Function at 0x4023e0
Capabilities:
Get uefi variable
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0xc]
push esi
dec eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 6
ja case.default.0x402409
jmp dword [eax*4 + 0x4029ac]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x40244d
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.default.0x402409
mov ecx, dword [ebp + 0x10]
or ecx, 1
call fcn.0050d020
nop dword [eax + eax]
test eax, eax
je 0x402957
push eax
push 0
jmp 0x402989
push str.restart
push str.preforms_a_hard
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
nop
call fcn.004019c0
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
nop dword [eax]
test al, al
je case.default.0x402409
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
jns 0x402957
push 0
lfence
push eax
jmp 0x402989
push str.restart
push str.forces_a_critical
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004019c0
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.default.0x402409
push 0x80000000
push 6
push 5
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x402957
push 0
lfence
push eax
jmp 0x402989
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x402555
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.default.0x402409
mov byte [esp + 0x20], 1
call fcn.0051f020
nop
test al, al
jne 0x402579
mov eax, 0xc0000001
push 0
push eax
lfence
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x40298e
mov esi, dword [0x63596c]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call dword [0x5a9914]
call esi
test eax, eax
mov dword [esp + 0x24], eax
mov ecx, 0
cmovns ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
mov esi, ecx
js 0x402666
call fcn.0051f020
test al, al
jne 0x4025c5
mov dword ds:[esp + 0x24], 0xc0000001
jmp 0x402666
lea eax, [esp + 0x10]
push eax
push 0x5d1a90
push esi
mov esi, dword [0x635974]
mov ecx, esi
call dword [0x5a9914]
nop
call esi
test eax, eax
mov dword [esp + 0x24], eax
mov esi, 0
cmovns esi, dword [esp + 0x10]
mov dword [esp + 0x18], esi
js 0x402637
call fcn.0051f020
nop dword [eax]
test al, al
jne 0x40260e
mov dword [esp + 0x24], 0xc0000001
jmp 0x402633
push 1
lea eax, [esp + 0x24]
push eax
push 0x260000c3
ret
add byte [eax], al
push esi
mov esi, dword [0x635970]
mov ecx, esi
call dword [0x5a9914]
call esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], 0
mov eax, dword [esp + 0x1c]
mov esi, eax
je 0x402666
call fcn.0051f020
test al, al
je 0x402666
push dword [esp + 0x18]
mov esi, dword [0x63584c]
mov ecx, esi
call dword [0x5a9914]
nop
call esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x402688
call fcn.0051f020
test al, al
je 0x402688
push esi
mov esi, dword [0x635968]
mov ecx, esi
call dword [0x5a9914]
call esi
mov eax, dword [esp + 0x24]
test eax, eax
js 0x402569
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402957
push eax
push 0
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x40298e
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_Ordinal_1518
test byte [eax + 4], 1
je 0x40288a
push 1
push 0x16
push 0
call sym.SystemInformer.exe_Ordinal_1463
nop dword [eax + eax]
test eax, eax
js 0x40288a
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0x40002
push eax
push 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], 0x5d397c
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
je 0x402737
push str.This_machine_does_not_have_UEFI_support.
jmp 0x40288f
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x402771
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.default.0x402409
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0
push eax
xorps xmm0, xmm0
push 0x5d78c4
push 0x630a24
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x24], xmm0
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov edx, eax
cmp edx, 0xc0000100
je 0x40287a
mov ecx, dword [esp + 0x28]
and ecx, 1
or ecx, 0
je 0x40287a
test edx, edx
js 0x40287f
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 0x5d78c4
push 0x6309e4
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov edx, eax
test edx, edx
jns 0x40280c
nop word [eax + eax]
cmp edx, 0xc0000100
jne 0x40287f
or dword ds:[esp + 0x10], 1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp edx, 0xc0000100
jne 0x402833
mov eax, 1
mov dword [esp + 0x1c], eax
jmp 0x402837
mov eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push 0x5d78c4
push 0x6309e4
call dword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
mov edx, eax
test edx, edx
js 0x40287f
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402957
push eax
push 0
jmp 0x402989
mov edx, 0xc00000bb
push 0
lfence
push edx
jmp 0x402989
push str.Make_sure_System_Informer_is_running_with_administrative_privileges.
push str.Unable_to_restart_to_firmware_options.
push 0xfffe
push 1
push edi
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x14
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x4028f7
push 0
push 0
push str.the_computer
push str.update_and_restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.default.0x402409
push 0x80000000
push 0x45
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402957
push eax
push 0
jmp 0x402989
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x40294c
push 0
push 0
push str.the_computer_for_Windows_Defender_Offline_Scan
push str.restart
push edi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je case.default.0x402409
call fcn.0052bec0
mov ecx, eax
test ecx, ecx
jne 0x40296c
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x80070000
jne 0x402982
movzx eax, cx
push eax
push 0
jmp 0x402989
push 0
push 0xc0000001
push str.Unable_to_restart_the_computer.
push edi
call sym.SystemInformer.exe_Ordinal_1701
mov ecx, dword ds:[esp + 0x4c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc