Function at 0x180008450
Capabilities:
Check for time delay via queryperformancecounter
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor esi, esi
mov dword [rdx + 0x110], r8d
sub r8d, 2
mov ebx, esi
mov r13, rdx
mov r14, rcx
mov qword [rsp + 0x68], rbx
je 0x18000852d
dec r8d
je 0x1800084c1
dec r8d
je 0x1800084ad
dec r8d
je 0x1800084a1
mov edi, 0x54f
mov eax, edi
jmp 0x18000878e
mov edi, 0x32
mov eax, edi
jmp 0x18000878e
lea r9, [rdx + 0x4c]
lea r8, [rdx + 8]
lea rdx, [rsp + 0x68]
call fcn.180008960
jmp 0x18000853f
mov ecx, 0x258
call fcn.1800251fc
test rax, rax
je 0x1800084dd
mov rcx, rax
call fcn.180022280
mov rbp, rax
jmp 0x1800084e0
mov rbp, rsi
mov rax, qword [r14 + 8]
lea r8, [r13 + 0x4c]
lea rdx, [r13 + 8]
mov rcx, rbp
mov qword [rbp + 0x30], rax
call fcn.180022400
mov edi, eax
test eax, eax
jne 0x180008513
mov rcx, rbp
call fcn.180022500
mov edi, eax
test eax, eax
jne 0x180008513
mov rbx, rbp
mov edi, esi
jmp 0x180008546
mov rcx, rbp
call fcn.1800225f0
mov rcx, rbp
call fcn.180022370
mov rcx, rbp
call sub.KERNEL32.dll_LocalFree
jmp 0x180008546
lea r9, [rdx + 0x4c]
lea r8, [rdx + 8]
lea rdx, [rsp + 0x68]
call fcn.180008840
mov rbx, qword [rsp + 0x68]
mov edi, eax
test edi, edi
je 0x180008551
mov eax, edi
jmp 0x18000878e
mov ecx, 0xf010
call fcn.1800251fc
lea rcx, [rsp + 0x68]
mov qword [rax], 0x20190520
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x180037b20]
mov dword [rdi + 0xc], esi
imul r11d, r11d, 0x7f
add r11d, dword [rsp + 0x6c]
mov ecx, r11d
shr ecx, 3
add ecx, dword [rsp + 0x68]
add r11d, ecx
mov dword [0x180037b20], r11d
and r11d, 0x1f
mov dword [rdi + 8], r11d
jle 0x1800085e2
lea rbp, [rdi + 0x10]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x180037b20]
inc esi
inc rbp
imul r11d, r11d, 0x7f
add r11d, dword [rsp + 0x6c]
mov eax, r11d
shr eax, 3
add eax, dword [rsp + 0x68]
add r11d, eax
mov byte [rbp - 1], r11b
mov dword [0x180037b20], r11d
cmp esi, dword [rdi + 8]
jl 0x1800085a5
mov r8d, 0x7530
mov rdx, rdi
mov rcx, rbx
call fcn.180020860
lea rcx, [r14 + 0x69b0]
mov r8d, 0x120
mov rdx, r13
mov esi, eax
call fcn.18002525c
test esi, esi
jne 0x180008737
lea r12, [0x180000000]
nop dword [rax]
mov r8d, 0x2bf20
mov rdx, rdi
mov rcx, rbx
call fcn.180020690
mov esi, eax
test eax, eax
jne 0x180008737
mov eax, dword [rdi + 4]
dec eax
cmp eax, 0xb
ja case.default.0x180008650
mov ecx, dword [r12 + rax*4 + 0x87b0]
add rcx, r12
jmp rcx
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.180008ab0
jmp 0x1800086d9
mov rdx, rdi
mov rcx, rbx
call fcn.180008fb0
jmp 0x1800086d9
mov rdx, rdi
mov rcx, r14
call fcn.180009090
jmp 0x1800086d9
mov rdx, rdi
mov rcx, rbx
call fcn.180009210
jmp 0x1800086d9
mov rdx, rdi
mov rcx, rbx
call fcn.180009490
jmp 0x1800086d9
mov rdx, rdi
mov rcx, rbx
call fcn.1800092f0
jmp 0x1800086d9
mov rcx, rdi
call fcn.180009370
jmp 0x1800086d9
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.1800095b0
jmp 0x1800086d9
mov edx, dword [rdi + 0x10]
lea rcx, [r14 + 0x158]
call fcn.180005620
jmp case.default.0x180008650
mov rcx, rdi
call fcn.180008290
mov esi, eax
test eax, eax
je case.default.0x180008650
jmp 0x180008737
lea rcx, str.SeShutdownPrivilege
call fcn.18001d0e0
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne case.default.0x180008650
lea ecx, [rax + 6]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne case.default.0x180008650
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp case.default.0x180008650
mov esi, 0x2746
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov rcx, rbx
call qword [rbx + 0x28]
mov eax, dword [rbx + 0x84]
sub eax, 2
je 0x18000875c
dec eax
je 0x1800087a5
dec eax
je 0x18000875c
dec eax
jne 0x180008778
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call sub.KERNEL32.dll_LocalFree
lea rcx, [r14 + 0x69b0]
xor edx, edx
mov r8d, 0x120
call fcn.1800252b0
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.180022370
jmp 0x180008770