Function at 0x140003440
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov r13d, r8d
mov rsi, rcx
sub edx, 1
je 0x14000396b
sub edx, 1
je 0x140003916
sub edx, 1
je 0x1400037f6
nop dword [rax]
cmp edx, 3
jne 0x140003c79
lea rax, str.EnableWarnings
mov qword [rsp + 0x48], 0x1c
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
je 0x140003770
lea r14, str.update_and_shutdown
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1400034ea
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400034e6
mov ebx, ecx
shr rbx, 1
jmp 0x140003527
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x140003519
nop
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140003500
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402c4fb8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r15w
mov rcx, qword [rax + 8]
call fcn.1402074d0
mov rcx, rdi
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, qword [0x1402c4fb8]
mov r13, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [r13 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r14, rax
mov qword [rax], r13
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r13], r15w
test r12, r12
je 0x1400035c0
mov rdi, r13
mov ebx, r15d
shr rdi, 1
je 0x1400035bd
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x1400035a2
mov qword [r14], r13
mov rcx, r14
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, qword [0x1402c4fb8]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], r15w
test r12, r12
je 0x14000360c
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.1402074d0
mov rcx, rbx
call sym.SystemInformer.exe_QiAutoDereferenceObject
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x14000362f
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023a5ac]
mov ecx, 3
call fcn.140001a40
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.140207110
mov rcx, qword [0x1402c4fc8]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x14000369c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000369c
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x1400036a1
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x140272da0]
mov dword [rbp - 0x65], eax
lea rdx, str.Do_you_want_to
mov rax, qword [0x1402c4fd0]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001a40
xor r9d, r9d
lea rdx, [rbp + 0x7f]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x14026a3a8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x14000373b
cmp dword [rbp + 0x7f], 6
jmp 0x140003756
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_QiShowMessage
cmp eax, 6
sete al
test al, al
je 0x140003c79
nop dword [rax + rax]
mov r9d, 0x49
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x140003c68
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r8, [0x140236d98]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
test rax, rax
je 0x140003c6c
mov rcx, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003c79
call fcn.14013fb00
jmp 0x140003c79
lea r14, str.shut_down
mov r8, r14
lea rdx, str.forces_a_critical
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001a80
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiShowConfirmMessage
test al, al
je 0x140003c79
mov edx, 6
mov r8d, 0x80000000
mov ecx, edx
call qword [sym.imp.ntdll.dll_NtSetSystemPowerState]
mov ebx, eax
test eax, eax
jns 0x140003c68
cmp eax, 0xc0000022
je 0x14000388c
nop word [rax + rax]
cmp eax, 0xc0000005
je 0x14000388c
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14000387c
movzx eax, bx
jmp 0x140003897
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000389b
mov eax, ebx
jmp 0x140003897
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x1400038a7
lfence
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x1400038b1
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r8, [0x140236d98]
mov rbx, rax
lea r9, str.Unable_to_shut_down_the_computer.
mov rcx, rsi
test rax, rax
je 0x140003c6f
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003c79
lfence
call fcn.14013fb00
jmp 0x140003c79
lea r14, str.shut_down
mov r8, r14
lea rdx, str.preforms_a_hard
lea rcx, str.This_option__s__s_in_an_disorderly_manner_and_may_cause_corrupted_files_or_instability_in_the_system.
call fcn.140001a80
lea r8, str.the_computer
mov byte [rsp + 0x20], 1
mov rdx, r14
mov rcx, rsi
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiShowConfirmMessage
test al, al
je 0x140003c79
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
jmp 0x140003849
lea rax, str.EnableWarnings
mov qword [rsp + 0x48], 0x1c
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
je 0x140003c52
lea r14, str.shut_down
xorps xmm1, xmm1
mov rbx, r14
mov rcx, r14
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1400039cd
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400039c9
mov ebx, ecx
shr rbx, 1
jmp 0x140003a09
add rbx, 0x10
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x1400039fb
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x1400039e2
sub rbx, r14
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402c4fb8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor r15d, r15d
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
mov rcx, qword [rax + 8]
call fcn.1402074d0
mov rcx, rdi
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, qword [0x1402c4fb8]
mov rbx, qword [rax]
mov r12, qword [rax + 8]
mov qword [rbp + 0x7f], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], r15w
test r12, r12
je 0x140003ab2
mov rdi, rbx
mov ebx, r15d
shr rdi, 1
je 0x140003aab
movzx ecx, word [r12 + rbx*2]
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeChar]
mov rcx, qword [r14 + 8]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, rdi
jb 0x140003a90
mov rax, qword [rbp + 0x7f]
mov qword [r14], rax
mov rcx, r14
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, qword [0x1402c4fb8]
mov r14, rax
mov rdi, qword [rax]
mov r12, qword [rax + 8]
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rdi + rcx], r15w
test r12, r12
je 0x140003afb
mov rcx, qword [rax + 8]
mov r8, rdi
mov rdx, r12
call fcn.1402074d0
mov rcx, rbx
call sym.SystemInformer.exe_QiAutoDereferenceObject
lea rbx, [rax + 8]
cmp qword [rax], r15
jbe 0x140003b20
mov rax, qword [rbx]
movzx ecx, word [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
mov rcx, qword [rbx]
mov word [rcx], ax
mov rdx, qword [r14 + 8]
lea r9, str.the_computer
lea r8, [0x14023a5ac]
mov ecx, 3
call fcn.140001a40
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0xa0
mov rdi, rax
call fcn.140207110
mov rcx, qword [0x1402c4fc8]
mov qword [rbp - 0x6d], rcx
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x75], rsi
test rsi, rsi
je 0x140003b8f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140003b8f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
mov eax, 0x1008
je 0x140003b94
mov eax, 8
mov r8, qword [rdi + 8]
lea r9, [0x140272da0]
mov dword [rbp - 0x65], eax
lea rdx, str.Do_you_want_to
mov rax, qword [0x1402c4fd0]
mov ecx, 3
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x55], 0xfffd
call fcn.140001a40
xor r9d, r9d
lea rdx, [rbp + 0x7f]
xor r8d, r8d
mov rcx, qword [rax + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x34], rax
lea rax, [0x14026a3a8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x4d], rcx
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x39], rax
mov dword [rsp + 0x30], 6
mov dword [rsp + 0x3c], 7
mov dword [rbp - 0x3d], 2
mov dword [rbp - 0x31], 6
mov dword [rbp + 0x23], 0xc8
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x140003c30
cmp dword [rbp + 0x7f], 6
jmp 0x140003c4b
mov r9, qword [rdi + 8]
lea r8, str.Are_you_sure_you_want_to__s_
mov edx, 0x134
mov rcx, rsi
call sym.SystemInformer.exe_QiShowMessage
cmp eax, 6
sete al
test al, al
je 0x140003c79
or r13d, 2
mov ecx, r13d
call fcn.140151100
nop
test eax, eax
jne 0x140003793
mov al, 1
jmp 0x140003c7b
mov rcx, rsi
mov edx, 0x10
call sym.SystemInformer.exe_QiShowMessage
xor al, al
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret