Function at 0x14001d7d8
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov al, byte [section.flag_dat]
xor r14d, r14d
mov esi, 1
mov byte [rsp + 0xc0], al
or al, 0x80
test ecx, ecx
setne r14b
mov byte [section.flag_dat], al
test dl, 0x70
mov eax, edx
mov ebx, edx
mov ebp, 0
setne bpl
test dl, 0x72
mov r12d, 0
setne r12b
shr eax, 5
mov r15, r8
and al, 2
test r14d, r14d
mov r13d, edx
movzx eax, al
cmovne eax, esi
shr ebx, 0xe
and ebx, esi
mov dword [rsp + 0xc8], eax
call fcn.140013e20
mov rdi, rax
lea rcx, str.ASNT5SHUTDOWN
shr rdi, 0x10
call fcn.140014668
mov edx, r13d
not edx
mov ecx, esi
mov dword [rsp + 0xd8], eax
and edx, esi
test eax, eax
cmovne ecx, edx
test ecx, ecx
je 0x14001d88c
test ebp, ebp
je 0x14001d88c
cmp edi, 0x60002
jae 0x14001d88e
xor esi, esi
test ebx, ebx
jne 0x14001d89c
test r12d, r12d
je 0x14001d89c
lea edi, [rbx + 1]
jmp 0x14001d8a2
xor edi, edi
test ebx, ebx
jne 0x14001d8ae
test r12d, r12d
je 0x14001d8ae
mov ebx, 1
jmp 0x14001d8b0
xor ebx, ebx
lea rcx, [rsp + 0x78]
mov edx, 0x12c
call fcn.14004bc80
mov ecx, dword [rsp + 0xd8]
movzx eax, byte [rsp + 0xc0]
movzx r12d, byte [rsp + 0xc8]
lea rdx, str._nBoot_0x_X__0x_X____S___Main0x_X__d_op__d__d:0x_X__d__d:_d_
mov r9d, r13d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x50], ebx
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov r8d, r14d
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [rsp + 0x78]
call fcn.140011ef0
and r13d, 0xfffffffe
mov rcx, r15
mov edx, r13d
call fcn.1400144d8
mov r15d, 2
lea rcx, str.SeShutdownPrivilege
mov edx, r15d
call fcn.140016130
lea rcx, str.SeRemoteShutdownPrivilege
mov edx, r15d
call fcn.140016130
and qword [rsp + 0x70], 0
test esi, esi
lea esi, [r15 - 1]
je 0x14001d99c
lea rdx, [0x1400d63f4]
mov r9d, esi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
lea rcx, [0x1400f1e30]
xor r8d, r8d
mov edx, 0x2710
call fcn.140013908
lea rcx, str.___next
call fcn.140011ef0
mov r13d, 0xffff
test edi, edi
je 0x14001d9cc
xor r9d, r9d
lea rax, [rsp + 0x70]
mov r8, rsi
mov qword [rsp + 0x30], rax
lea edx, [r9 + 0x16]
mov rcx, r13
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test ebx, ebx
je 0x14001da1b
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea edx, [r9 + 0x10]
mov rcx, r13
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea r11, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r11
mov edx, r15d
mov rcx, r13
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test ebp, ebp
je 0x14001da2b
mov ecx, r12d
call fcn.140014494
mov ebx, eax
jmp 0x14001da2d
xor ebx, ebx
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret