Function at 0x140037e30
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140087048]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x68], rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x14007a5f0]
movdqu xmmword [rbp - 0x50], xmm1
mov byte [rbp - 0x60], r14b
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
lea rdx, str.__.__
lea rcx, [rbp - 0x40]
call fcn.1400103c0
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp], r14
mov byte [rbp + 8], r14b
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov qword [rbp + 0x30], r14
mov byte [rbp + 0x38], r14b
movdqa xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x50], r14b
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
mov byte [rbp + 0x68], r14b
add rbx, 0x150
cmp qword [rbx + 0x18], 0x10
jb 0x140037efe
mov r8, qword [rbx]
mov rdx, r8
add rdx, qword [rbx + 0x10]
mov rbx, r8
jmp 0x140037f08
mov rdx, qword [rbx + 0x10]
add rdx, rbx
mov r8, rbx
mov qword [rsp + 0x28], r8
lea r9, [rbp - 0x40]
lea r8, [rbp]
mov rcx, rbx
call fcn.140010d90
test al, al
je 0x140038005
mov rcx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x10]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 1
ja 0x140037f5b
lea rax, [rbp + 0x58]
lea r8, [rbp + 0x68]
jmp 0x140037f63
lea rax, [r8 + 0x18]
add r8, 0x28
cmp byte [r8], 0
je 0x140037f73
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
jmp 0x140037f7c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
cmp rdx, r8
jne 0x140037fab
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
jmp 0x140037fb8
sub r8, rdx
lea rcx, [rsp + 0x30]
call fcn.140007670
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140037ff3
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003898d
call fcn.14003dd70
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x50], xmm1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x68]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400381cc
lea rcx, [rsp + 0x30]
call fcn.14000f830
nop
mov r9d, 5
lea r8, str.HWID
mov rcx, rax
call fcn.14000c2f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str._ExitWindows_fail
lea rcx, [rsp + 0x78]
call fcn.140006e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400380f2
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400380ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038993
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140038141
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003813c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038999
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rbp + 0x10]
call fcn.1400102a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400106c0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140038189
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x140038189
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140038948
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038975
jmp 0x140038943
lea r8, [rbp - 0x14]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
call fcn.14004eac4
mov rsi, rax
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rbx, qword [rbp - 0x60]
mov dword [rax], r14d
mov r8d, 0xa
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.14004e888
cmp rbx, qword [rsp + 0x78]
je 0x14003899f
cmp dword [rsi], 0x22
je 0x1400389ac
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp - 0x18]
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400383f9
lea rcx, [rsp + 0x30]
call fcn.14000f830
nop
mov r9d, 5
lea r8, str.HWID
mov rcx, rax
call fcn.14000c2f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x2b
lea rdx, str._ExitWindows_fail___Cant_adjust_Privileges
lea rcx, [rsp + 0x78]
call fcn.140006e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14003831f
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003831a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389b9
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003836e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038369
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389bf
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rbp + 0x10]
call fcn.1400102a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400106c0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400383b6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x1400383b6
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140038948
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003897b
jmp 0x140038943
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400385ae
lea rcx, [rsp + 0x30]
call fcn.14000f830
nop
mov r9d, 5
lea r8, str.HWID
mov rcx, rax
call fcn.14000c2f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str._ExitWindows_fail
lea rcx, [rsp + 0x78]
call fcn.140006e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400384d4
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400384cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389c5
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140038523
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003851e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389cb
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rbp + 0x10]
call fcn.1400102a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400106c0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14003856b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x14003856b
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140038948
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038981
jmp 0x140038943
call fcn.14004eac4
mov rsi, rax
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rbx, qword [rbp - 0x60]
mov dword [rax], r14d
mov r8d, 0xa
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.14004e888
cmp rbx, qword [rsp + 0x78]
je 0x1400389d1
cmp dword [rsi], 0x22
je 0x1400389de
or eax, 4
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_ExitWindowsEx]
lea rcx, [rsp + 0x50]
test eax, eax
je 0x1400387ae
call fcn.14000f830
nop
mov r9d, 5
lea r8, str.HWID
mov rcx, rax
call fcn.14000c2f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x14
lea rdx, str._ExitWindows_success
lea rcx, [rsp + 0x30]
call fcn.140006e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400386d3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400386ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389eb
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140038723
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003871e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389f1
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, [rbp + 0x10]
call fcn.1400102a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400106c0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14003876b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x14003876b
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140038948
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038987
jmp 0x140038943
call fcn.14000f830
nop
mov r9d, 5
lea r8, str.HWID
mov rcx, rax
call fcn.14000c2f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str._ExitWindows_fail
lea rcx, [rsp + 0x30]
call fcn.140006e40
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140038879
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038874
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389f7
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400388c9
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400388c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400389fd
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, [rbp + 0x10]
call fcn.1400102a0
nop
lea rcx, [rbp - 0x40]
call fcn.1400106c0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140038911
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x140038911
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140038948
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003896f
call fcn.14003dd70
mov rax, rdi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14003dd50
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400447b4
int3
call fcn.1400447b4
int3
call fcn.1400447b4
int3
call fcn.1400447b4
int3
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
int3
lea rcx, str.invalid_stoul_argument
call fcn.14003b974
int3
lea rcx, str.stoul_argument_out_of_range
call fcn.14003b9bc
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
int3
lea rcx, str.invalid_stoul_argument
call fcn.14003b974
int3
lea rcx, str.stoul_argument_out_of_range
call fcn.14003b9bc
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
int3