Function at 0x446740
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
add edx, 0xffff6320
push esi
mov esi, ecx
cmp edx, 0x7c
ja case.0x446762.40172
movzx eax, byte [edx + 0x446a00]
jmp dword [eax*4 + 0x4469b8]
push esi
call sym.SystemInformer.exe_Ordinal_1197
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call sym.SystemInformer.exe_Ordinal_1198
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call sym.SystemInformer.exe_Ordinal_1225
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call sym.SystemInformer.exe_Ordinal_1195
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push esi
call sym.SystemInformer.exe_Ordinal_1203
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 4
push esi
call sym.SystemInformer.exe_Ordinal_1203
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push 1
push esi
call sym.SystemInformer.exe_Ordinal_1203
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 5
push esi
call sym.SystemInformer.exe_Ordinal_1203
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push esi
call sym.SystemInformer.exe_Ordinal_1224
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 8
push 1
push esi
call sym.SystemInformer.exe_Ordinal_1224
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 2
push esi
call sym.SystemInformer.exe_Ordinal_1203
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 2
push esi
call sym.SystemInformer.exe_Ordinal_1224
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 3
push esi
call sym.SystemInformer.exe_Ordinal_1203
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 3
push esi
call sym.SystemInformer.exe_Ordinal_1224
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x446888
push 0
push 0
push str.the_computer
push str.update_and_restart
push esi
call sym.SystemInformer.exe_Ordinal_1695
nop
test al, al
je 0x4469a7
push 0x80000000
push 0x45
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
nop dword [eax + eax]
test eax, eax
je 0x4469a7
push eax
push 0
push str.Unable_to_restart_the_computer.
push esi
call sym.SystemInformer.exe_Ordinal_1701
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x4468f7
push 0
push 0
push str.the_computer
push str.update_and_shutdown
push esi
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je 0x4469a7
push 0x80000000
push 0x49
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4469a7
push eax
push 0
push str.Unable_to_shut_down_the_computer.
push esi
call sym.SystemInformer.exe_Ordinal_1701
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
mov dword [esp + 0x10], str.EnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x446964
push 0
push 0
push str.the_computer_for_Windows_Defender_Offline_Scan
push str.restart
push esi
call sym.SystemInformer.exe_Ordinal_1695
nop
test al, al
je 0x4469a7
call fcn.0052bec0
test eax, eax
je 0x4469a7
mov ecx, eax
and ecx, 0xffff0000
cmp ecx, 0x80070000
jne 0x446995
movzx eax, ax
push eax
push 0
push str.Unable_to_restart_the_computer.
push esi
call sym.SystemInformer.exe_Ordinal_1701
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000001
push str.Unable_to_restart_the_computer.
push esi
call sym.SystemInformer.exe_Ordinal_1701
mov al, 1
pop esi
mov esp, ebp
pop ebp
xor al, al
pop esi
mov esp, ebp
pop ebp
ret