Function at 0x100002a9c
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rdx, [0x100001ac8]
mov rsi, rcx
call fcn.100002e78
mov ebx, eax
test eax, eax
jns 0x100002b41
mov rcx, qword [0x100012120]
lea rdi, [0x100012120]
lea rbp, [0x1000016e8]
cmp rcx, rdi
je 0x100002af9
test byte [rcx + 0x1c], 1
je 0x100002af9
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
mov edx, ebx
mov rcx, rsi
call fcn.1000038f0
mov rcx, qword [rsi]
mov r8d, dword [rsi + 8]
mov rax, qword [rcx]
mov edx, 2
call qword [rax + 8]
test eax, eax
jns 0x100002e58
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002e58
test byte [rcx + 0x1c], 1
je 0x100002e58
mov edx, 0xf
jmp 0x100002de5
cmp dword [rsi + 0xc], 3
jne 0x100002bdc
lea rdx, [0x100001af0]
mov rcx, rsi
call fcn.100002e78
mov ebx, eax
test eax, eax
jns 0x100002bdc
mov rcx, qword [0x100012120]
lea rdi, [0x100012120]
lea rbp, [0x1000016e8]
cmp rcx, rdi
je 0x100002b94
test byte [rcx + 0x1c], 1
je 0x100002b94
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
mov edx, ebx
mov rcx, rsi
call fcn.1000038f0
mov rcx, qword [rsi]
mov r8d, dword [rsi + 8]
mov rax, qword [rcx]
mov edx, 2
call qword [rax + 8]
test eax, eax
jns 0x100002e58
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002e58
test byte [rcx + 0x1c], 1
je 0x100002e58
mov edx, 0x11
jmp 0x100002de5
mov rcx, rsi
call fcn.100002fe4
mov ebx, eax
test eax, eax
je 0x100002cae
lea rbp, [0x1000016e8]
lea rdi, [0x100012120]
cmp eax, 0xc0000061
je 0x100002c39
cmp eax, 0xc0000022
je 0x100002c39
mov rcx, qword [rsi]
mov r8d, dword [rsi + 8]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
jns 0x100002c75
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002c7c
test byte [rcx + 0x1c], 1
je 0x100002c7c
mov edx, 0x13
jmp 0x100002c66
mov rcx, qword [rsi]
mov r8d, dword [rsi + 8]
mov edx, 2
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
jns 0x100002c75
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002c7c
test byte [rcx + 0x1c], 1
je 0x100002c7c
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
mov rcx, qword [0x100012120]
bts ebx, 0x1c
cmp rcx, rdi
je 0x100002c9f
test byte [rcx + 0x1c], 1
je 0x100002c9f
mov rcx, qword [rcx + 0x10]
mov edx, 0x14
mov r9d, ebx
mov r8, rbp
call fcn.100001cb4
mov edx, ebx
mov rcx, rsi
call fcn.1000038f0
jmp 0x100002e58
mov rcx, rsi
call fcn.100003348
lea rbp, [0x1000016e8]
lea rdi, [0x100012120]
test eax, eax
jns 0x100002cee
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002cee
test byte [rcx + 0x1c], 2
je 0x100002cee
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
xor edx, edx
mov rcx, rsi
call fcn.1000038f0
test eax, eax
jns 0x100002d22
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002d29
test byte [rcx + 0x1c], 2
je 0x100002d29
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
mov rcx, qword [0x100012120]
cmp dword [rsi + 0xc], 3
jne 0x100002df6
mov r9d, 4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80010001
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x100002d88
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002d91
test byte [rcx + 0x1c], 1
je 0x100002d91
mov rcx, qword [rcx + 0x10]
mov edx, 0x32
mov r9d, ebx
mov r8, rbp
call fcn.100001cb4
jmp 0x100002d8a
xor ebx, ebx
mov rcx, qword [0x100012120]
test ebx, ebx
jns 0x100002df6
cmp rcx, rdi
je 0x100002db4
test byte [rcx + 0x1c], 1
je 0x100002db4
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9d, ebx
mov r8, rbp
call fcn.100001cb4
mov rcx, qword [rsi]
mov r8d, dword [rsi + 8]
mov edx, 3
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
jns 0x100002e58
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002e58
test byte [rcx + 0x1c], 1
je 0x100002e58
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
jmp 0x100002e58
cmp dword [rsi + 0xc], 4
jne 0x100002e3a
mov rcx, qword [rsi]
mov edx, 4
mov rax, qword [rcx]
call qword [rax]
test eax, eax
jns 0x100002e33
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002e56
test byte [rcx + 0x1c], 1
je 0x100002e3a
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9d, eax
mov r8, rbp
call fcn.100001cb4
mov rcx, qword [0x100012120]
cmp rcx, rdi
je 0x100002e56
test byte [rcx + 0x1c], 4
je 0x100002e56
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r8, rbp
call fcn.100001c08
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret