Function at 0x1400056e0
Capabilities:
Shutdown system

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x88
mov rax, qword [0x1400692a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13, rdx
movsxd rbp, ecx
mov esi, 1
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0
xor r12d, r12d
mov rcx, qword [r13]
lea edx, [rsi + 0x5b]
call fcn.14000938c
test rax, rax
jne 0x140005736
mov rdi, qword [r13]
jmp 0x140005742
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov qword [rsp + 0xd0], rbx
mov r15, rbp
mov qword [rsp + 0x80], r14
mov ecx, 0xfffd
mov qword [rsp + 0x38], rdi
cmp rbp, rsi
jle 0x14000584c
mov rbx, rsi
lea r14d, [rcx - 0x1e]
mov edi, ecx
mov rcx, qword [r13 + rbx*8]
movzx eax, word [rcx]
sub ax, 0x2d
test di, ax
jne 0x140005842
movzx edx, word [rcx + 2]
lea eax, [rdx - 0x4d]
test r14w, ax
je 0x14000581e
lea eax, [rdx - 0x52]
test r14w, ax
je 0x14000580d
lea eax, [rdx - 0x46]
test r14w, ax
je 0x140005800
sub dx, 0x55
test r14w, dx
jne 0x140005842
cmp word [rcx + 4], 0
jne 0x140005842
mov ecx, 1
call fcn.140017d70
mov rcx, rax
call fcn.14002f768
mov ecx, eax
mov edx, 0x10000
call fcn.14002f80c
mov ecx, 2
call fcn.140017d70
mov rcx, rax
call fcn.14002f768
mov ecx, eax
mov edx, 0x10000
call fcn.14002f80c
jmp 0x140005834
cmp word [rcx + 4], 0
jne 0x140005842
or r12d, 1
jmp 0x140005834
cmp word [rcx + 4], 0
jne 0x140005842
mov dword [rsp + 0x30], 1
jmp 0x140005834
cmp word [rcx + 4], 0x3a
jne 0x140005842
add rcx, 6
cmp word [rcx], 0
je 0x140005842
mov qword [rsp + 0x50], rcx
inc esi
inc rbx
cmp r15, rbx
jg 0x140005771
mov rdi, qword [rsp + 0x38]
mov ecx, 0xfffd
mov eax, ebp
sub eax, esi
cmp eax, 1
jge 0x140005867
mov ecx, 2
call fcn.140017d70
mov r8, rdi
jmp 0x1400058dc
lfence
movsxd rax, esi
mov r14, qword [r13 + rax*8]
movzx eax, word [r14]
sub ax, 0x2d
test cx, ax
jne 0x14000588b
mov rcx, r14
call qword [sym.imp.USER32.dll_CharNextW]
mov r14, rax
mov rax, qword [section..data]
inc esi
xor edi, edi
test rax, rax
je 0x1400058cd
movsxd rbp, esi
xor ebx, ebx
mov rdx, rax
mov rcx, r14
call fcn.140017a80
test eax, eax
jne 0x1400058b4
cmp r15, rbp
jge 0x14000591c
inc rbx
lea rcx, section..data
inc edi
lea rax, [rbx + rbx*2]
mov rax, qword [rcx + rax*8]
test rax, rax
jne 0x1400058a0
mov ecx, 2
call fcn.140017d70
mov r8, qword [rsp + 0x38]
mov edx, 0xea60
mov rcx, rax
call fcn.140004b90
mov eax, 3
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140007be0
add rsp, 0x88
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lfence
mov rdx, qword [rsp + 0x50]
lea r14, section..data
movsxd rax, edi
mov r9d, r15d
sub r9d, esi
mov r8d, r12d
mov rsi, qword [rsp + 0x38]
lea rcx, [rax + rax*2]
lea rbx, [rcx*8]
mov rax, qword [rbx + r14 + 8]
lea rcx, [rbp*8]
add rcx, r13
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [0x140055500]
mov edi, eax
mov edx, eax
test eax, eax
je 0x140005a68
sub edx, 1
je 0x1400059c2
mov rbx, qword [rbx + r14]
mov ecx, 2
cmp edx, ecx
je 0x1400059a3
call fcn.140017d70
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov edx, 0xea61
call fcn.140004b90
mov eax, edi
jmp 0x1400058ee
call fcn.140017d70
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov edx, 0xea62
call fcn.140004b90
mov eax, edi
jmp 0x1400058ee
cmp dword [rsp + 0x30], 0
je 0x140005a68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140005a48
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140005a42
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x64], rax
xor r9d, r9d
xor eax, eax
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x6c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 0x80010002
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov eax, edi
jmp 0x1400058ee