Function at 0x402dc0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x44
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
mov esi, edx
mov dword [esp + 0x1c], str.EnableWarnings
mov ebp, ecx
mov edi, 0xc0000001
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x402e15
push 0
push 0
push str.the_computer
push str.restart
push ebp
call sym.SystemInformer.exe_Ordinal_1695
test al, al
je 0x40308d
call fcn.0051fae0
mov dword ds:[esp + 0x14], eax
test eax, eax
je 0x402fdf
cmp esi, dword [eax]
jae 0x402f3e
lfence
mov eax, dword [eax + 8]
xor ebx, ebx
mov eax, dword [eax + esi*4]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x28], xmm0
call fcn.0051f020
test al, al
je 0x402f3a
mov esi, dword [0x63596c]
lea eax, ds:[esp + 0x20]
push eax
mov ecx, esi
call dword [0x5a9914]
call esi
mov edi, eax
mov eax, ebx
test edi, edi
cmovns eax, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
js 0x402f3a
nop dword [eax]
call fcn.0051f020
test al, al
jne 0x402e93
mov edi, 0xc0000001
jmp 0x402f15
mov esi, dword [0x635974]
lea eax, [esp + 0x24]
push eax
push 0x5d0cf4
push dword [esp + 0x24]
mov ecx, esi
call dword [0x5a9914]
call esi
mov edi, eax
test edi, edi
cmovns ebx, dword [esp + 0x24]
js 0x402ef5
movups xmm0, xmmword [esp + 0x28]
movups xmmword [esp + 0x3c], xmm0
call fcn.0051f020
test al, al
jne 0x402ed6
mov edi, 0xc0000001
jmp 0x402ef5
mov esi, dword [0x635970]
lea eax, [esp + 0x3c]
push 0x10
push eax
push 0x24000002
push ebx
mov ecx, esi
call dword [0x5a9914]
call esi
mov edi, eax
test ebx, ebx
je 0x402f15
call fcn.0051f020
nop
test al, al
je 0x402f15
mov esi, dword [0x63584c]
mov ecx, esi
push ebx
call dword [0x5a9914]
call esi
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x402f3a
nop dword [eax]
call fcn.0051f020
test al, al
je 0x402f3a
mov esi, dword [0x635968]
mov ecx, esi
push ebx
call dword [0x5a9914]
call esi
mov eax, dword [esp + 0x14]
mov ecx, eax
mov esi, edi
call fcn.0051fba0
test edi, edi
js 0x402fbf
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
nop
test eax, eax
je 0x40308d
push eax
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x403078
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebp
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40308d
call fcn.004fe1e0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x44
ret
mov edi, esi
cmp esi, 0xc0000022
je 0x402fd1
cmp edi, 0xc0000005
jne 0x402fdf
mov edi, esi
push edi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x403009
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x402ff2
movzx eax, di
jmp 0x403009
mov eax, edi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x403018
mov eax, edi
test eax, eax
je 0x403018
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
jmp 0x403025
push edi
lfence
call sym.SystemInformer.exe_Ordinal_1660
mov esi, eax
test esi, esi
je 0x403078
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebp
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40308d
lfence
call fcn.004fe1e0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00583f9f
add esp, 0x44
ret
push str.Unable_to_configure_the_boot_application.
push 0x5d369c
push 0x10
push ebp
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x44
ret