Function at 0x402d40
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
mov ebx, ecx
mov dword [ebp - 0x18], str.EnableWarnings
push eax
mov esi, edx
mov dword [ebp - 0x3c], ebx
mov edi, 0xc0000001
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x402d96
push 0
push 0
push str.the_computer
push str.restart
push ebx
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x40301e
call fcn.0051ef80
mov dword ds:[ebp - 0x18], eax
test eax, eax
je 0x402f76
cmp esi, dword [eax]
jae 0x402ecf
lfence
mov eax, dword [eax + 8]
xor ebx, ebx
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
call fcn.0051e340
test al, al
je 0x402ec9
mov esi, dword [0x635e60]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call dword [0x5a28f0]
call esi
mov edi, eax
mov eax, ebx
test edi, edi
cmovns eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
js 0x402ec9
call fcn.0051e340
test al, al
jne 0x402e19
mov edi, 0xc0000001
jmp 0x402ea8
mov esi, dword [0x635e68]
lea eax, [ebp - 0x28]
push eax
push 0x5c99cc
push dword [ebp - 0x20]
mov ecx, esi
call dword [0x5a28f0]
call esi
mov edi, eax
test edi, edi
cmovns ebx, dword [ebp - 0x28]
js 0x402e8a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
call fcn.0051e340
lea esp, [esp]
test al, al
jne 0x402e6b
mov edi, 0xc0000001
jmp 0x402e8a
mov esi, dword [0x635e64]
lea eax, ds:[ebp - 0x14]
push 0x10
push eax
push 0x24000002
push ebx
mov ecx, esi
call dword [0x5a28f0]
call esi
mov edi, eax
test ebx, ebx
je 0x402ea8
call fcn.0051e340
test al, al
je 0x402ea8
mov esi, dword [0x635e50]
mov ecx, esi
push ebx
call dword [0x5a28f0]
call esi
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x402ec9
call fcn.0051e340
test al, al
je 0x402ec9
mov esi, dword [0x635e5c]
mov ecx, esi
push ebx
call dword [0x5a28f0]
call esi
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov esi, edi
call fcn.0051f040
test edi, edi
js 0x402f50
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x40301e
push eax
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x403009
push dword ds:[esi + 4]
push 0x5cc434
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebx
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40301e
call fcn.004fbd80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov edi, esi
cmp esi, 0xc0000022
je 0x402f68
lea ebx, [ebx]
cmp edi, 0xc0000005
jne 0x402f76
mov edi, esi
push edi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x402f9c
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x402f8c
movzx eax, di
jmp 0x402f9c
mov eax, edi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x402faf
mov eax, edi
lea esp, [esp]
test eax, eax
je 0x402faf
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x402fb8
push edi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
mov esi, eax
test esi, esi
je 0x403009
lfence
lfence
push dword [esi + 4]
push 0x5cc434
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebx
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40301e
lfence
call fcn.004fbd80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push str.Unable_to_configure_the_boot_application.
push 0x5cc434
push 0x10
push ebx
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057e94f
mov esp, ebp
pop ebp
ret