Function at 0x402260
Capabilities:
Get uefi variable
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x62e040]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
dec eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 6
ja case.default.0x402289
jmp dword [eax*4 + 0x40280c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4022cd
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402289
mov ecx, dword [ebp + 0x10]
or ecx, 1
call fcn.0050ada0
jmp 0x4022e0
test eax, eax
je 0x4027b4
push eax
push 0
jmp 0x4027e9
push str.restart
push str.preforms_a_hard
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
nop
call fcn.00401820
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
lea ecx, [ecx]
test al, al
je case.default.0x402289
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
jns 0x4027b4
push 0
lfence
push eax
jmp 0x4027e9
push str.restart
push str.forces_a_critical
push str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.00401820
add esp, 0xc
push 1
push dword [eax + 4]
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402289
push 0x80000000
push 6
push 5
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x4027b4
push 0
lfence
push eax
jmp 0x4027e9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4023d5
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402289
mov byte [esp + 0x24], 1
call fcn.0051f3e0
nop
test al, al
jne 0x4023f9
mov ebx, 0xc0000001
push 0
push ebx
lfence
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x4027ee
mov esi, dword [0x636d98]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call dword [0x5a38f4]
call esi
mov ebx, eax
mov eax, 0
test ebx, ebx
cmovns eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov esi, eax
js 0x4024cf
call fcn.0051f3e0
test al, al
jne 0x40243b
mov ebx, 0xc0000001
jmp 0x4024cf
lea eax, [esp + 0x10]
push eax
push 0x5cb8a0
push esi
mov esi, dword [0x636da0]
mov ecx, esi
call dword [0x5a38f4]
call esi
mov ebx, eax
mov esi, 0
test ebx, ebx
cmovns esi, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
js 0x4024a1
call fcn.0051f3e0
test al, al
jne 0x40247a
mov ebx, 0xc0000001
jmp 0x40249d
push 1
lea eax, [esp + 0x28]
push eax
push 0x260000c3
push esi
mov esi, dword [0x636d9c]
mov ecx, esi
call dword [0x5a38f4]
call esi
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], 0
mov eax, dword [esp + 0x20]
mov esi, eax
je 0x4024cf
call fcn.0051f3e0
test al, al
je 0x4024cf
push dword [esp + 0x1c]
mov esi, dword [0x636cb8]
mov ecx, esi
call dword [0x5a38f4]
call esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4024ed
call fcn.0051f3e0
test al, al
je 0x4024ed
push esi
mov esi, dword [0x636d94]
mov ecx, esi
call dword [0x5a38f4]
call esi
test ebx, ebx
js 0x4023e9
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4027b4
push eax
push 0
push str.Unable_to_configure_the_advanced_boot_options.
jmp 0x4027ee
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
je 0x4026f7
push 1
push 0x16
push 0
call sym.SystemInformer.exe_PhAdjustPrivilege
lea esp, [esp]
test eax, eax
js 0x4026f7
xor eax, eax
mov dword [esp + 0x28], 0x40002
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], 0x5cd84c
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
cmp eax, 0xc0000100
je 0x40259b
push str.This_machine_does_not_have_UEFI_support.
jmp 0x4026fc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4025d5
push 0
push 0
push str.the_computer
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402289
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 8
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x28], 0
push eax
push 0x5d440c
push 0x631e04
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov edx, eax
cmp edx, 0xc0000100
je 0x4026e7
mov ecx, dword ds:[esp + 0x28]
and ecx, 1
or ecx, 0
je 0x4026e7
test edx, edx
js 0x4026ec
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push 0x5d440c
push 0x631dbc
call dword [sym.imp.ntdll.dll_NtQuerySystemEnvironmentValueEx]
mov edx, eax
test edx, edx
jns 0x40267f
cmp edx, 0xc0000100
jne 0x4026ec
or dword [esp + 0x10], 1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp edx, 0xc0000100
jne 0x40269f
mov eax, 1
mov dword [esp + 0x20], eax
jmp 0x4026a3
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push 0x5d440c
push 0x631dbc
call dword [sym.imp.ntdll.dll_NtSetSystemEnvironmentValueEx]
mov edx, eax
test edx, edx
js 0x4026ec
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4027b4
push eax
push 0
jmp 0x4027e9
mov edx, 0xc00000bb
push 0
lfence
push edx
jmp 0x4027e9
push str.Make_sure_System_Informer_is_running_with_administrative_privileges.
push str.Unable_to_restart_to_firmware_options.
push 0xfffe
push 1
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x14
jmp case.default.0x402289
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x402750
push 0
push 0
push str.the_computer
push str.update_and_restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402289
push 0x80000000
push 0x45
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x4027b4
push eax
push 0
jmp 0x4027e9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
mov dword [esp + 0x18], str.EnableWarnings
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4027a9
push 0
push 0
push str.the_computer_for_Windows_Defender_Offline_Scan
push str.restart
push edi
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je case.default.0x402289
call fcn.0052bd80
mov ecx, eax
test ecx, ecx
jne 0x4027cb
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret 0xc
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x80070000
jne 0x4027e2
movzx eax, cx
push eax
push 0
jmp 0x4027e9
push 0
push 0xc0000001
push str.Unable_to_restart_the_computer.
push edi
call sym.SystemInformer.exe_PhShowStatus
mov ecx, dword ds:[esp + 0x44]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret 0xc