Function at 0x402c40
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
mov esi, edx
mov dword [ebp - 0x18], str.EnableWarnings
mov ebx, ecx
mov edi, 0xc0000001
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x402c93
push 0
push 0
push str.the_computer
push str.restart
push ebx
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x402f1e
call fcn.0051f180
mov dword ds:[ebp - 0x20], eax
test eax, eax
je 0x402e7d
cmp esi, dword [eax]
jae 0x402dcb
lfence
mov eax, dword [eax + 8]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
call fcn.0051e4e0
test al, al
je 0x402e50
mov esi, dword [0x635500]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call dword [0x5a38e4]
call esi
mov edi, eax
test edi, edi
js 0x402e50
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
call fcn.0051e4e0
test al, al
jne 0x402d14
mov edi, 0xc0000001
jmp 0x402da2
mov esi, dword [0x635508]
lea eax, [ebp - 0x28]
push eax
push 0x5caa1c
push edi
mov ecx, esi
call dword [0x5a38e4]
call esi
mov edi, eax
test edi, edi
js 0x402da2
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 8], eax
call fcn.0051e4e0
test al, al
jne 0x402d62
mov edi, 0xc0000001
jmp 0x402d83
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x24000002
push esi
mov esi, dword [0x635504]
mov ecx, esi
call dword [0x5a38e4]
call esi
mov esi, dword [ebp - 0x3c]
mov edi, eax
test esi, esi
je 0x402da2
call fcn.0051e4e0
test al, al
je 0x402da2
push esi
mov esi, dword [0x6354f0]
mov ecx, esi
call dword [0x5a38e4]
nop
call esi
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x402dc8
call fcn.0051e4e0
test al, al
je 0x402dc8
push esi
mov esi, dword [0x6354fc]
mov ecx, esi
call dword [0x5a38e4]
call esi
mov eax, dword [ebp - 0x20]
mov ecx, eax
call fcn.0051f240
test edi, edi
js 0x402e58
push 0x80000000
push 5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x402f1e
push eax
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x402f09
push dword ds:[esi + 4]
push 0x5cd020
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebx
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402f1e
call fcn.004fbfa0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x20]
call fcn.0051f240
mov eax, edi
cmp edi, 0xc0000022
je 0x402e6f
cmp eax, 0xc0000005
jne 0x402e7d
mov edi, eax
push edi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
jmp 0x402ea0
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x402e90
movzx eax, di
jmp 0x402ea0
mov eax, edi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x402eaf
mov eax, edi
test eax, eax
je 0x402eaf
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x402eb8
push edi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
mov esi, eax
test esi, esi
je 0x402f09
lfence
lfence
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_configure_the_boot_application.
push 0xfffe
push 0x20
push ebx
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x402f1e
lfence
call fcn.004fbfa0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push str.Unable_to_configure_the_boot_application.
push 0x5cd020
push 0x10
push ebx
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret