Function at 0x401f80
Capabilities:
Get uefi variable
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
dec eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 5
ja case.default.0x401fa5
jmp dword [eax*4 + 0x4024c0]
push str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x401fd2
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je case.default.0x401fa5
mov eax, dword [ebp + 0x10]
push 0x80000000
or eax, 4
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4024a8
push eax
push 0
push str.Unable_to_restart_the_computer.
push edi
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 0xc
push str.restart
push str.preforms_a_hard
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004015a0
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je case.default.0x401fa5
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
jns 0x4024a8
push 0
lfence
push eax
jmp 0x401ff5
push str.restart
push str.forces_a_critical
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.004015a0
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je case.default.0x401fa5
push 0x80000000
push 6
push 5
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x4024a8
push 0
lfence
push eax
jmp 0x401ff5
push str.EnableWarnings
mov edi, edi
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x4020e8
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
lea ecx, [ecx]
test al, al
je case.default.0x401fa5
mov byte [esp + 0xc], 1
call fcn.004dd6a0
test al, al
jne 0x40210b
mov ebx, 0xc0000001
push 0
push ebx
lfence
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x401ffa
mov esi, dword [0x5cf1f4]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call dword [0x55890c]
mov edi, edi
call esi
mov ebx, eax
test ebx, ebx
js 0x4020fb
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], esi
call fcn.004dd6a0
test al, al
jne 0x402145
mov ebx, 0xc0000001
jmp 0x4021d7
lea eax, [esp + 0x20]
push eax
push 0x5c78f0
push esi
mov esi, dword [0x5cf1fc]
mov ecx, esi
call dword [0x55890c]
mov edi, edi
call esi
mov ebx, eax
test ebx, ebx
js 0x4021d3
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
call fcn.004dd6a0
test al, al
jne 0x402182
mov ebx, 0xc0000001
jmp 0x4021a9
mov esi, dword [0x5cf1f8]
lea eax, [esp + 0xc]
push 1
push eax
push 0x260000c3
push ebx
mov ecx, esi
call dword [0x55890c]
call esi
mov ebx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
mov esi, eax
je 0x4021d7
call fcn.004dd6a0
test al, al
je 0x4021d7
push dword [esp + 0x14]
mov esi, dword [0x5cf1e4]
mov ecx, esi
call dword [0x55890c]
call esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4021fa
jmp 0x4021e0
call fcn.004dd6a0
test al, al
je 0x4021fa
push esi
mov esi, dword [0x5cf1f0]
mov ecx, esi
call dword [0x55890c]
call esi
lea ebx, [ebx]
test ebx, ebx
js 0x4020fb
push 0x80000000
push 4
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
jmp 0x402220
test eax, eax
je 0x4024a8
push eax
push 0
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x401ffa
lea eax, [esp + 0x30]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
je 0x402435
lea eax, [esp + 0x10]
push eax
push 0x20
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtOpenProcessToken]
jmp 0x402260
test eax, eax
js 0x402435
push 0
push 0
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
push eax
push 0
push dword [esp + 0x24]
mov dword [esp + 0x44], 2
mov dword [esp + 0x3c], 0x16
mov dword [esp + 0x40], 0
call dword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, 0x106
je 0x402435
test esi, esi
js 0x402435
xor eax, eax
mov dword [esp + 0x18], 0x40002
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0x5838c4
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x30], 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
je 0x402317
push str.This_machine_does_not_have_UEFI_support.
jmp 0x40243a
push str.EnableWarnings
lea esp, [esp]
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x402348
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
lea ecx, [ecx]
test al, al
je case.default.0x401fa5
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 8
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
push eax
push 0x5c9558
push 0x5c9538
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
je 0x402425
mov ecx, dword [esp + 0x18]
and ecx, 1
or ecx, 0
je 0x402425
test eax, eax
js 0x40242a
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
push 0x5c9558
push 0x5c9530
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
jne 0x4023e4
mov ecx, 1
mov dword [esp + 0x10], ecx
jmp 0x4023ec
test eax, eax
js 0x40242a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
or dword [esp + 0x20], 1
push ecx
push dword [esp + 0x18]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push 0x5c9558
push 0x5c9530
call dword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
test eax, eax
js 0x40242a
push 0x80000000
push 4
jmp 0x401fde
mov eax, 0xc00000bb
push 0
lfence
push eax
jmp 0x401ff5
push str.Make_sure_Process_Hacker_is_running_with_administrative_privileges.
push str.Unable_to_restart_to_firmware_options.
push 0xfffe
push 1
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
jmp case.default.0x401fa5
push str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov edi, edi
test eax, eax
je 0x402488
push 0
push 0
push str.the_computer
push str.update_and_restart
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
jmp 0x402480
test al, al
je case.default.0x401fa5
push 0x80000000
push 0x44
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
jmp 0x4024a0
test eax, eax
jne 0x401ff2
mov ecx, dword [esp + 0x44]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 0xc