Function at 0x402118
Capabilities:
Shutdown system
Terminate process

Disassembly:
push 0x18
push 0x418548
call fcn.0040ec0c
and dword [ebp - 4], 0
push 0x400
push pe_nt_image_headers32
mov esi, dword [sym.imp.kernel32.dll_GlobalAlloc]
call esi
mov edi, eax
push 0x1fe
push edi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
push edi
call fcn.00401f98
pop ecx
push edi
call fcn.00407b85
pop ecx
mov ecx, 0x417034
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov ebx, eax
mov ecx, 0x417060
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push 0x80000001
call fcn.00407eb7
add esp, 0x10
test eax, eax
je 0x4021dd
push dword [ebp - 0x20]
push ebx
call fcn.00408173
pop ecx
pop ecx
mov edi, dword [ebp - 0x1c]
cmp byte [edi], 0x22
jne 0x4021d4
push 0x2800
push pe_nt_image_headers32
call esi
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
dec eax
push eax
lea eax, [edi + 2]
push eax
push esi
call dword [sym.imp.kernel32.dll_lstrcpynW]
push esi
push edi
call dword [sym.imp.kernel32.dll_lstrcpyW]
push esi
call fcn.00407b85
pop ecx
push edi
call fcn.00401f98
pop ecx
jmp 0x4021e0
mov edi, dword [ebp - 0x1c]
push ebx
call fcn.00407b85
pop ecx
push dword [ebp - 0x20]
call fcn.00407b85
pop ecx
push edi
call fcn.00407b85
pop ecx
mov ecx, 0x417070
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, 0x4170ac
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x24]
mov esi, 0x80000002
push esi
call fcn.00407eb7
add esp, 0x10
test eax, eax
je 0x4022af
push 0
push 0x2c
mov edi, dword [ebp - 0x1c]
mov ecx, edi
call fcn.00407bc6
pop ecx
pop ecx
test eax, eax
jbe 0x4022a8
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
lea ebx, [edi + eax*2 + 4]
push ebx
call fcn.00401f98
pop ecx
mov ecx, 0x4170b8
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov dword [ebp - 0x28], eax
push eax
push ebx
call dword [sym.imp.kernel32.dll_lstrcatW]
push dword [ebp - 0x28]
call fcn.00407b85
pop ecx
push ebx
call fcn.00401f98
mov dword [esp], 0x4170c4
push edi
call dword [sym.imp.kernel32.dll_lstrcatW]
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push esi
call fcn.00408040
add esp, 0x10
push edi
call fcn.00407b85
pop ecx
push dword [ebp - 0x20]
call fcn.00407b85
pop ecx
push dword [ebp - 0x24]
call fcn.00407b85
pop ecx
mov ecx, 0x4170c8
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408687
push eax
push esi
push 0x80000001
call fcn.00407eb7
add esp, 0x10
test eax, eax
je 0x402334
push dword [ebp - 0x1c]
call fcn.00401f98
pop ecx
mov ecx, 0x4170fc
call fcn.004073dd
push eax
call fcn.00407491
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_lstrcatW]
push edi
call fcn.00407b85
pop ecx
push dword [ebp - 0x1c]
call fcn.00401f98
pop ecx
call fcn.00408687
push eax
push esi
call fcn.00408173
pop ecx
pop ecx
push esi
call fcn.00407b85
pop ecx
jmp 0x402353
or dword [ebp - 4], 0xffffffff
push 0x30000
push 0x14
call dword [sym.imp.user32.dll_ExitWindowsEx]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]