Function at 0x1400031a0
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov r13d, r8d
mov rsi, rcx
sub edx, 1
je 0x1400036cb
sub edx, 1
je 0x140003676
sub edx, 1
je 0x140003556
nop dword [rax]
cmp edx, 3
jne 0x1400039d9
lea rax, str.EnableWarnings
mov qword [rsp + 0x48], 0x1c
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x1400034d0
lea r14, str.update_and_shutdown
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000324a
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003246
mov ebx, ecx
shr rbx, 1
jmp 0x140003287
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x140003279
nop
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003260
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402bfcf8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r15w
mov rcx, qword [rax + 8]
call fcn.1401e3aa0
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402bfcf8]
mov r13, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [r13 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r14, rax
mov qword [rax], r13
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r13], r15w
test r12, r12
je 0x140003320
mov rdi, r13
mov ebx, r15d
shr rdi, 1
je 0x14000331d
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140003302
mov qword [r14], r13
mov rcx, r14
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402bfcf8]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], r15w
test r12, r12
je 0x14000336c
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.1401e3aa0
mov rcx, rbx
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x14000338f
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023646c]
mov ecx, 3
call fcn.140001780
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.1401dff50
mov rcx, qword [0x1402bfd08]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x1400033fc
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400033fc
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140003401
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14026e7d0]
mov dword [rbp - 0x65], eax
lea rdx, str.Do_you_want_to
mov rax, qword [0x1402bfd10]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001780
xor r9d, r9d
lea rdx, [rbp + 0x7f]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x1402661e8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x14000349b
cmp dword [rbp + 0x7f], 6
jmp 0x1400034b6
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_PhShowMessage
cmp eax, 6
sete al
test al, al
je 0x1400039d9
nop dword [rax + rax]
mov r9d, 0x49
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x1400039c8
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x140232c58]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
test rax, rax
je 0x1400039cc
mov rcx, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400039d9
call fcn.14013d2a0
jmp 0x1400039d9
lea r14, str.shut_down
mov r8, r14
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.1400017c0
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x1400039d9
mov edx, 6
mov r8d, 0x80000000
mov ecx, edx
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
mov ebx, eax
test eax, eax
jns 0x1400039c8
cmp eax, 0xc0000022
je 0x1400035ec
nop word [rax + rax]
cmp eax, 0xc0000005
je 0x1400035ec
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x1400035dc
movzx eax, bx
jmp 0x1400035f7
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x1400035fb
mov eax, ebx
jmp 0x1400035f7
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x140003607
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x140003611
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x140232c58]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
mov rcx, rsi
test rax, rax
je 0x1400039cf
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400039d9
lfence
call fcn.14013d2a0
jmp 0x1400039d9
lea r14, str.shut_down
mov r8, r14
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.1400017c0
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x1400039d9
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
jmp 0x1400035a9
lea rax, str.EnableWarnings
mov qword [rsp + 0x48], 0x1c
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x1400039b2
lea r14, str.shut_down
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000372d
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003729
mov ebx, ecx
shr rbx, 1
jmp 0x140003769
add rbx, 0x10
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x14000375b
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003742
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402bfcf8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
mov rcx, qword [rax + 8]
call fcn.1401e3aa0
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402bfcf8]
mov rbx, qword [rax]
mov r12, qword [rax + 8]
mov qword [rbp + 0x7f], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
test r12, r12
je 0x140003812
mov rdi, rbx
mov ebx, r15d
shr rdi, 1
je 0x14000380b
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x1400037f0
mov rax, qword [rbp + 0x7f]
mov qword [r14], rax
mov rcx, r14
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402bfcf8]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rdi + rcx], r15w
test r12, r12
je 0x14000385b
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.1401e3aa0
mov rcx, rbx
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x140003880
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023646c]
mov ecx, 3
call fcn.140001780
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.1401dff50
mov rcx, qword [0x1402bfd08]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x1400038ef
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400038ef
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x1400038f4
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14026e7d0]
mov dword [rbp - 0x65], eax
lea rdx, str.Do_you_want_to
mov rax, qword [0x1402bfd10]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001780
xor r9d, r9d
lea rdx, [rbp + 0x7f]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x1402661e8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x140003990
cmp dword [rbp + 0x7f], 6
jmp 0x1400039ab
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_PhShowMessage
cmp eax, 6
sete al
test al, al
je 0x1400039d9
or r13d, 2
mov ecx, r13d
call fcn.14014e5c0
nop
test eax, eax
jne 0x1400034f3
mov al, 1
jmp 0x1400039db
mov rcx, rsi
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret