Function at 0x1400041c0
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r15, rcx
mov dword [rsp + 0x40], edx
lea rax, str.EnableWarnings
mov qword [rsp + 0x30], 0x1c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov ebx, edx
mov esi, 0xc0000001
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
xor r14d, r14d
test eax, eax
je 0x14000450c
lea r12, str.restart
mov qword [rsp + 0x168], r13
mov rbx, r12
mov rcx, r12
and rbx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14000426d
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x30], ecx
je 0x140004269
mov ebx, ecx
shr rbx, 1
jmp 0x1400042aa
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x30], ecx
jne 0x14000429c
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x30], ecx
je 0x140004282
sub rbx, r12
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402cb8c0]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r8, rbx
mov rdx, r12
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r14w
mov rcx, qword [rax + 8]
call fcn.14020be40
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402cb8c0]
mov rbx, qword ds:[rax]
mov r13, qword [rax + 8]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r12, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], r14w
test r13, r13
je 0x140004356
mov rdi, rbx
mov rbx, r14
shr rdi, 1
je 0x14000434d
nop dword [rax + rax]
movzx ecx, word [r13 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r12 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140004330
mov rax, qword [rsp + 0x30]
mov qword [r12], rax
mov rcx, r12
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402cb8c0]
mov r12, rax
mov rdi, qword [rax]
mov r13, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rdi + rcx], r14w
test r13, r13
je 0x14000439f
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r13
call fcn.14020be40
mov rcx, rbx
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r13, qword [rsp + 0x168]
lea rbx, [rax + 8]
cmp qword [rax], r14
jbe 0x1400043cc
mov rax, qword ds:[rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r12 + 8]
lea r9, str.the_computer
lea r8, [0x14023b5e8]
mov ecx, 3
call fcn.140001a20
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0xa0
mov rdi, rax
call fcn.14020ba80
mov rcx, qword [0x1402cb8d0]
mov qword [rsp + 0x5c], rcx
mov dword [rsp + 0x50], 0xa0
mov qword [rsp + 0x54], r15
test r15, r15
je 0x14000443c
mov rcx, r15
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000443c
mov rcx, r15
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140004441
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14023b66c]
mov dword [rsp + 0x64], eax
lea rdx, [0x14023b670]
mov rax, qword [0x1402cb8d8]
mov ecx, 3
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], 0xfffd
call fcn.140001a20
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rbp - 0xc], rax
lea rax, [0x14023b578]
mov qword [rbp], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x7c], rcx
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x10], 6
mov dword [rbp - 4], 7
mov dword [rbp - 0x74], 2
mov dword [rbp - 0x68], 6
mov dword [rbp - 0x14], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x1400044dd
cmp dword [rsp + 0x30], 6
jmp 0x1400044f8
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, r15
call sym.SystemInformer.exe_PhShowMessage
cmp eax, 6
sete al
test al, al
je 0x14000479e
mov ebx, dword [rsp + 0x40]
call fcn.140171700
mov rdi, rax
test rax, rax
je 0x1400046f5
nop dword [rax]
cmp ebx, dword [rax]
jae 0x140004630
movaps xmmword [rsp + 0x120], xmm6
lfence
mov rcx, qword [rax + 8]
mov edx, ebx
mov r8, qword [rcx + rdx*8]
movups xmm6, xmmword [r8]
call fcn.140170880
test al, al
jne 0x140004551
mov eax, esi
jmp 0x140004628
mov rax, qword [0x1402ceed8]
lea rcx, ds:[rsp + 0x40]
call qword [case.0x14013dbaa.0]
test eax, eax
mov r12, r14
cmovns r12, qword [rsp + 0x40]
jns 0x14000457a
mov esi, eax
jmp 0x140004628
call fcn.140170880
nop
test al, al
jne 0x140004588
mov ebx, esi
jmp 0x140004607
mov rax, qword [0x1402ceee8]
lea r8, ds:[rsp + 0x30]
lea rdx, [0x140238340]
mov rcx, r12
call qword [case.0x14013dbaa.0]
test eax, eax
mov ebx, eax
cmovns r14, qword [rsp + 0x30]
js 0x1400045e9
movdqa xmmword [rbp - 0x10], xmm6
call fcn.140170880
nop dword [rax]
test al, al
jne 0x1400045c8
mov ebx, esi
jmp 0x1400045e9
mov rax, qword [0x1402ceee0]
lea r8, [rbp - 0x10]
mov r9d, 0x10
mov edx, 0x24000002
mov rcx, r14
call qword [case.0x14013dbaa.0]
mov ebx, eax
test r14, r14
je 0x140004607
call fcn.140170880
test al, al
je 0x140004607
mov rax, qword [0x1402ceeb8]
mov rcx, r14
call qword [case.0x14013dbaa.0]
test r12, r12
je 0x140004626
call fcn.140170880
test al, al
je 0x140004626
mov rax, qword [0x1402ceed0]
mov rcx, r12
call qword [case.0x14013dbaa.0]
mov esi, ebx
movaps xmm6, xmmword [rsp + 0x120]
mov rcx, rdi
mov ebx, esi
call fcn.1401717e0
nop word [rax + rax]
test esi, esi
js 0x1400046d3
lfence
mov r9d, 5
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x14000479e
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023b2dc]
mov rbx, rax
lea r9, str.Unable_to_configure_the_boot_application.
mov rcx, r15
test rax, rax
je 0x140004794
mov rdx, qword [rax + 8]
mov qword [rsp + 0x28], rdx
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000479e
call fcn.140142200
jmp 0x14000479e
cmp ebx, 0xc0000022
je 0x1400046e8
nop dword [rax + rax]
cmp ebx, 0xc0000005
jne 0x1400046f5
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x14000471c
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000470c
movzx eax, si
jmp 0x14000471c
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x140004730
mov eax, esi
nop dword [rax]
test eax, eax
je 0x140004730
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x14000473a
lfence
mov ecx, esi
call sym.SystemInformer.exe_PhGetNtMessage
lea r8, [0x14023b2dc]
mov rbx, rax
lea r9, str.Unable_to_configure_the_boot_application.
mov rcx, r15
test rax, rax
je 0x140004794
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000479e
lfence
call fcn.140142200
jmp 0x14000479e
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1401e5e20
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret