Function at 0x140003400
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov r13d, r8d
mov rsi, rcx
sub edx, 1
je 0x14000392b
sub edx, 1
je 0x1400038d6
sub edx, 1
je 0x1400037b4
nop dword [rax]
cmp edx, 3
jne 0x140003c39
lea rax, str.EnableWarnings
mov qword [rsp + 0x30], 0x1c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x140003728
lea r14, str.update_and_shutdown
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1400034aa
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400034a6
mov ebx, ecx
shr rbx, 1
jmp 0x1400034e7
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x1400034d9
nop
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400034c0
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402ca978]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r15w
mov rcx, qword [rax + 8]
call fcn.14020a640
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402ca978]
mov r13, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [r13 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r14, rax
mov qword [rax], r13
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r13], r15w
test r12, r12
je 0x140003580
mov rdi, r13
mov ebx, r15d
shr rdi, 1
je 0x14000357d
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140003562
mov qword [r14], r13
mov rcx, r14
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402ca978]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], r15w
test r12, r12
je 0x1400035cc
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.14020a640
mov rcx, rbx
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x1400035ef
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023a418]
mov ecx, 3
call fcn.140001a20
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.14020a280
mov rcx, qword [0x1402ca988]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x14000365c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000365c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140003661
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14023a49c]
mov dword [rbp - 0x65], eax
lea rdx, [0x14023a4a0]
mov rax, qword [0x1402ca990]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001a20
xor r9d, r9d
lea rdx, [rbp + 0x6f]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x14023a3a8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x1400036fb
cmp dword [rbp + 0x6f], 6
jmp 0x140003716
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_PhShowMessage
cmp eax, 6
sete al
test al, al
je 0x140003c39
lfence
lfence
mov r9d, 0x49
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x140003c28
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
test rax, rax
je 0x140003c2c
mov rcx, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003c39
call fcn.140141ca0
jmp 0x140003c39
lea r14, str.shut_down
mov r8, r14
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001a60
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x140003c39
mov edx, 6
mov r8d, 0x80000000
mov ecx, edx
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
mov ebx, eax
test eax, eax
jns 0x140003c28
cmp eax, 0xc0000022
je 0x14000384b
cmp eax, 0xc0000005
je 0x14000384b
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x140003834
movzx eax, bx
jmp 0x140003856
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000385a
mov eax, ebx
jmp 0x140003856
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x140003867
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x140003871
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
mov rcx, rsi
test rax, rax
je 0x140003c2f
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003c39
lfence
call fcn.140141ca0
jmp 0x140003c39
lea r14, str.shut_down
mov r8, r14
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001a60
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhShowConfirmMessage
test al, al
je 0x140003c39
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
jmp 0x140003807
lea rax, str.EnableWarnings
mov qword [rsp + 0x30], 0x1c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x140003c12
lea r14, str.shut_down
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000398d
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003989
mov ebx, ecx
shr rbx, 1
jmp 0x1400039c9
add rbx, 0x10
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x1400039bb
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400039a2
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402ca978]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
mov rcx, qword [rax + 8]
call fcn.14020a640
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402ca978]
mov rbx, qword [rax]
mov r12, qword [rax + 8]
mov qword [rbp + 0x7f], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
test r12, r12
je 0x140003a72
mov rdi, rbx
mov ebx, r15d
shr rdi, 1
je 0x140003a6b
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140003a50
mov rax, qword [rbp + 0x7f]
mov qword [r14], rax
mov rcx, r14
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rdx, qword [0x1402ca978]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rdi + rcx], r15w
test r12, r12
je 0x140003abb
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.14020a640
mov rcx, rbx
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x140003ae0
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023a418]
mov ecx, 3
call fcn.140001a20
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.14020a280
mov rcx, qword [0x1402ca988]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x140003b4f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140003b4f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140003b54
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x14023a49c]
mov dword [rbp - 0x65], eax
lea rdx, [0x14023a4a0]
mov rax, qword [0x1402ca990]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001a20
xor r9d, r9d
lea rdx, [rbp + 0x6f]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x14023a3a8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x140003bf0
cmp dword [rbp + 0x6f], 6
jmp 0x140003c0b
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_PhShowMessage
cmp eax, 6
sete al
test al, al
je 0x140003c39
or r13d, 2
mov ecx, r13d
call fcn.140153640
nop
test eax, eax
jne 0x140003751
mov al, 1
jmp 0x140003c3b
mov rcx, rsi
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
xor al, al
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret