Function at 0x140116dc0
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov esi, edx
mov rbx, rcx
xor r14d, r14d
mov qword [rbp - 0x21], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x21]
lea edx, [r14 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140116fe6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp + 7]
call fcn.140023b20
nop
mov qword [rbp - 0x29], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov ecx, 0x13ff
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, eax
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 7
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.140018360
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rax, qword [rbp - 0x19]
lea rcx, [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
cmovae rcx, qword [rbp + 7]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Unable_to_OpenProcessToken:__d__s
lea r8, [r14 - 1]
call fcn.14009d740
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140116ef9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140116ef4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011765b
call fcn.1401a9460
lea rdi, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdi, qword [rbp + 7]
mov dword [rbp - 0x29], r14d
lea rax, [rbp - 0x29]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x25]
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 7
mov r8d, 0x14
lea rdx, str.InitiateSystemReboot
lea rcx, [rbp - 0x19]
call fcn.140018360
nop
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x59]
call fcn.140018360
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x69]
mov r8d, 0x8e5
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x59]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14011761f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401174ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140117649
jmp 0x1401174ef
lea r8, [rbp + 0x27]
lea rdx, [0x14024be28]
lea rcx, [0x14022de70]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1401171d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 7
mov word [rbp - 0x19], r14w
mov edx, 0x400
lea rcx, [rbp - 0x19]
call fcn.140023c30
mov rdx, rax
mov qword [rbp - 9], 0x3ff
mov qword [rbp - 1], 0x3ff
movzx eax, r14w
mov rdi, rdx
mov ecx, 0x3ff
rep stosw word [rdi], ax
mov word [rdx + 0x7fe], r14w
mov qword [rbp - 0x19], rdx
mov edx, ebx
lea rcx, [rbp - 0x59]
call fcn.14007dcf0
cmp qword [rax + 0x18], 8
jb 0x14011707e
mov rax, qword [rax]
lea rcx, [rbp - 0x19]
mov rdx, qword [rbp - 1]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Unable_to_LookupPrivilegeValue:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009d740
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x1401170eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401170e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140117661
call fcn.1401a9460
lea rdi, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdi, qword [rbp - 0x19]
mov dword [rbp - 0x29], r14d
lea rax, [rbp - 0x29]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x25]
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x59]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 7
mov r8d, 0x14
lea rdx, str.InitiateSystemReboot
lea rcx, [rbp - 0x59]
call fcn.140018360
nop
mov qword [rbp + 7], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp + 7]
call fcn.140018360
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x69]
mov r8d, 0x8ec
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x14011761f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401174ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011764f
jmp 0x1401174ef
mov dword [rbp + 0x2f], 1
mov rax, qword [rbp + 0x27]
mov qword [rbp + 0x33], rax
mov dword [rbp + 0x3b], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp + 0x2f]
xor edx, edx
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, eax
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1401173ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp + 7]
call fcn.140023b20
nop
mov edx, edi
lea rcx, [rbp - 0x59]
call fcn.14007dcf0
cmp qword [rax + 0x18], 8
jb 0x140117251
mov rax, qword [rax]
lea rcx, [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
cmovae rcx, qword [rbp + 7]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Unable_to_AdjustTokenPrivileges:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009d740
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x1401172be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401172b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140117667
call fcn.1401a9460
lea rdi, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdi, qword [rbp + 7]
mov dword [rbp - 0x29], r14d
lea rax, [rbp - 0x29]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x25]
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x59]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 7
mov r8d, 0x14
lea rdx, str.InitiateSystemReboot
lea rcx, [rbp - 0x59]
call fcn.140018360
nop
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x19]
call fcn.140018360
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x69]
mov r8d, 0x8f8
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14011761f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401174ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140117655
jmp 0x1401174ef
mov dword [rsp + 0x28], 0x80010002
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
cmp eax, 1
jne 0x1401174f9
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp + 7]
call fcn.140023b20
nop
lea rcx, [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
cmovae rcx, qword [rbp + 7]
lea r9, str.Initiating_system_shutdown
mov r8, 0xffffffffffffffff
call fcn.14009d740
lea rdi, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdi, qword [rbp + 7]
mov dword [rbp - 0x29], r14d
lea rax, [rbp - 0x29]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x25]
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x59]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 7
mov r8d, 0x14
lea rdx, str.InitiateSystemReboot
lea rcx, [rbp - 0x59]
call fcn.140018360
nop
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x19]
call fcn.140018360
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x69]
mov r8d, 0x902
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14011761f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401174ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011766d
call fcn.1401a9460
jmp 0x14011761f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x19]
call fcn.140023b20
nop
mov edx, edi
lea rcx, [rbp - 0x59]
call fcn.14007dcf0
cmp qword [rax + 0x18], 8
jb 0x140117528
mov rax, qword [rax]
lea rcx, [rbp - 0x19]
mov rdx, qword [rbp - 1]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Initiating_system_shutdown_failed_with_error_code:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009d740
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x140117595
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140117590
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140117643
call fcn.1401a9460
lea rbx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rbx, qword [rbp - 0x19]
mov dword [rbp - 0x29], r14d
lea rax, [rbp - 0x59]
mov qword [rbp - 0x31], rax
lea rdx, str.InitiateSystemReboot
lea rcx, [rbp - 0x59]
call fcn.140017fc0
mov rdi, rax
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp + 7]
call fcn.140017fc0
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x69], rcx
lea rcx, [rbp - 0x25]
mov qword [rbp - 0x61], rcx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x69]
mov r8d, 0x906
mov rdx, rdi
mov rcx, rax
call fcn.1400b0fe0
nop
mov r8, qword [rbp - 1]
cmp r8, 8
jb 0x14011761f
inc r8
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x19]
call fcn.140023c60
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1401a9440
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3
call fcn.1401e37cc
int3
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3