Function at 0x1400052e0
Capabilities:
Shutdown system

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x88
mov rax, qword [0x1400672a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13, rdx
movsxd rbp, ecx
mov esi, 1
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], 0
xor r12d, r12d
mov rcx, qword [r13]
lea edx, [rsi + 0x5b]
call fcn.140008ecc
test rax, rax
jne 0x140005336
mov rdi, qword [r13]
jmp 0x140005342
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov qword [rsp + 0xd0], rbx
mov r15, rbp
mov qword [rsp + 0x80], r14
mov ecx, 0xfffd
mov qword [rsp + 0x38], rdi
cmp rbp, rsi
jle 0x14000544c
mov rbx, rsi
lea r14d, [rcx - 0x1e]
mov edi, ecx
mov rcx, qword [r13 + rbx*8]
movzx eax, word [rcx]
sub ax, 0x2d
test di, ax
jne 0x140005442
movzx edx, word [rcx + 2]
lea eax, [rdx - 0x4d]
test r14w, ax
je 0x14000541e
lea eax, [rdx - 0x52]
test r14w, ax
je 0x14000540d
lea eax, [rdx - 0x46]
test r14w, ax
je 0x140005400
sub dx, 0x55
test r14w, dx
jne 0x140005442
cmp word [rcx + 4], 0
jne 0x140005442
mov ecx, 1
call fcn.140016a60
mov rcx, rax
call fcn.14002f44c
mov ecx, eax
mov edx, 0x10000
call fcn.14002f4f0
mov ecx, 2
call fcn.140016a60
mov rcx, rax
call fcn.14002f44c
mov ecx, eax
mov edx, 0x10000
call fcn.14002f4f0
jmp 0x140005434
cmp word [rcx + 4], 0
jne 0x140005442
or r12d, 1
jmp 0x140005434
cmp word [rcx + 4], 0
jne 0x140005442
mov dword [rsp + 0x30], 1
jmp 0x140005434
cmp word [rcx + 4], 0x3a
jne 0x140005442
add rcx, 6
cmp word [rcx], 0
je 0x140005442
mov qword [rsp + 0x50], rcx
inc esi
inc rbx
cmp r15, rbx
jg 0x140005371
mov rdi, qword [rsp + 0x38]
mov ecx, 0xfffd
mov eax, ebp
sub eax, esi
cmp eax, 1
jge 0x140005467
mov ecx, 2
call fcn.140016a60
mov r8, rdi
jmp 0x1400054dc
lfence
movsxd rax, esi
mov r14, qword [r13 + rax*8]
movzx eax, word [r14]
sub ax, 0x2d
test cx, ax
jne 0x14000548b
mov rcx, r14
call qword [sym.imp.USER32.dll_CharNextW]
mov r14, rax
mov rax, qword [section..data]
inc esi
xor edi, edi
test rax, rax
je 0x1400054cd
movsxd rbp, esi
xor ebx, ebx
mov rdx, rax
mov rcx, r14
call fcn.14001676c
test eax, eax
jne 0x1400054b4
cmp r15, rbp
jge 0x14000551c
inc rbx
lea rcx, section..data
inc edi
lea rax, [rbx + rbx*2]
mov rax, qword [rcx + rax*8]
test rax, rax
jne 0x1400054a0
mov ecx, 2
call fcn.140016a60
mov r8, qword [rsp + 0x38]
mov edx, 0xea60
mov rcx, rax
call fcn.140004770
mov eax, 3
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400076e0
add rsp, 0x88
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lfence
mov rdx, qword [rsp + 0x50]
lea r14, section..data
movsxd rax, edi
mov r9d, r15d
sub r9d, esi
mov r8d, r12d
mov rsi, qword [rsp + 0x38]
lea rcx, [rax + rax*2]
lea rbx, [rcx*8]
mov rax, qword [rbx + r14 + 8]
lea rcx, [rbp*8]
add rcx, r13
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [0x1400544f8]
mov edi, eax
mov edx, eax
test eax, eax
je 0x140005668
sub edx, 1
je 0x1400055c2
mov rbx, qword [rbx + r14]
mov ecx, 2
cmp edx, ecx
je 0x1400055a3
call fcn.140016a60
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov edx, 0xea61
call fcn.140004770
mov eax, edi
jmp 0x1400054ee
call fcn.140016a60
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov edx, 0xea62
call fcn.140004770
mov eax, edi
jmp 0x1400054ee
cmp dword [rsp + 0x30], 0
je 0x140005668
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140005648
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140005642
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x64], rax
xor r9d, r9d
xor eax, eax
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x6c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 0x80010002
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov eax, edi
jmp 0x1400054ee