Function at 0x1400033e0
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov r13d, r8d
mov rsi, rcx
sub edx, 1
je 0x14000390b
sub edx, 1
je 0x1400038b6
sub edx, 1
je 0x140003794
nop dword [rax]
cmp edx, 3
jne 0x140003c19
lea rax, str.EnableWarnings
mov qword [rsp + 0x30], 0x1c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x140003708
lea r14, str.update_and_shutdown
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000348a
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003486
mov ebx, ecx
shr rbx, 1
jmp 0x1400034c7
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x1400034b9
nop
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400034a0
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402c5ff0]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r15w
mov rcx, qword [rax + 8]
call fcn.14020c7e0
mov rcx, rdi
call sym.SystemInformer.exe_Ordinal_1238
mov rdx, qword [0x1402c5ff0]
mov r13, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [r13 + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov r14, rax
mov qword [rax], r13
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r13], r15w
test r12, r12
je 0x140003560
mov rdi, r13
mov ebx, r15d
shr rdi, 1
je 0x14000355d
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140003542
mov qword [r14], r13
mov rcx, r14
call sym.SystemInformer.exe_Ordinal_1238
mov rdx, qword [0x1402c5ff0]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], r15w
test r12, r12
je 0x1400035ac
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.14020c7e0
mov rcx, rbx
call sym.SystemInformer.exe_Ordinal_1238
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x1400035cf
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023c748]
mov ecx, 3
call fcn.140001a20
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.14020c410
mov rcx, qword [0x1402c6000]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x14000363c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000363c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140003641
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14023c7cc]
mov dword [rbp - 0x65], eax
lea rdx, [0x14023c7d0]
mov rax, qword [0x1402c6008]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001a20
lea r9, [rbp + 0x7f]
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x6f]
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x14023c6d8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
jne 0x1400036de
cmp dword [rbp + 0x6f], 6
jmp 0x1400036f9
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_Ordinal_1698
cmp eax, 6
sete al
test al, al
je 0x140003c19
lfence
lfence
mov r9d, 0x49
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x140003c08
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
lea r8, [0x14023c43c]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
test rax, rax
je 0x140003c0c
mov rcx, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_Ordinal_1699
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003c19
call fcn.140143da0
jmp 0x140003c19
lea r14, str.shut_down
mov r8, r14
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001a60
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je 0x140003c19
mov edx, 6
mov r8d, 0x80000000
mov ecx, edx
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
mov ebx, eax
test eax, eax
jns 0x140003c08
cmp eax, 0xc0000022
je 0x14000382b
cmp eax, 0xc0000005
je 0x14000382b
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x140003814
movzx eax, bx
jmp 0x140003836
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000383a
mov eax, ebx
jmp 0x140003836
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x140003847
lfence
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x140003851
lfence
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
lea r8, [0x14023c43c]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
mov rcx, rsi
test rax, rax
je 0x140003c0f
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_Ordinal_1699
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003c19
lfence
call fcn.140143da0
jmp 0x140003c19
lea r14, str.shut_down
mov r8, r14
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001a60
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je 0x140003c19
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
jmp 0x1400037e7
lea rax, str.EnableWarnings
mov qword [rsp + 0x30], 0x1c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x140003bf3
lea r14, str.shut_down
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000396d
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003969
mov ebx, ecx
shr rbx, 1
jmp 0x1400039a9
add rbx, 0x10
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x14000399b
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003982
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402c5ff0]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
mov rcx, qword [rax + 8]
call fcn.14020c7e0
mov rcx, rdi
call sym.SystemInformer.exe_Ordinal_1238
mov rdx, qword [0x1402c5ff0]
mov rbx, qword [rax]
mov r12, qword [rax + 8]
mov qword [rbp + 0x7f], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
test r12, r12
je 0x140003a52
mov rdi, rbx
mov ebx, r15d
shr rdi, 1
je 0x140003a4b
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140003a30
mov rax, qword [rbp + 0x7f]
mov qword [r14], rax
mov rcx, r14
call sym.SystemInformer.exe_Ordinal_1238
mov rdx, qword [0x1402c5ff0]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_Ordinal_1240
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], r15w
test r12, r12
je 0x140003a9b
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.14020c7e0
mov rcx, rbx
call sym.SystemInformer.exe_Ordinal_1238
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x140003ac0
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023c748]
mov ecx, 3
call fcn.140001a20
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.14020c410
mov rcx, qword [0x1402c6000]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x140003b2f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140003b2f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140003b34
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14023c7cc]
mov dword [rbp - 0x65], eax
lea rdx, [0x14023c7d0]
mov rax, qword [0x1402c6008]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001a20
lea r9, [rbp + 0x7f]
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x6f]
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x14023c6d8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
jne 0x140003bd1
cmp dword [rbp + 0x6f], 6
jmp 0x140003bec
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_Ordinal_1698
cmp eax, 6
sete al
test al, al
je 0x140003c19
or r13d, 2
mov ecx, r13d
call fcn.1401556c0
nop
test eax, eax
jne 0x140003731
mov al, 1
jmp 0x140003c1b
mov rcx, rsi
mov edx, 0x10
call sym.SystemInformer.exe_Ordinal_1698
xor al, al
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret