Function at 0x56c448
Capabilities:
Shutdown system

Disassembly:
push 0x5c
mov eax, 0x618a6b
call fcn.0057938a
push str.attemptReboot__Win32_
lea ecx, [ebp - 0x14]
call fcn.00567f27
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.0056bf05
xor esi, esi
inc esi
test al, al
je 0x56c5df
lea eax, [ebp - 0x10]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x56c4f5
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x56c4b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056d7e4
jmp 0x56c4b9
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00522a78
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x20], 0x3e
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x68]
call fcn.0056a9e3
push 0x6856fc
lea eax, [ebp - 0x68]
push eax
call fcn.00578ed6
lea eax, [ebp - 0x2c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x56c55b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x56c536
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056d7e4
jmp 0x56c538
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00522a78
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x20], 0x45
jmp 0x56c4d7
mov eax, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
push ebx
push 0x10
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push dword [ebp - 0x10]
jne 0x56c5d9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 5
je 0x56c5b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056d7e4
jmp 0x56c5b6
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00522a78
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x20], 0x4e
jmp 0x56c4d7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0056c005
test al, al
je 0x56c66c
call fcn.0056c21d
test al, al
je 0x56c66c
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0056f135
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 7
je 0x56c624
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x2c], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x28], 0x5a
lea eax, [ebp - 0x2c]
jmp 0x56c4de
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00418da3
push SysReAllocString
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp eax, ebx
jne 0x56c710
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0xa
je 0x56c6e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056d7e4
jmp 0x56c6e5
call fcn.0056bfac
test al, al
je 0x56c62f
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x56c62f
push str.InitiateSystemShutdownExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x56c62f
push SysReAllocString
push esi
push esi
push ebx
push ebx
push ebx
call eax
cmp eax, ebx
jne 0x56c710
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x56c6c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056d7e4
jmp 0x56c6ca
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00522a78
mov byte [ebp - 4], 9
mov dword [ebp - 0x28], 0x72
jmp 0x56c6fc
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00522a78
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], 0x88
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], str...AttemptRebootWin32.cpp
jmp 0x56c4df
lea ecx, [ebp - 0x14]
call fcn.00566b7e
call fcn.00579462
ret