Function at 0x4026b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ffc0
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x43f6fc]
xor eax, ebp
mov dword [ebp - 0x78], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18c], ecx
movzx eax, word [ebp + 0xc]
cmp eax, 0xea
je 0x4026f8
movzx ecx, word [ebp + 0xc]
cmp ecx, 0xe9
jne 0x402751
cmp dword [0x4491e8], 8
jne 0x40272d
lea ecx, [ebp - 0x24]
call fcn.004069d0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x24]
call fcn.00406d50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00406bc0
jmp 0x402736
call dword [sym.imp.Skutil.dll_Mixer_GetMuteState]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402751
push 8
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.Skutil.dll_SendAppCommand]
add esp, 8
movzx edx, word [ebp + 0xc]
mov dword [ebp - 0x190], edx
mov eax, dword [ebp - 0x190]
sub eax, 0x11
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xd9
ja case.0x402787.1
mov ecx, dword [ebp - 0x190]
movzx edx, byte [ecx + 0x402adc]
jmp dword [edx*4 + 0x402ab4]
mov ecx, dword [ebp - 0x18c]
call fcn.00403080
cmp dword [ebp + 0x10], 1
jne 0x4027a1
jmp 0x4027ab
push 0
call fcn.00401430
add esp, 4
jmp case.0x402787.1
mov eax, dword [ebp - 0x18c]
cmp dword [eax + 0x274], 0
jne 0x4027c4
call fcn.00401330
cmp dword [ebp + 0x10], 1
jne 0x4027e0
mov dword [0x4491f0], 2
push 1
call fcn.00401430
add esp, 4
jmp 0x4027ea
push 0
call fcn.00401430
add esp, 4
jmp case.0x402787.1
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx + 0x274], 0
jne 0x402803
call fcn.00401330
cmp dword [ebp + 0x10], 1
jne 0x40281f
mov dword [0x4491f0], 3
push 1
call fcn.00401430
add esp, 4
jmp 0x402829
push 0
call fcn.00401430
add esp, 4
jmp case.0x402787.1
cmp dword [ebp + 0x10], 1
jne 0x40290c
mov edx, dword [ebp - 0x18c]
cmp dword [edx + 0x274], 0
je 0x40287a
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x50c]
mov dword [ebp - 0x180], ecx
cmp dword [ebp - 0x180], 0
je 0x40287a
push 0x10
mov ecx, dword [ebp - 0x18c]
add ecx, 0x504
call fcn.00406790
jmp 0x40290c
cmp dword [0x4491e8], 6
jne 0x402888
jmp case.0x402787.1
lea ecx, [ebp - 0x38]
call fcn.004069d0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00406ed0
mov dword [ebp - 0x3c], 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x38]
call fcn.00406e10
test eax, eax
jne 0x4028ca
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00406bc0
jmp case.0x402787.1
cmp dword [0x43e8b8], 0
je 0x4028fd
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x44]
cdq
sub eax, edx
sar eax, 1
push eax
call dword [sym.imp.skosd.dll_OSD_ShowMic]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00406bc0
jmp case.0x402787.1
cmp dword [ebp + 0x10], 1
jne 0x40291d
call dword [sym.imp.Skutil.dll_LockComputer]
jmp case.0x402787.1
cmp dword [ebp + 0x10], 1
jne 0x402966
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0040c9d4
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x54], 0x5b
mov dword [ebp - 0x50], 0x46
lea edx, [ebp - 0x54]
push edx
push 2
call fcn.004014a0
add esp, 8
jmp case.0x402787.1
cmp dword [ebp + 0x10], 1
jne 0x4029af
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0040c9d4
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 0x5c], 0x5b
mov dword [ebp - 0x58], 0x45
lea edx, [ebp - 0x5c]
push edx
push 2
call fcn.004014a0
add esp, 8
jmp case.0x402787.1
cmp dword [ebp + 0x10], 1
jne 0x402a15
push 0
push str.WMPlayerApp
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x4029f9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [ebp - 0x60], eax
je 0x4029f7
mov dword [ebp - 0x68], 0x11
mov dword [ebp - 0x64], 0x50
lea eax, [ebp - 0x68]
push eax
push 2
call fcn.004014a0
add esp, 8
jmp 0x402a15
mov dword [ebp - 0x70], 0x11
mov dword [ebp - 0x6c], 0x50
lea ecx, [ebp - 0x70]
push ecx
push 2
call fcn.004014a0
add esp, 8
jmp case.0x402787.1
cmp dword [ebp + 0x10], 1
jne case.0x402787.1
mov byte [ebp - 0x17c], 0
push 0xff
push 0
lea edx, [ebp - 0x17b]
push edx
call fcn.0041d0e0
add esp, 0xc
mov dword [ebp - 0x74], 0x100
mov eax, dword [ebp - 0x74]
push eax
lea ecx, [ebp - 0x17c]
push ecx
push str.BlueBtn
mov edx, dword [str.SoftwareLTON_HISLenovo_Slim_USB_Keyboard]
push edx
push reloc.SKHidKbd.dll_Ordinal_2
call dword [sym.imp.Skutil.dll_Reg_GetValueString]
add esp, 0x14
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402a91
push 5
push 0
push 0
push str.calc.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x402787.1
call fcn.00401670
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x78]
xor ecx, ebp
call fcn.0041cf4c
mov esp, ebp
pop ebp
ret 0xc