Function at 0x402360
Capabilities:
Get uefi variable
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
dec eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 6
ja case.default.0x402389
jmp dword [eax*4 + 0x40290c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4023cd
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402389
mov ecx, dword [ebp + 0x10]
or ecx, 1
call fcn.0050a940
jmp 0x4023e0
test eax, eax
je 0x4028b4
push eax
push 0
jmp 0x4028e9
push str.restart
push str.preforms_a_hard
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
nop
call fcn.00401920
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
lea ecx, [ecx]
test al, al
je case.default.0x402389
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
jns 0x4028b4
push 0
lfence
push eax
jmp 0x4028e9
push str.restart
push str.forces_a_critical
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.00401920
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402389
push 0x80000000
push 6
push 5
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x4028b4
push 0
lfence
push eax
jmp 0x4028e9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4024d5
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402389
mov byte [esp + 0x24], 1
call fcn.0051e340
nop
test al, al
jne 0x4024f9
mov ebx, 0xc0000001
push 0
push ebx
lfence
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x4028ee
mov esi, dword [0x635e60]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call dword [0x5a28f0]
call esi
mov ebx, eax
mov eax, 0
test ebx, ebx
cmovns eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov esi, eax
js 0x4025cf
call fcn.0051e340
test al, al
jne 0x40253b
mov ebx, 0xc0000001
jmp 0x4025cf
lea eax, [esp + 0x10]
push eax
push 0x5ca768
push esi
mov esi, dword [0x635e68]
mov ecx, esi
call dword [0x5a28f0]
call esi
mov ebx, eax
mov esi, 0
test ebx, ebx
cmovns esi, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
js 0x4025a1
call fcn.0051e340
test al, al
jne 0x40257a
mov ebx, 0xc0000001
jmp 0x40259d
push 1
lea eax, [esp + 0x28]
push eax
push 0x260000c3
push esi
mov esi, dword [0x635e64]
mov ecx, esi
call dword [0x5a28f0]
call esi
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], 0
mov eax, dword [esp + 0x20]
mov esi, eax
je 0x4025cf
call fcn.0051e340
test al, al
je 0x4025cf
push dword [esp + 0x1c]
mov esi, dword [0x635e50]
mov ecx, esi
call dword [0x5a28f0]
call esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4025ed
call fcn.0051e340
test al, al
je 0x4025ed
push esi
mov esi, dword [0x635e5c]
mov ecx, esi
call dword [0x5a28f0]
call esi
test ebx, ebx
js 0x4024e9
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4028b4
push eax
push 0
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x4028ee
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
je 0x4027f7
push 1
push 0x16
push 0
call sym.SystemInformer.exe_PhAdjustPrivilege
lea esp, [esp]
test eax, eax
js 0x4027f7
xor eax, eax
mov dword [esp + 0x28], 0x40002
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], 0x5cc714
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
je 0x40269b
push str.This_machine_does_not_have_UEFI_support.
jmp 0x4027fc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4026d5
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402389
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 8
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x28], 0
push eax
push 0x5d31cc
push 0x630e54
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov edx, eax
cmp edx, 0xc0000100
je 0x4027e7
mov ecx, dword ds:[esp + 0x28]
and ecx, 1
or ecx, 0
je 0x4027e7
test edx, edx
js 0x4027ec
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push 0x5d31cc
push 0x630e0c
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov edx, eax
test edx, edx
jns 0x40277f
cmp edx, 0xc0000100
jne 0x4027ec
or dword [esp + 0x10], 1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp edx, 0xc0000100
jne 0x40279f
mov eax, 1
mov dword [esp + 0x20], eax
jmp 0x4027a3
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push 0x5d31cc
push 0x630e0c
call dword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
mov edx, eax
test edx, edx
js 0x4027ec
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4028b4
push eax
push 0
jmp 0x4028e9
mov edx, 0xc00000bb
push 0
lfence
push edx
jmp 0x4028e9
push str.Make_sure_System_Informer_is_running_with_administrative_privileges.
push str.Unable_to_restart_to_firmware_options.
push 0xfffe
push 1
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x14
jmp case.default.0x402389
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x402850
push 0
push 0
push str.the_computer
push str.update_and_restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402389
push 0x80000000
push 0x45
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4028b4
push eax
push 0
jmp 0x4028e9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4028a9
push 0
push 0
push str.the_computer_for_Windows_Defender_Offline_Scan
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402389
call fcn.0052abe0
mov ecx, eax
test ecx, ecx
jne 0x4028cb
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret 0xc
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x80070000
jne 0x4028e2
movzx eax, cx
push eax
push 0
jmp 0x4028e9
push 0
push 0xc0000001
push str.Unable_to_restart_the_computer.
push edi
call sym.SystemInformer.exe_PhShowStatus
mov ecx, dword ds:[esp + 0x44]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret 0xc