Function at 0x4b70f0
Capabilities:
Shutdown system

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56964e
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
push ebx
push ebp
push esi
push edi
call fcn.005040f5
test eax, eax
je 0x4b7853
mov ebp, dword [esp + 0x200]
lea eax, [esp + 0x40]
push eax
push 0x28
or ebp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4b734f
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [esp + 0xf8]
call fcn.00404a20
mov edx, dword [esp + 0x1c]
push 0x572a6c
push 0x57b5c8
mov eax, dword [esp + 0x22]
push 0x572a4c
mov ecx, dword [esp + 0x24]
push 0x572a6c
push 0x572a48
push 0x10000000
push 0x572a40
push edx
mov edx, dword [esp + 0x36]
push 0x572a3c
push eax
mov eax, dword [esp + 0x3a]
push 0x572a3c
push ecx
mov ecx, dword [esp + 0x40]
push 0x572a38
push edx
push 0x572a34
push eax
push 0x572a34
push ecx
push 0x572a38
push 0x919
push 0x572a3c
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x94], esp
xor ebx, ebx
push 0x14
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str..WatchClientDlg.cpp
mov dword [esp + 0x274], ebx
mov byte [ecx + 4], bl
call fcn.00404640
lea edx, [esp + 0x98]
push edx
call fcn.00407150
add esp, 0x24
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
mov byte [esp + 0x24c], 1
jb 0x4b721f
mov eax, dword [eax + 4]
jmp 0x4b7222
add eax, 4
push eax
lea eax, [esp + 0x148]
push 0x572a0c
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
mov eax, dword [esp + 0x44]
add esp, 8
cmp eax, esi
mov byte [esp + 0x1f8], bl
jb 0x4b730a
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0055047a
add esp, 4
lea edx, [esp + 0xf0]
push edx
call fcn.00407930
add esp, 4
lea ecx, [esp + 0x13c]
mov dword [esp + 0x1f8], 0xffffffff
call fcn.004028d0
lea ecx, [esp + 0x13c]
mov dword [esp + 0x13c], 0x572840
call fcn.0054dfcb
xor eax, eax
jmp 0x4b7a98
lea eax, [esp + 0x64]
push eax
push str.SeShutdownPrivilege
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 0x40]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x6c]
push ecx
push ebx
mov edi, 2
push edx
mov dword [esp + 0x78], 1
mov dword [esp + 0x84], edi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
je 0x4b763a
push 1
push edi
lea ecx, [esp + 0x78]
call fcn.00404a20
push esi
lea eax, [esp + 0x74]
push str.GetLastError:
push eax
mov dword [esp + 0x204], edi
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.0040bbec
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push edi
lea ecx, [esp + 0xf8]
call fcn.00404a20
push 0x572a6c
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x78]
mov byte [esp + 0x200], 3
call fcn.00407320
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
mov byte [esp + 0x1fc], 4
jb 0x4b7415
mov eax, dword [eax + 4]
jmp 0x4b7418
add eax, 4
push eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x22]
push 0x572a4c
mov edx, dword [esp + 0x24]
push 0x572a6c
push 0x572a48
push 0x10000000
push 0x572a40
push eax
mov eax, dword [esp + 0x36]
push 0x572a3c
push ecx
mov ecx, dword [esp + 0x3a]
push 0x572a3c
push edx
mov edx, dword [esp + 0x40]
push 0x572a38
push eax
push 0x572a34
push ecx
push 0x572a34
push edx
push 0x572a38
push 0x930
push 0x572a3c
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x94], esp
push 0x14
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str..WatchClientDlg.cpp
mov byte [ecx + 4], bl
call fcn.00404640
lea eax, [esp + 0xb8]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], esi
mov byte [esp + 0x24c], 5
jb 0x4b74c2
mov eax, dword [eax + 4]
jmp 0x4b74c5
add eax, 4
push eax
lea ecx, [esp + 0x148]
push 0x572a0c
push ecx
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
mov eax, dword [esp + 0x64]
add esp, 8
cmp eax, esi
jb 0x4b75a6
mov edx, dword [esp + 0x48]
push edx
call fcn.0055047a
add esp, 4
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov byte [esp + 0x1f8], 3
jb 0x4b75cd
mov eax, dword [esp + 0x28]
push eax
call fcn.0055047a
add esp, 4
lea ecx, [esp + 0xf0]
push ecx
call fcn.00407930
add esp, 4
lea ecx, [esp + 0x13c]
mov byte [esp + 0x1f8], 2
call fcn.004028d0
mov esi, 0x572840
lea ecx, [esp + 0x13c]
mov dword [esp + 0x13c], esi
call fcn.0054dfcb
lea ecx, [esp + 0xbc]
mov dword [esp + 0x1f8], 0xffffffff
call fcn.004028d0
lea ecx, [esp + 0xbc]
mov dword [esp + 0xbc], esi
call fcn.0054dfcb
xor eax, eax
jmp 0x4b7a98
push ebx
push ebp
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4b7a93
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push edi
lea ecx, [esp + 0x78]
call fcn.00404a20
mov eax, dword [esp + 0x1c]
push 0x572a6c
push 0x57b820
mov ecx, dword [esp + 0x22]
push 0x572a4c
mov edx, dword [esp + 0x24]
push 0x572a6c
push 0x572a48
push 0x10000000
push 0x572a40
push eax
mov eax, dword [esp + 0x36]
push 0x572a3c
push ecx
mov ecx, dword [esp + 0x3a]
push 0x572a3c
push edx
mov edx, dword [esp + 0x40]
push 0x572a38
push eax
push 0x572a34
push ecx
push 0x572a34
push edx
push 0x572a38
push 0x936
push 0x572a3c
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x94], esp
push 0x14
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str..WatchClientDlg.cpp
mov dword [esp + 0x274], 6
mov byte [ecx + 4], bl
call fcn.00404640
lea eax, [esp + 0x98]
push eax
call fcn.00407150
add esp, 0x24
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
mov byte [esp + 0x24c], 7
jb 0x4b7725
mov eax, dword [eax + 4]
jmp 0x4b7728
add eax, 4
push eax
lea ecx, [esp + 0xc8]
push 0x572a0c
push ecx
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
mov eax, dword [esp + 0x44]
add esp, 8
cmp eax, esi
mov byte [esp + 0x1f8], 6
jb 0x4b7811
mov edx, dword [esp + 0x28]
push edx
call fcn.0055047a
add esp, 4
lea eax, [esp + 0x70]
push eax
call fcn.00407930
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0x1f8], 0xffffffff
call fcn.004028d0
lea ecx, [esp + 0xbc]
mov dword [esp + 0xbc], 0x572840
call fcn.0054dfcb
xor eax, eax
jmp 0x4b7a98
mov eax, dword [esp + 0x200]
cmp eax, 8
jne 0x4b7864
mov eax, 1
xor ebx, ebx
or eax, 4
push ebx
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4b7a93
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [esp + 0x178]
call fcn.00404a20
mov edx, dword [esp + 0x50]
push 0x572a6c
push str.ExitWindowsEx_EWX_SHUTDOWN
mov eax, dword [esp + 0x56]
push 0x572a4c
mov ecx, dword [esp + 0x58]
push 0x572a6c
push 0x572a48
push 0x10000000
push 0x572a40
push edx
mov edx, dword [esp + 0x6a]
push 0x572a3c
push eax
mov eax, dword [esp + 0x6e]
push 0x572a3c
push ecx
mov ecx, dword [esp + 0x74]
push 0x572a38
push edx
push 0x572a34
push eax
push 0x572a34
push ecx
push 0x572a38
push 0x940
push 0x572a3c
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x94], esp
push 0x14
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str..WatchClientDlg.cpp
mov dword [esp + 0x274], 8
mov byte [ecx + 4], bl
call fcn.00404640
lea edx, [esp + 0x98]
push edx
call fcn.00407150
add esp, 0x24
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
mov byte [esp + 0x24c], 9
jb 0x4b7959
mov eax, dword [eax + 4]
jmp 0x4b795c
add eax, 4
push eax
lea eax, [esp + 0x1c8]
push 0x572a0c
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
add esp, 8
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
add esp, 8
push eax
call fcn.00403980
mov eax, dword [esp + 0x44]
add esp, 8
cmp eax, esi
mov byte [esp + 0x1f8], 8
jb 0x4b7a45
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0055047a
add esp, 4
lea edx, [esp + 0x170]
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00407930
add esp, 4
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x1f8], 0xffffffff
call fcn.004028d0
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x1bc], 0x572840
call fcn.0054dfcb
xor eax, eax
jmp 0x4b7a98
mov eax, 1
mov ecx, dword [esp + 0x1f0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1ec
ret