Function at 0x402c40
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x62a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
mov ebx, ecx
mov dword [ebp - 0x18], str.EnableWarnings
push eax
mov esi, edx
mov dword [ebp - 0x3c], ebx
mov edi, 0xc0000001
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x402c96
push 0
push 0
push str.the_computer
push str.restart
push ebx
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x402f1e
call fcn.0051ca60
mov dword ds:[ebp - 0x18], eax
test eax, eax
je 0x402e76
cmp esi, dword [eax]
jae 0x402dcf
lfence
mov eax, dword [eax + 8]
xor ebx, ebx
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
call fcn.0051be20
test al, al
je 0x402dc9
mov esi, dword [0x632d60]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call dword [0x5a08ec]
call esi
mov edi, eax
mov eax, ebx
test edi, edi
cmovns eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
js 0x402dc9
call fcn.0051be20
test al, al
jne 0x402d19
mov edi, 0xc0000001
jmp 0x402da8
mov esi, dword [0x632d68]
lea eax, [ebp - 0x28]
push eax
push 0x5c7a2c
push dword [ebp - 0x20]
mov ecx, esi
call dword [0x5a08ec]
call esi
mov edi, eax
test edi, edi
cmovns ebx, dword [ebp - 0x28]
js 0x402d8a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
call fcn.0051be20
lea esp, [esp]
test al, al
jne 0x402d6b
mov edi, 0xc0000001
jmp 0x402d8a
mov esi, dword [0x632d64]
lea eax, ds:[ebp - 0x14]
push 0x10
push eax
push 0x24000002
push ebx
mov ecx, esi
call dword [0x5a08ec]
call esi
mov edi, eax
test ebx, ebx
je 0x402da8
call fcn.0051be20
test al, al
je 0x402da8
mov esi, dword [0x632d50]
mov ecx, esi
push ebx
call dword [0x5a08ec]
call esi
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x402dc9
call fcn.0051be20
test al, al
je 0x402dc9
mov esi, dword [0x632d5c]
mov ecx, esi
push ebx
call dword [0x5a08ec]
call esi
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov esi, edi
call fcn.0051cb20
test edi, edi
js 0x402e50
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402f1e
push eax
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x402f09
push dword ds:[esi + 4]
push 0x5ca058
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebx
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402f1e
call fcn.004f9e40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov edi, esi
cmp esi, 0xc0000022
je 0x402e68
lea ebx, [ebx]
cmp edi, 0xc0000005
jne 0x402e76
mov edi, esi
push edi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x402e9c
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x402e8c
movzx eax, di
jmp 0x402e9c
mov eax, edi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x402eaf
mov eax, edi
lea esp, [esp]
test eax, eax
je 0x402eaf
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x402eb8
push edi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
mov esi, eax
test esi, esi
je 0x402f09
lfence
lfence
push dword [esi + 4]
push 0x5ca058
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebx
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402f1e
lfence
call fcn.004f9e40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push str.Unable_to_configure_the_boot_application.
push 0x5ca058
push 0x10
push ebx
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057c26f
mov esp, ebp
pop ebp
ret