Function at 0x444ba0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
add edx, 0xffff6320
push esi
mov esi, ecx
cmp edx, 0x7c
ja case.0x444bc2.40172
movzx eax, byte [edx + 0x444e60]
jmp dword [eax*4 + 0x444e18]
push esi
call sym.SystemInformer.exe__PhUiLockComputer_4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call sym.SystemInformer.exe__PhUiLogoffComputer_4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call sym.SystemInformer.exe__PhUiSleepComputer_4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call sym.SystemInformer.exe__PhUiHibernateComputer_4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push esi
call sym.SystemInformer.exe__PhUiRestartComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 4
push esi
call sym.SystemInformer.exe__PhUiRestartComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push 1
push esi
call sym.SystemInformer.exe__PhUiRestartComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 5
push esi
call sym.SystemInformer.exe__PhUiRestartComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push esi
call sym.SystemInformer.exe__PhUiShutdownComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 8
push 1
push esi
call sym.SystemInformer.exe__PhUiShutdownComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 2
push esi
call sym.SystemInformer.exe__PhUiRestartComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 2
push esi
call sym.SystemInformer.exe__PhUiShutdownComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 3
push esi
call sym.SystemInformer.exe__PhUiRestartComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 3
push esi
call sym.SystemInformer.exe__PhUiShutdownComputer_12
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x444ce8
push 0
push 0
push str.the_computer
push str.update_and_restart
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
mov edi, edi
test al, al
je 0x444e07
push 0x80000000
push 0x45
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
jmp 0x444d00
test eax, eax
je 0x444e07
push eax
push 0
push str.Unable_to_restart_the_computer.
push esi
call sym.SystemInformer.exe_PhShowStatus
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x444d57
push 0
push 0
push str.the_computer
push str.update_and_shutdown
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x444e07
push 0x80000000
push 0x49
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x444e07
push eax
push 0
push str.Unable_to_shut_down_the_computer.
push esi
call sym.SystemInformer.exe_PhShowStatus
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x444dc4
push 0
push 0
push str.the_computer_for_Windows_Defender_Offline_Scan
push str.restart
push esi
call sym.SystemInformer.exe_PhShowConfirmMessage
mov edi, edi
test al, al
je 0x444e07
call fcn.0052aec0
test eax, eax
je 0x444e07
mov ecx, eax
and ecx, 0xffff0000
cmp ecx, 0x80070000
jne 0x444df5
movzx eax, ax
push eax
push 0
push str.Unable_to_restart_the_computer.
push esi
call sym.SystemInformer.exe_PhShowStatus
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000001
push str.Unable_to_restart_the_computer.
push esi
call sym.SystemInformer.exe_PhShowStatus
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret