Function at 0x140004200
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r14, rcx
mov dword [rsp + 0x38], edx
lea rax, str.EnableWarnings
mov qword [rsp + 0x68], 0x1c
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov edi, edx
mov esi, 0xc0000001
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
je 0x14000453b
lea r15, str.restart
mov qword ss:[rsp + 0x188], r12
mov rbx, r15
mov qword [rsp + 0x190], r13
and rbx, 0xfffffffffffffff1
mov rcx, r15
xorps xmm1, xmm1
and ecx, 0xf
je 0x1400042a7
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x30], ecx
je 0x1400042a3
mov ebx, ecx
shr rbx, 1
jmp 0x1400042e8
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x30], ecx
jne 0x1400042da
nop dword [rax]
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x30], ecx
je 0x1400042c0
sub rbx, r15
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402c4fb8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
mov r8, rbx
mov rdx, r15
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rbx + rcx], ax
mov rcx, qword [rdi + 8]
call fcn.1402074d0
mov rcx, rdi
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, qword [0x1402c4fb8]
mov r13, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [r13 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r13], ax
test r12, r12
je 0x140004380
mov rdi, r13
mov ebx, eax
shr rdi, 1
je 0x14000437d
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r15 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140004362
mov qword [r15], r13
mov rcx, r15
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, qword [0x1402c4fb8]
mov r15, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r13, qword [rsp + 0x190]
mov rbx, rax
lea rcx, [rax + 0x10]
mov qword [rax], rdi
mov qword [rax + 8], rcx
xor eax, eax
mov word [rdi + rcx], ax
test r12, r12
je 0x1400043d5
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, r12
call fcn.1402074d0
mov rcx, rbx
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r12, qword [rsp + 0x188]
cmp qword [rax], 0
lea rbx, [rax + 8]
jbe 0x140004401
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r15 + 8]
lea r9, str.the_computer
lea r8, [0x14023a5ac]
mov ecx, 3
call fcn.140001a40
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0xa0
mov rdi, rax
call fcn.140207110
mov rcx, qword [0x1402c4fc8]
mov qword [rbp - 0x74], rcx
mov dword [rbp - 0x80], 0xa0
mov qword [rbp - 0x7c], r14
test r14, r14
je 0x14000446f
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000446f
mov rcx, r14
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140004474
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x140272da0]
mov dword [rbp - 0x6c], eax
lea rdx, str.Do_you_want_to
mov rax, qword [0x1402c4fd0]
mov ecx, 3
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], 0xfffd
call fcn.140001a40
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x54], rax
lea rax, [0x14026a3a8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x54], rcx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x40], rax
mov dword [rsp + 0x50], 6
mov dword [rsp + 0x5c], 7
mov dword [rbp - 0x44], 2
mov dword [rbp - 0x38], 6
mov dword [rbp + 0x1c], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x140004511
cmp dword [rsp + 0x40], 6
jmp 0x14000452c
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, r14
call sym.SystemInformer.exe_QiShowMessage
cmp eax, 6
sete al
test al, al
je 0x1400047c6
mov edi, dword [rsp + 0x38]
movaps xmmword [rsp + 0x140], xmm6
call fcn.14016e460
mov rbx, rax
test rax, rax
je 0x140004714
cmp edi, dword [rax]
jae 0x140004646
lfence
mov rcx, qword [rax + 8]
mov edx, edi
mov r8, qword [rcx + rdx*8]
movups xmm6, xmmword [r8]
call fcn.14016d640
test al, al
je 0x1400046ec
mov rax, qword [0x1402c8538]
lea rcx, [rsp + 0x38]
call qword [case.0x14013b5a0.0]
test eax, eax
js 0x1400046ea
mov r15, qword [rsp + 0x38]
call fcn.14016d640
nop
test al, al
je 0x140004624
mov rax, qword [0x1402c8548]
lea r8, ds:[rsp + 0x48]
lea rdx, [0x1402342a0]
mov rcx, r15
call qword [case.0x14013b5a0.0]
test eax, eax
js 0x140004622
mov rdi, qword [rsp + 0x48]
movdqa xmmword [rbp + 0x20], xmm6
call fcn.14016d640
test al, al
je 0x1400045fe
mov rax, qword [0x1402c8540]
lea r8, [rbp + 0x20]
mov r9d, 0x10
mov edx, 0x24000002
mov rcx, rdi
call qword [case.0x14013b5a0.0]
mov esi, eax
nop
test rdi, rdi
je 0x140004624
call fcn.14016d640
test al, al
je 0x140004624
mov rax, qword [0x1402c8518]
mov rcx, rdi
call qword [case.0x14013b5a0.0]
nop
jmp 0x140004624
mov esi, eax
test r15, r15
je 0x140004646
call fcn.14016d640
test al, al
je 0x140004646
mov rax, qword [0x1402c8530]
mov rcx, r15
call qword [case.0x14013b5a0.0]
mov rcx, rbx
call fcn.14016e540
test esi, esi
js 0x1400046f4
mov r9d, 5
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x1400047be
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r8, [0x140236d98]
mov rbx, rax
lea r9, str.Unable_to_configure_the_boot_application.
mov rcx, r14
test rax, rax
je 0x1400047b4
mov rdx, qword [rax + 8]
mov qword [rsp + 0x28], rdx
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400047be
nop
call fcn.14013fb00
jmp 0x1400047be
mov esi, eax
mov rcx, rbx
call fcn.14016e540
mov eax, esi
cmp esi, 0xc0000022
je 0x140004707
nop
cmp eax, 0xc0000005
jne 0x140004714
lfence
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x14000473c
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000472c
movzx eax, si
jmp 0x14000473c
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x140004750
mov eax, esi
nop dword [rax]
test eax, eax
je 0x140004750
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
jmp 0x14000475a
lfence
mov ecx, esi
call sym.SystemInformer.exe_QiGetNtMessage
lea r8, [0x140236d98]
mov rbx, rax
lea r9, str.Unable_to_configure_the_boot_application.
mov rcx, r14
test rax, rax
je 0x1400047b4
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400047be
lfence
call fcn.14013fb00
jmp 0x1400047be
mov edx, 0x10
call sym.SystemInformer.exe_QiShowMessage
movaps xmm6, xmmword [rsp + 0x140]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1401e0100
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret