Function at 0x18002c220
Capabilities:
Get uefi variable
Shutdown system

Disassembly:
jmp 0x18002c220
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
lea rdi, [rsp + 0x30]
mov ecx, 0x38
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x120]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x100], eax
mov eax, dword [rsp + 0x100]
dec eax
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 5
ja case.default.0x18002c2a6
movsxd rax, dword [rsp + 0x100]
lea rcx, [0x180000000]
mov eax, dword [rcx + rax*4 + 0x2c8a8]
add rax, rcx
jmp rax
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002c2e2
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x18002c332
mov eax, dword [rsp + 0x130]
or eax, 4
mov dword [rsp + 0x20], 0x80000000
mov r9d, eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x18002c316
mov al, 1
jmp 0x18002c87a
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp case.default.0x18002c2a6
lea r8, str.restart
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.180010960
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x38]
mov r9, qword [rax + 8]
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x18002c3bf
mov ecx, 1
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x18002c3a3
mov al, 1
jmp 0x18002c87a
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp case.default.0x18002c2a6
lea r8, str.restart
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.180010960
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x48]
mov r9, qword [rax + 8]
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x18002c457
mov r8d, 0x80000000
mov edx, 6
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x18002c43b
mov al, 1
jmp 0x18002c87a
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp case.default.0x18002c2a6
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002c496
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x18002c50f
mov cl, 1
call fcn.1800060e0
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jl 0x18002c4f3
mov dword [rsp + 0x20], 0x80000000
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x18002c4d5
mov al, 1
jmp 0x18002c87a
mov r9d, dword [rsp + 0x54]
xor r8d, r8d
lea rdx, str.Unable_to_configure_the_advanced_boot_options.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp 0x18002c50f
xor r9d, r9d
mov r8d, dword [rsp + 0x54]
lea rdx, str.Unable_to_configure_the_advanced_boot_options.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp case.default.0x18002c2a6
lea rcx, [rsp + 0xe8]
call sym.ProcessMonitor.dll_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
jne 0x18002c55b
lea rax, str.Make_sure_Process_Hacker_is_running_with_administrative_privileges.
mov qword [rsp + 0x20], rax
lea r9, str.Unable_to_restart_to_firmware_options.
mov r8d, 0xfffe
mov edx, 1
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowMessage2
jmp case.default.0x18002c2a6
mov r8b, 1
mov edx, 0x16
xor ecx, ecx
call fcn.1800095b0
test eax, eax
jge 0x18002c59e
lea rax, str.Make_sure_Process_Hacker_is_running_with_administrative_privileges.
mov qword [rsp + 0x20], rax
lea r9, str.Unable_to_restart_to_firmware_options.
mov r8d, 0xfffe
mov edx, 1
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowMessage2
jmp case.default.0x18002c2a6
call fcn.180010660
movzx eax, al
test eax, eax
jne 0x18002c5da
lea rax, str.This_machine_does_not_have_UEFI_support.
mov qword [rsp + 0x20], rax
lea r9, str.Unable_to_restart_to_firmware_options.
mov r8d, 0xfffe
mov edx, 1
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowMessage2
jmp case.default.0x18002c2a6
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002c618
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
je 0x18002c7ea
mov qword [rsp + 0x58], 1
mov dword [rsp + 0x64], 8
mov dword [rsp + 0x84], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
lea r8, [rsp + 0xa8]
lea rdx, [0x18058e290]
lea rcx, [0x18058e2a0]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0xc0000100
je 0x18002c6a2
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa8]
and rcx, rax
mov rax, rcx
test rax, rax
jne 0x18002c6ad
mov dword [rsp + 0xd4], 0xc00000bb
cmp dword [rsp + 0xd4], 0
jl 0x18002c76d
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
lea r8, [rsp + 0xc8]
lea rdx, [0x18058e290]
lea rcx, [0x18058e2b0]
call qword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0xc0000100
jne 0x18002c708
mov dword [rsp + 0x84], 1
cmp dword [rsp + 0xd4], 0
jge 0x18002c71f
cmp dword [rsp + 0xd4], 0xc0000100
jne 0x18002c76d
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8], rax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x64]
lea r8, [rsp + 0xc8]
lea rdx, [0x18058e290]
lea rcx, [0x18058e2b0]
call qword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0
jl 0x18002c7cb
mov dword [rsp + 0x20], 0x80000000
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0xd4], eax
cmp dword [rsp + 0xd4], 0
jne 0x18002c7aa
mov al, 1
jmp 0x18002c87a
mov r9d, dword [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp 0x18002c7ea
xor r9d, r9d
mov r8d, dword [rsp + 0xd4]
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
jmp case.default.0x18002c2a6
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x18002c829
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.the_computer
lea rdx, str.update_and_restart
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowConfirmMessage
movzx eax, al
test eax, eax
je case.default.0x18002c2a6
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0x44
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
jne 0x18002c859
mov al, 1
jmp 0x18002c87a
mov r9d, dword [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.Unable_to_restart_the_computer.
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhShowStatus
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180399730]
call fcn.180014e20
mov rax, rdi
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x110
pop rdi
ret