Function at 0x14003d608
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
mov al, byte [section.flag_dat]
xor r14d, r14d
mov r12d, 1
mov byte [rsp + 0x140], al
or al, 0x80
test ecx, ecx
setne r14b
test dl, 0x70
mov byte [section.flag_dat], al
mov eax, edx
mov ebx, edx
mov ebp, 0
setne bpl
test dl, 0x72
mov esi, 0
setne sil
shr eax, 5
mov r13d, edx
and al, 2
test r14d, r14d
movzx r15d, al
cmovne r15d, r12d
shr ebx, 0xe
and ebx, r12d
call fcn.14005ea5c
lea rcx, str.ASNT5SHUTDOWN
mov rdi, rax
shr rdi, 0x10
call fcn.14001a5b0
mov edx, r13d
not edx
mov ecx, r12d
mov dword [rsp + 0x148], eax
and edx, r12d
test eax, eax
cmovne ecx, edx
test ecx, ecx
je 0x14003d6b8
test ebp, ebp
je 0x14003d6b8
cmp edi, 0x60002
jae 0x14003d6bb
xor r12d, r12d
test ebx, ebx
jne 0x14003d6c8
test esi, esi
je 0x14003d6c8
lea edi, [rbx + 1]
jmp 0x14003d6ce
xor edi, edi
test ebx, ebx
jne 0x14003d6d9
test esi, esi
je 0x14003d6d9
mov ebx, 1
jmp 0x14003d6db
xor ebx, ebx
lea rcx, [rsp + 0x158]
mov edx, 0x12c
call fcn.1400633a8
mov ecx, dword [rsp + 0x148]
movzx eax, byte [rsp + 0x140]
movzx esi, r15b
mov r15, qword [rsp + 0x150]
lea rdx, str._nBoot_0x_X__0x_X____S___Main0x_X__d_op__d__d:0x_X__d__d:_d_
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x50], ebx
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov r9d, r13d
mov r8d, r14d
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [rsp + 0x158]
call fcn.140017878
lea rcx, [rsp + 0x158]
call fcn.14005b104
and qword [rsp + 0x88], 0
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x58]
mov dword [rsp + 0x80], 0x68
call fcn.140102a90
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x70]
add eax, 0xf0
movsxd rdx, eax
call fcn.140063694
movzx r11d, word [rsp + 0xc0]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], r11d
lea rdx, str.__s__Down0x_X_Reboot0x_X_sa.wShowWindow0x_X
mov r9d, r13d
mov r8, r15
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x70]
mov edx, r13d
call fcn.14003d478
xor r8d, r8d
lea rcx, str.SeShutdownPrivilege
lea r15d, [r8 + 2]
mov edx, r15d
call fcn.14001c2cc
lea rcx, str.SeRemoteShutdownPrivilege
xor r8d, r8d
mov edx, r15d
call fcn.14001c2cc
xor r13d, r13d
cmp r12d, r13d
lea r12d, [r15 - 1]
je 0x14003d85e
lea rdx, [0x14011c638]
mov r9d, r12d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
lea rcx, [0x14013d130]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2710
call fcn.1400195f0
lea rcx, str.___next
call fcn.140017878
mov r14d, 0xa
cmp edi, r13d
je 0x14003d897
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 0xc]
lea rcx, [0x14013d130]
mov r9, r12
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
call fcn.140027eac
cmp ebx, r13d
je 0x14003d8f7
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [0x14013d130]
lea r8d, [r9 + 0x10]
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
call fcn.140027eac
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r14
lea rcx, [0x14013d130]
xor r9d, r9d
mov r8d, r15d
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
call fcn.140027eac
cmp ebp, r13d
je 0x14003d908
mov ecx, esi
call fcn.14001a56c
movsxd rbx, eax
jmp 0x14003d90b
mov rbx, r13
lea rcx, [rsp + 0x70]
call fcn.14005b104
mov rax, rbx
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret