Function at 0x14000cca0
Capabilities:
Get uefi variable
Shutdown system

Disassembly:
jmp 0x14002cfa0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
lea rdi, [rsp + 0x30]
mov ecx, 0x38
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x120]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x100], eax
mov eax, dword [rsp + 0x100]
dec eax
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 5
ja case.default.0x14002d026
movsxd rax, dword [rsp + 0x100]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x2d628]
add rax, rcx
jmp rax
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d062
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x14002d0b2
mov eax, dword [rsp + 0x130]
or eax, 4
mov dword [rsp + 0x20], 0x80000000
mov r9d, eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14002d096
mov al, 1
jmp 0x14002d5fa
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp case.default.0x14002d026
lea r8, str.restart
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.1400110d0
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x38]
mov r9, qword [rax + 8]
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x14002d13f
mov ecx, 1
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x14002d123
mov al, 1
jmp 0x14002d5fa
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp case.default.0x14002d026
lea r8, str.restart
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.1400110d0
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x48]
mov r9, qword [rax + 8]
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x14002d1d7
mov r8d, 0x80000000
mov edx, 6
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x14002d1bb
mov al, 1
jmp 0x14002d5fa
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp case.default.0x14002d026
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d216
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x14002d28f
mov cl, 1
call fcn.140006330
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jl 0x14002d273
mov dword [rsp + 0x20], 0x80000000
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x14002d255
mov al, 1
jmp 0x14002d5fa
mov r9d, dword [rsp + 0x54]
xor r8d, r8d
lea rdx, str.Unable_to_configure_the_advanced_boot_options.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp 0x14002d28f
xor r9d, r9d
mov r8d, dword [rsp + 0x54]
lea rdx, str.Unable_to_configure_the_advanced_boot_options.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp case.default.0x14002d026
lea rcx, [rsp + 0xe8]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
jne 0x14002d2db
lea rax, str.Make_sure_Process_Hacker_is_running_with_administrative_privileges.
mov qword [rsp + 0x20], rax
lea r9, str.Unable_to_restart_to_firmware_options.
mov r8d, 0xfffe
mov edx, 1
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowMessage2
jmp case.default.0x14002d026
mov r8b, 1
mov edx, 0x16
xor ecx, ecx
call fcn.140009980
test eax, eax
jge 0x14002d31e
lea rax, str.Make_sure_Process_Hacker_is_running_with_administrative_privileges.
mov qword [rsp + 0x20], rax
lea r9, str.Unable_to_restart_to_firmware_options.
mov r8d, 0xfffe
mov edx, 1
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowMessage2
jmp case.default.0x14002d026
call fcn.140010d90
movzx eax, al
test eax, eax
jne 0x14002d35a
lea rax, str.This_machine_does_not_have_UEFI_support.
mov qword [rsp + 0x20], rax
lea r9, str.Unable_to_restart_to_firmware_options.
mov r8d, 0xfffe
mov edx, 1
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowMessage2
jmp case.default.0x14002d026
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d398
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x14002d56a
mov qword [rsp + 0x58], 1
mov dword [rsp + 0x64], 8
mov dword [rsp + 0x84], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
lea r8, [rsp + 0xa8]
lea rdx, [0x1405c4290]
lea rcx, [0x1405c42a0]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0xc0000100
je 0x14002d422
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa8]
and rcx, rax
mov rax, rcx
test rax, rax
jne 0x14002d42d
mov dword [rsp + 0xd4], 0xc00000bb
cmp dword [rsp + 0xd4], 0
jl 0x14002d4ed
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
lea r8, [rsp + 0xc8]
lea rdx, [0x1405c4290]
lea rcx, [0x1405c42b0]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0xc0000100
jne 0x14002d488
mov dword [rsp + 0x84], 1
cmp dword [rsp + 0xd4], 0
jge 0x14002d49f
cmp dword [rsp + 0xd4], 0xc0000100
jne 0x14002d4ed
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8], rax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x64]
lea r8, [rsp + 0xc8]
lea rdx, [0x1405c4290]
lea rcx, [0x1405c42b0]
call qword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0
jl 0x14002d54b
mov dword [rsp + 0x20], 0x80000000
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0
jne 0x14002d52a
mov al, 1
jmp 0x14002d5fa
mov r9d, dword [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp 0x14002d56a
xor r9d, r9d
mov r8d, dword [rsp + 0xd4]
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
jmp case.default.0x14002d026
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14002d5a9
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.update_and_restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowConfirmMessage
movzx eax, al
test eax, eax
je case.default.0x14002d026
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0x44
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
jne 0x14002d5d9
mov al, 1
jmp 0x14002d5fa
mov r9d, dword [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1403c4a50]
call fcn.140015750
mov rax, rdi
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x110
pop rdi
ret