Function at 0x402dd0
Capabilities:
Shutdown system

Disassembly:
push 0xffffffffffffffff
push 0x40a53f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.00403a60
lea ecx, [esp + 0x10]
mov dword [esp + 0x1b0], esi
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x1b8]
mov byte [esp + 0x1b0], 1
cmp ebp, esi
jle 0x402e5f
mov edi, dword [esp + 0x1bc]
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push eax
call fcn.0040961a
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::MakeLower
mov ecx, dword [esp + 0x10]
push str._reboot
push ecx
call ebx
add esp, 8
test eax, eax
je 0x402fbf
inc esi
add edi, 4
cmp esi, ebp
jl 0x402e2b
lea ecx, [esp + 0x10]
mov byte [esp + 0x1b0], 0
call fcn.0040960e
lea ecx, [esp + 0x164]
mov dword [esp + 0x1b0], 0x1c
call fcn.004096fe
lea ecx, [esp + 0x124]
mov byte [esp + 0x1b0], 0x1b
call sub.MFC42.DLL_CListCtrl::CListCtrl
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1b0], 0x1a
call sub.MFC42.DLL_CButton::CButton
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 0x19
call fcn.0040960e
mov esi, 0x40b4d4
lea ecx, [esp + 0xbc]
mov byte [esp + 0x1b0], 0x18
mov dword [esp + 0xbc], esi
call fcn.00403190
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1b0], 0x17
mov dword [esp + 0xb4], esi
call fcn.00403190
lea ecx, [esp + 0xac]
mov byte [esp + 0x1b0], 0x16
mov dword [esp + 0xac], esi
call fcn.00403190
lea ecx, [esp + 0xa4]
mov byte [esp + 0x1b0], 0x15
call fcn.00403200
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1b0], 0x14
call fcn.00403200
lea ecx, [esp + 0x94]
mov byte [esp + 0x1b0], 0x13
call fcn.00403200
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1b0], 0x12
call fcn.00403200
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1b0], 0x11
call fcn.004096e6
mov byte [esp + 0x1b0], 0x10
lea ecx, [esp + 0x78]
call fcn.0040960e
lea ecx, [esp + 0x18]
mov dword [esp + 0x1b0], 0xffffffff
call fcn.00409614
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a4
ret 8
push str.SeShutdownPrivilege
lea ecx, [esp + 0x1c]
call fcn.00404720
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1b0], 0
call fcn.0040960e
lea ecx, [esp + 0x164]
mov dword [esp + 0x1b0], 0xe
call fcn.004096fe
lea ecx, [esp + 0x124]
mov byte [esp + 0x1b0], 0xd
call sub.MFC42.DLL_CListCtrl::CListCtrl
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1b0], 0xc
call sub.MFC42.DLL_CButton::CButton
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 0xb
call fcn.0040960e
mov esi, 0x40b4d4
lea ecx, [esp + 0xbc]
mov byte [esp + 0x1b0], 0xa
mov dword [esp + 0xbc], esi
call fcn.00403190
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1b0], 9
mov dword [esp + 0xb4], esi
call fcn.00403190
lea ecx, [esp + 0xac]
mov byte [esp + 0x1b0], 8
mov dword [esp + 0xac], esi
call fcn.00403190
lea ecx, [esp + 0xa4]
mov byte [esp + 0x1b0], 7
mov dword [esp + 0xa4], esi
call fcn.00403190
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1b0], 6
mov dword [esp + 0x9c], esi
call fcn.00403190
lea edx, [esp + 0x94]
mov dword [esp + 0x94], 0x40b4c0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x94]
mov byte [esp + 0x1b0], 0xf
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x8c]
mov dword [esp + 0x94], 0x40b4ac
mov byte [esp + 0x1b0], 4
mov dword [esp + 0x8c], esi
call fcn.00403190
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1b0], 3
call fcn.004096e6
mov byte [esp + 0x1b0], 2
jmp 0x402f82