Function at 0x180005c80
Capabilities:
Shutdown system

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov eax, dword [0x180042724]
mov r10, qword [0x1800420f0]
mov dword [rsp + 0x3d], 0xfd18b4c
mov dword [rsp + 0x39], eax
add r10, 0x200
mov byte [rsp + 0x41], 5
mov byte [rsp + 0x38], 0xb8
mov rax, qword [r11 - 0x30]
mov r9d, 8
mov qword [r10], rax
movzx eax, word [rsp + 0x40]
mov ebp, r8d
mov word [r10 + 8], ax
mov rsi, rdx
lea rax, [r11 + 0x20]
mov rdi, rcx
lea r8, [r11 - 0x30]
lea edx, [r9 + 0x16]
or rcx, 0xffffffffffffffff
mov qword [r11 - 0x48], rax
mov byte [r10 + 0xa], 0xc3
call r10
mov rcx, qword [0x1800420f0]
xor edx, edx
mov r8d, 0x1000
mov ebx, eax
call fcn.180016520
cmp ebx, 0xc0000353
jne 0x180005d1a
cmp qword [rsp + 0x38], 0
je 0x180005d1d
mov byte [rsi], 0xd
movzx edx, byte [rsi]
cmp edx, 0x2a
ja case.0x180005d47.1
lea r8, [0x180000000]
movsxd rax, edx
movzx eax, byte [r8 + rax + 0x6028]
mov ecx, dword [r8 + rax*4 + 0x5fec]
add rcx, r8
jmp rcx
mov ecx, 1
call fcn.180002ec0
movzx ecx, byte [rsi + 1]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.180002ec0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rsp + 0x78]
lea ecx, [r8 + 0x13]
mov dl, 1
mov rdi, rax
call rbx
lea r11, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
mov dword [rsp + 0x20], 6
call rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov byte [0x180042204], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsi + 1]
lea rcx, str.Group
call fcn.180011080
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsi + 1]
lea rcx, str.Remark
call fcn.180011080
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x180035314]
lea rcx, [0x1800350a8]
call fcn.180011080
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov edx, ebp
mov rcx, rsi
call fcn.1800061b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea r9, [rdi + 0x20]
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call fcn.180006290
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r9d, 1
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call fcn.1800064b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x180042840]
lea rdx, [rsi + 1]
mov r8d, 0x83
call fcn.180011290
cmp byte [0x180042206], 0
jne 0x180005f00
cmp byte [0x180042610], 0
jne 0x180005f00
lea rcx, [0x180007b90]
xor edx, edx
call fcn.180002c40
mov ecx, dword [rdi + 0x2068]
mov qword [rdi + rcx*8 + 0x128], rax
inc dword [rdi + 0x2068]
mov byte [0x180042610], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x180042207], 0
jne 0x180005f40
lea rcx, [0x180006a20]
mov rdx, rdi
call fcn.180002c40
mov ecx, dword [rdi + 0x2068]
mov qword [rdi + rcx*8 + 0x128], rax
inc dword [rdi + 0x2068]
mov byte [0x180042207], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x180042206], 0
jne 0x180005f89
cmp byte [0x180042610], 0
jne 0x180005f89
lea rcx, [0x180007b90]
mov rdx, rdi
call fcn.180002c40
mov ecx, dword [rdi + 0x2068]
mov qword [rdi + rcx*8 + 0x128], rax
inc dword [rdi + 0x2068]
mov byte [0x180042206], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea r8d, [rbp - 1]
lea rdx, [rsi + 1]
xor r9d, r9d
mov rcx, rdi
call fcn.1800064b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x180006060]
call fcn.180002c40
mov ecx, dword [rdi + 0x2068]
mov qword [rdi + rcx*8 + 0x128], rax
inc dword [rdi + 0x2068]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret