 0x5c4], ecx
cmp dword [ecx], ebx
je 0x406db5
lea edi, [ebp + eax - 0x274]
mov dword [ebp - 0x5c8], edi
cmp dword [edi], 6
jne 0x406c14
cmp dword [0x42b53c], 1
jle 0x406c14
dec dword [ebp - 0x5b0]
mov dword [ecx], ebx
inc dword [ebp - 0x5c0]
jmp 0x406bbc
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x5cc], eax
test al, 5
jne 0x406c3e
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x5c4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x406d5b
test al, 4
je 0x406d5b
lea edx, [ebp - 0x38]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x406d2b
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x5ec]
rep stosd dword es:[edi], eax
mov eax, 2
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], 5
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x5d0], ecx
lea edx, [ebp - 0x2c]
push edx
push ebx
lea eax, [ebp - 0x5ec]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [ebp - 0x5f0], eax
cmp eax, ebx
jne 0x406d2b
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x406d2b
push 1
mov ecx, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x406d2b
push ebx
mov edx, dword [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x406d2b
mov dword [ebp - 0x5fc], 0xc
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x5f8], ecx
mov dword [ebp - 0x5f4], ebx
push esi
push ebx
push ebx
lea edx, [ebp - 0x5fc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x5c4]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x406d39
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x406d47
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x406d55
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x5c8]
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx]
mov eax, dword [eax]
cmp eax, ebx
je 0x406db5
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + ecx*4 - 0x518], eax
mov esi, dword [edi]
mov dword [ebp + ecx*4 - 0x5a8], esi
test byte [ebp - 0x5cc], 2
je 0x406d92
push eax
push esi
call fcn.00401510
add esp, 8
inc dword [ebp - 0x5ac]
dec dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x5c4]
mov dword [eax], ebx
cmp dword [edi], 5
jne 0x406db5
push 1
call fcn.00402ab0
add esp, 4
inc dword [ebp - 0x5c0]
jmp 0x406bbc
cmp dword [ebp - 0x5b0], ebx
jne 0x406dea
cmp dword [ebp - 0x5ac], ebx
je 0x406dea
mov edi, dword [ebp - 0x5b4]
mov dword [ebp - 0x600], edi
cmp edi, 0xffffffff
je 0x406df5
mov dword [ebp - 0x20], 1
jmp 0x406df5
mov edi, 0xfa0
mov dword [ebp - 0x600], edi
cmp dword [0x4269f8], ebx
je 0x406e10
cmp edi, 0x3e8
jbe 0x406e10
mov edi, 0x3e8
mov dword [ebp - 0x600], edi
cmp edi, 0x7530
jbe 0x406e23
mov edi, 0x7530
mov dword [ebp - 0x600], edi
cmp dword [ebp - 0x27c], ebx
jne 0x406e3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x280]
cmp eax, 0x7530
jb 0x406e72
mov dword [ebp - 0x27c], 1
call fcn.004088f0
call fcn.00408660
cmp dword [0x426a1c], ebx
je 0x406e6d
cmp edi, 0x3e8
jbe 0x406e6d
mov edi, 0x3e8
mov dword [ebp - 0x600], edi
call fcn.00408bd0
cmp dword [ebp - 0x5ac], ebx
jne 0x406e92
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp dword [ebp - 0x5b8], ebx
je 0x406ebe
mov edi, 0x7d0
mov dword [ebp - 0x600], edi
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
jne 0x406ec1
mov ecx, dword [ebp - 0x5bc]
push ecx
push edi
call fcn.00405390
add esp, 8
jmp 0x406ec1
mov esi, dword [ebp - 0x1c]
push edi
push ebx
lea edx, [ebp - 0x518]
push edx
mov eax, dword [ebp - 0x5ac]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
mov dword [ebp - 0x604], edi
cmp edi, 0x102
jne 0x406f18
cmp dword [ebp - 0x20], ebx
je 0x406ef1
call fcn.004076b0
cmp dword [0x4269f8], ebx
je 0x406f07
call fcn.004060a0
test eax, eax
jne 0x406f07
call fcn.00406160
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp edi, dword [ebp - 0x5ac]
jae 0x407445
mov dword [ebp - 0x5c0], edi
cmp dword [0x426948], ebx
je 0x406f4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x426a04]
cmp eax, 0x7d0
jbe 0x406f4b
mov dword [0x426948], ebx
mov eax, dword [ebp + edi*4 - 0x5a8]
cmp eax, 0x23
ja case.default.0x406f74
jmp dword [eax*4 + 0x407610]
mov ecx, dword [0x4269f0]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x406f74
jmp dword [eax*4 + 0x4076a0]
mov dword [0x42b524], 3
mov dword [0x42b538], 0x64
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov dword [ebp - 0x1c], 1
mov dword [0x42b524], 7
cmp dword [0x426974], ebx
je 0x406fc3
push 2
call fcn.00402ab0
add esp, 4
push 0x42b520
mov edx, dword [0x426968]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov dword [ebp - 0x1c], ebx
mov dword [0x42b524], 4
cmp dword [0x426974], ebx
je 0x407005
push 1
call fcn.00402ab0
add esp, 4
push 0x42b520
mov eax, dword [0x426968]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
push 0x42b520
mov ecx, dword [0x426968]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
xor edx, edx
cmp eax, 3
sete dl
push edx
call fcn.00401b30
add esp, 4
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x402830
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x4036b0
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x403a00
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push 0x42196c
push 0x4037d0
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push 0x426a14
push 0x4037d0
jmp 0x407426
call fcn.004045e0
mov dword [ebp - 0x604], eax
cmp esi, ebx
jne case.default.0x406f74
call fcn.00402ae0
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
call fcn.00409b10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push ebx
call fcn.004030f0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push 1
call fcn.004030f0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push ebx
call fcn.00404ef0
add esp, 4
test eax, eax
je case.default.0x406f74
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push 1
call fcn.00404ef0
add esp, 4
test eax, eax
je case.default.0x406f74
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov eax, dword [ebp + edi*4 - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x4034d0
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x4038e0
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x403b60
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x403bf0
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push 0x421970
push 0x4037d0
jmp 0x407426
call fcn.004085b0
cmp esi, ebx
jne case.default.0x406f74
cmp dword [0x4269f8], ebx
je 0x40742e
call fcn.004060a0
test eax, eax
jne 0x40742e
call fcn.00406160
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
call fcn.00405070
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x4032b0
jmp 0x407426
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x4033c0
jmp 0x407426
call fcn.00408d50
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov dword [ebp - 0x608], ebx
cmp esi, ebx
jne case.default.0x406f74
lea ecx, [ebp - 0x608]
push ecx
call fcn.00404f10
add esp, 4
test eax, eax
je 0x40742e
push ebx
push ebx
push ebx
push 0x4038e0
jmp 0x407426
push ebx
push ebx
push ebx
push 0x403da0
call fcn.004031e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov dword [ebp - 0x60c], 1
jmp 0x4073ce
mov dword [ebp - 0x60c], 2
push ebx
push ebx
lea eax, [ebp - 0x60c]
push eax
push 0x403e30
call fcn.004031e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov dword [ebp - 0x60c], 4
push ebx
push ebx
lea ecx, [ebp - 0x60c]
push ecx
push 0x403e30
call fcn.004031e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
mov dword [ebp - 0x60c], 8
push ebx
push ebx
lea edx, [ebp - 0x60c]
push edx
push 0x403e30
call fcn.004031e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x403eb0
call fcn.004031e0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp esi, ebx
jne case.default.0x406f74
push ebx
push ebx
push ebx
push 0x403f60
call fcn.004031e0
add esp, 0x10
mov dword [ebp - 0x604], ebx
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp edi, 0xffffffff
jne 0x407456
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x604], eax
mov dword [ebp - 4], 0xffffffff
mov esi, 2
jmp 0x406b87
cmp dword [0x426974], ebx
je 0x40749e
push ebx
call fcn.00402ab0
add esp, 4
mov dword [0x42b524], 3
mov dword [0x42b534], 1
mov edi, 0x64
mov dword [0x42b538], edi
push 0x42b520
mov eax, dword [0x426968]
push eax
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call fcn.004090b0
call fcn.00408cc0
call fcn.00408a30
call fcn.00404950
mov dword [0x42b538], edi
xor eax, eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5ac], ebx
jle 0x40754f
test al, 7
jne 0x407524
mov dword [0x42b524], 3
inc dword [0x42b534]
push 0x42b520
mov ecx, dword [0x426968]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [ebp - 0x5c0]
lea edi, [ebp + eax*4 - 0x518]
mov ecx, dword [edi]
cmp ecx, ebx
je 0x407540
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp eax, dword [ebp - 0x5ac]
jl 0x4074f8
push 0x42b520
call fcn.00408650
add esp, 4
test eax, eax
jne 0x407582
mov dword [0x42b524], 1
mov dword [0x42b538], ebx
push 0x42b520
mov edx, dword [0x426968]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0x42b540
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call edi
push 0x42b360
call edi
push 0x42b560
call edi
cmp dword [ebp - 0x24], ebx
je 0x4075fc
lea eax, [ebp - 0x610]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x61c]
push ecx
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x614], esi
push ebx
push ebx
push ebx
lea edx, [ebp - 0x620]
push edx
push ebx
mov eax, dword [ebp - 0x610]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8