Function at 0x56cb6d
Capabilities:
Shutdown system

Disassembly:
push 0x5c
mov eax, 0x6191db
call fcn.00579aba
push str.attemptReboot__Win32_
lea ecx, [ebp - 0x14]
call fcn.0056864c
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.0056c62a
xor esi, esi
inc esi
test al, al
je 0x56cd04
lea eax, [ebp - 0x10]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x56cc1a
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x56cbdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056df09
jmp 0x56cbde
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0052319d
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x20], 0x3e
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x68]
call fcn.0056b108
push 0x686794
lea eax, [ebp - 0x68]
push eax
call fcn.00579606
lea eax, [ebp - 0x2c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x56cc80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x56cc5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056df09
jmp 0x56cc5d
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0052319d
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x20], 0x45
jmp 0x56cbfc
mov eax, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
push ebx
push 0x10
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push dword [ebp - 0x10]
jne 0x56ccfe
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 5
je 0x56ccd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056df09
jmp 0x56ccdb
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0052319d
mov byte [ebp - 4], 6
mov dword [ebp - 0x24], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x20], 0x4e
jmp 0x56cbfc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0056c72a
test al, al
je 0x56cd91
call fcn.0056c942
test al, al
je 0x56cd91
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0056f85a
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 7
je 0x56cd49
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x2c], str...AttemptRebootWin32.cpp
mov dword [ebp - 0x28], 0x5a
lea eax, [ebp - 0x2c]
jmp 0x56cc03
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00419296
push SysReAllocString
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp eax, ebx
jne 0x56ce35
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0xa
je 0x56ce08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056df09
jmp 0x56ce0a
call fcn.0056c6d1
test al, al
je 0x56cd54
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x56cd54
push str.InitiateSystemShutdownExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x56cd54
push SysReAllocString
push esi
push esi
push ebx
push ebx
push ebx
call eax
cmp eax, ebx
jne 0x56ce35
push 8
call fcn.00401012
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x56cded
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0056df09
jmp 0x56cdef
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0052319d
mov byte [ebp - 4], 9
mov dword [ebp - 0x28], 0x72
jmp 0x56ce21
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0052319d
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x28], 0x88
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], str...AttemptRebootWin32.cpp
jmp 0x56cc04
lea ecx, [ebp - 0x14]
call fcn.005672a3
call fcn.00579b92
ret