Function at 0xa62ce0
Capabilities:
Create process on windows
Hide graphical window
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafd158
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], 0
cmp esi, 0x5cc
ja case.0xa6322b.1363
cmp esi, 0x21
jb 0xa62d42
cmp esi, 0x48
jb case.0xa6322b.1363
cmp esi, 0x113
je 0xa6360d
cmp esi, 0x4b
jb 0xa62d5c
cmp esi, 0x7e
jb case.0xa6322b.1363
cmp esi, 0x111
ja 0xa63010
je 0xa62fc9
lea eax, [esi - 1]
cmp eax, 0xfe
ja case.0xa6322b.1363
movzx eax, byte [eax + 0xa638a8]
jmp dword [eax*4 + 0xa63878]
test edx, edx
je case.0xa63136.1259
cmp dword [edx], 0
je 0xa62dd0
mov ecx, dword [edi + 0x220]
mov eax, dword [ecx]
mov esi, dword [eax + 0x88]
lea eax, [ebp - 0x34]
push eax
push edx
push ebx
push ecx
cmp esi, fcn.00a62300
jne 0xa62db7
call fcn.00a62300
jmp 0xa62dc1
mov ecx, esi
call dword [0xc99200]
call esi
test al, al
jne 0xa634e5
xor eax, eax
jmp 0xa634e8
push edx
mov ecx, edi
call fcn.00b79d95
jmp 0xa634e8
mov ecx, edi
call fcn.00a89dc4
jmp 0xa634e8
mov ecx, edi
call fcn.00b77d3b
jmp 0xa634e8
test bl, 1
je 0xa62e2a
cmp byte [edi + 0x219], 0
jne 0xa62e0c
lea eax, [edi + 0x1c]
push eax
call fcn.00a81950
push 1
mov ecx, edi
call fcn.00b77795
test eax, eax
je case.0xa63136.1259
mov ecx, edi
call fcn.00b74bd3
mov eax, 1
jmp 0xa634e8
test dl, 1
je 0xa62e49
call fcn.00a9f124
test al, al
je 0xa62e49
push 0x43
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
jne 0xa62e49
call fcn.00bb20ce
mov ecx, edi
call fcn.00b74bd3
jmp 0xa63862
test byte [0xc96fc0], 1
je 0xa62e6d
push edx
push ebx
mov edx, 0xa145d0
call fcn.00b7b750
mov edx, dword [ebp - 0x2c]
test ebx, ebx
je 0xa62f39
test edx, edx
jns 0xa62e90
push edi
push 0xa449a0
push 0
push 0
mov dword [edi + 0x68], 1
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_EnumDisplayMonitors]
lea eax, [edi + 0x1c]
push eax
call fcn.00a81950
push 0
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
push 0
push dword [0xc9585c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_ShowWindow]
cmp dword [edi + 0x124], 0
jne 0xa634e5
push 0x2000
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
test eax, eax
je 0xa62f2b
mov ebx, dword [edi + 0x168]
test ebx, ebx
je 0xa62f2b
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
call fcn.00a398c6
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
push 0xa15e5c
push 0xa142ec
push ebx
call dword [0xc99200]
call esi
test eax, eax
js 0xa62f23
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [ebp - 0x24]
call fcn.00a398c6
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_DestroyWindow]
jmp 0xa634e5
cmp byte [edi + 0x219], 0
mov byte [edi + 0x218], 0
jne 0xa634e5
push 0x9f96f0
push dword [edi + 0x21c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RemovePropW]
jmp 0xa634e5
cmp dword [edi + 0xb8], 0
je 0xa63868
push 0x7f8a
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0xa634e8
push 0x9f96f0
push dword [edi + 0x21c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RemovePropW]
mov dword [edi + 0x21c], 0
jmp 0xa634e5
cmp dword [edi + 0xac], 0
je 0xa634e5
push edx
push ebx
push esi
call dword [sym.imp.SndVolSSO.DLL_Ordinal_3]
jmp 0xa634e5
mov ecx, dword [edi + 0x220]
mov eax, dword [ecx]
mov esi, dword [eax + 0x94]
lea eax, [ebp - 0x34]
push eax
push edx
push ebx
push 0x111
push dword [ebp - 0x24]
push ecx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xa634e5
push 1
push eax
push dword [ebp - 0x2c]
movzx eax, bx
push eax
lea eax, [edi + 0x1c]
push eax
call fcn.00a83d80
jmp 0xa634e5
cmp esi, 0x550
ja 0xa63215
je 0xa63201
cmp esi, 0x40d
ja 0xa63127
je case.0xa6322b.1363
cmp esi, 0x2b1
ja 0xa630e4
je 0xa630d3
cmp esi, 0x112
je 0xa630b0
cmp esi, 0x218
jne case.0xa6322b.1363
mov eax, dword [edi + 0x220]
push edx
push ebx
push esi
mov eax, dword [eax]
push ecx
mov eax, dword [eax + 0x8c]
cmp eax, fcn.00ab2dc0
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0x220]
push eax
jne 0xa63093
call fcn.00ab2dc0
push dword [ebp - 0x2c]
mov ecx, edi
push ebx
push esi
call fcn.00ab237a
jmp 0xa63862
mov ecx, dword [ebp - 0x30]
call dword [0xc99200]
call dword [ebp - 0x30]
push dword [ebp - 0x2c]
mov ecx, edi
push ebx
push esi
call fcn.00ab237a
jmp 0xa63862
mov eax, ebx
and eax, 0xfff0
cmp eax, 0xf060
jne 0xa63868
push 0
sub esp, 8
mov ecx, edi
call fcn.00b77814
jmp 0xa634e5
push edx
push ebx
mov ecx, edi
call fcn.00b79f13
mov dword [ebp - 0x34], eax
jmp 0xa634e5
cmp esi, 0x312
jne case.0xa6322b.1363
push ecx
push ebx
mov ecx, edi
call fcn.00a3acfb
test al, al
jne 0xa634e5
mov ecx, edi
cmp ebx, 0x1f4
jae 0xa63119
movzx eax, bx
push eax
call fcn.00b780a7
jmp 0xa634e5
push dword [ebp - 0x2c]
push ebx
call fcn.00a38a5a
jmp 0xa634e5
lea eax, [esi - 0x4e5]
cmp eax, 0xf
ja case.0xa6322b.1363
jmp dword [eax*4 + 0xa639a8]
push edx
push ebx
push ecx
mov ecx, edi
call fcn.00b7b16c
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
mov eax, esi
jmp 0xa634e8
push ebx
push ecx
mov ecx, edi
call fcn.00b7a593
jmp 0xa634e8
push ebx
push ecx
call dword [sym.imp.USER32.dll_UnregisterHotKey]
mov eax, 1
jmp 0xa634e8
push edx
push ebx
push ecx
mov ecx, edi
call fcn.00b7ae3b
jmp 0xa634e8
push ebx
push ecx
mov ecx, edi
call fcn.00b7aeb7
jmp 0xa634e8
xor eax, eax
test ebx, ebx
sete al
mov dword [edi + 0x6c], eax
mov eax, 1
jmp 0xa634e8
mov ecx, edi
call fcn.00a486e3
jmp 0xa634e8
push edx
push 2
mov ecx, edi
call fcn.00b7abd1
jmp 0xa634e8
push edx
push ebx
mov ecx, edi
call fcn.00b77cc8
jmp 0xa634e8
push edx
mov ecx, edi
call fcn.00a3a983
jmp 0xa634e8
push ebx
push edx
mov ecx, edi
call fcn.00a490ad
jmp 0xa634e8
mov ecx, edi
call fcn.00b75963
jmp 0xa634e5
push 0
push ebx
push 1
push edx
lea eax, [edi + 0x1c]
push eax
call fcn.00a4a910
jmp 0xa634e5
lea eax, [esi - 0x551]
cmp eax, 0x7b
ja case.0xa6322b.1363
movzx eax, byte [eax + 0xa63a50]
jmp dword [eax*4 + 0xa639e8]
cmp dword [edi + 0x124], 0
jne 0xa634e5
push ecx
push ebx
push esi
push ecx
mov ecx, edi
call fcn.00a4b397
jmp 0xa634e5
mov eax, dword [0xc96fc8]
mov dword [ebp - 0x34], eax
jmp 0xa634e5
push edx
mov ecx, edi
call fcn.00b79ea5
jmp 0xa634e5
push 0x38
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0x3c
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x6c], 0x200
lea eax, [ebp - 0x70]
mov dword [ebp - 0x60], 0x9fcd98
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x5c], 0x9fcd8c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0xa634e5
cmp byte [edi + 0x11e], 0
jne 0xa634e5
push ebx
mov ecx, edi
call fcn.00a39580
jmp 0xa634e5
push 0x13
push 0
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
jmp 0xa634e5
push edx
push ebx
mov ecx, edi
call fcn.00a4cedc
jmp 0xa634e5
push edx
mov ecx, edi
call fcn.00b792d1
jmp 0xa634e5
mov ecx, edi
call fcn.00a8aa53
jmp 0xa634e5
push edx
push ebx
mov ecx, edi
call fcn.00a3b098
jmp 0xa634e5
push 4
mov ecx, edi
call fcn.00a9ee0e
mov eax, dword [edi + 0x1a4]
test eax, eax
je 0xa634e5
push eax
push 0
mov ecx, edi
call fcn.00a4cedc
jmp 0xa634e5
mov ecx, dword [edi + 0x220]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x90]
cmp esi, fcn.00a4ade0
jne 0xa6335c
call fcn.00a4ade0
mov eax, dword [edi + 0x1a8]
jmp 0xa63321
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [edi + 0x1a8]
jmp 0xa63321
push 2
mov ecx, edi
call fcn.00a9ee0e
jmp 0xa634e5
push ebx
mov ecx, edi
call fcn.00b7760b
jmp 0xa634e5
lea eax, [edi + 0x1c]
push eax
call fcn.00a81950
push 2
mov ecx, edi
call fcn.00b77795
jmp 0xa634e5
xor cl, cl
call fcn.00bba717
push 0
push 0x9f0a04
mov edx, 3
mov ecx, 0x9fdf80
call fcn.00a38092
jmp 0xa634e5
cmp dword [edi + 0x114], ebx
je 0xa634e5
mov dword [edi + 0x114], ebx
mov dword [edi + 0x68], 0
test ebx, ebx
jne 0xa63412
push edi
push 0xa449a0
push ebx
push ebx
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_EnumDisplayMonitors]
push ebx
lea ecx, [edi + 0x1e0]
call fcn.00a4a648
test eax, eax
jns 0xa6341d
mov ecx, dword [ebp + 4]
mov edx, 0x112a
push eax
push 0x9f9bd4
call fcn.00ab606d
jmp 0xa6341d
lea ecx, [edi + 0x1e0]
call fcn.00a467e3
xor ecx, ecx
test ebx, ebx
sete cl
call fcn.00b62269
test eax, eax
jns 0xa634e5
mov ecx, dword [ebp + 4]
mov edx, 0x1131
push eax
push 0x9f9bd4
call fcn.00ab606d
jmp 0xa634e5
mov eax, dword [edi + 0x220]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x98]
mov ecx, esi
call dword [0xc99200]
call esi
push 0x2bf20
push 0
push 0x2bf20
push 0x18
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetCoalescableTimer]
jmp 0xa634e5
push ecx
push ebx
mov ecx, edi
call fcn.00a3aa87
jmp 0xa634e5
movsx eax, bx
mov dword [ebp - 0x20], eax
shr ebx, 0x10
movsx eax, bx
mov dword [ebp - 0x1c], eax
movsx eax, dx
mov dword [ebp - 0x18], eax
shr edx, 0x10
movsx eax, dx
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x220]
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x9c]
mov ecx, esi
call dword [0xc99200]
call esi
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00b7b02a
mov eax, dword [edi + 0x220]
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x9c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [edi + 0x220]
test ebx, ebx
push ecx
setne al
mov byte [edi + 0x11d], al
mov eax, dword [ecx]
mov esi, dword [eax + 0xa0]
cmp esi, fcn.00ab2310
jne 0xa6352f
call fcn.00ab2310
jmp 0xa634e5
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xa634e5
mov ecx, dword [edi + 0x220]
test ebx, ebx
push ecx
setne al
mov byte [edi + 0x11c], al
mov eax, dword [ecx]
mov esi, dword [eax + 0xa4]
cmp esi, fcn.00a47fc0
jne 0xa63564
call fcn.00a47fc0
jmp 0xa6356e
mov ecx, esi
call dword [0xc99200]
call esi
cmp byte [edi + 0x11c], 0
je 0xa634e5
push 1
lea ecx, [edi + 0x1e0]
call fcn.00a4a648
test eax, eax
jns 0xa634e5
mov ecx, dword [ebp + 4]
mov edx, 0x116c
push eax
push 0x9f9bd4
call fcn.00ab606d
jmp 0xa634e5
test ebx, ebx
setne al
mov byte [edi + 0x11e], al
test ebx, ebx
je 0xa635de
call fcn.00bb37e0
test eax, eax
je 0xa635de
cmp dword [edi + 0x120], 0
jne 0xa635e8
call fcn.00b742e8
xor ecx, ecx
test al, al
setne cl
inc ecx
mov dword [edi + 0x120], ecx
jmp 0xa635e8
mov dword [edi + 0x120], 0
mov ecx, dword [edi + 0x220]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0xa8]
cmp esi, fcn.00a91150
jne 0xa6352f
call fcn.00a91150
jmp 0xa634e5
lea eax, [ebx - 0x10]
cmp eax, 0xc
ja case.0xa63619.20
jmp dword [eax*4 + 0xa63acc]
call dword [sym.imp.SHELL32.dll_Ordinal_733]
jmp 0xa634e5
cmp dword [edi + 0x10c], 0
je 0xa63649
call dword [sym.imp.SHELL32.dll_Ordinal_753]
mov dword [edi + 0x10c], 0
jmp 0xa634e5
push 0x17
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
mov dword [edi + 0x110], 0
jmp 0xa634e5
push 0x10
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
lea eax, [edi + 0x1c]
push eax
call fcn.00a81950
mov byte [edi + 0x178], 0
jmp 0xa634e5
push 0x11
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
lea eax, [edi + 0x1c]
push eax
call fcn.00a81950
jmp 0xa634e5
push 0x12
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
push ecx
push 0
mov ecx, edi
call fcn.00a3aa87
jmp 0xa634e5
push 0x13
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
push dword [edi + 0xdc]
mov ecx, edi
call fcn.00b796cd
jmp 0xa634e5
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoFreeUnusedLibraries]
call dword [sym.imp.ntdll.dll_RtlFlushHeaps]
push 0x18
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
lea eax, [edi + 0x1c]
push eax
call fcn.00a3e460
jmp 0xa634e5
lea ecx, [edi + 0x1e0]
call fcn.00a69360
test eax, eax
jns 0xa634e5
mov ecx, dword [ebp + 4]
mov edx, 0x720
push eax
push 0x9f9bd4
call fcn.00ab606d
jmp 0xa634e5
push 0x1c
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_KillTimer]
cmp byte [edi + 0x20a], 0
push ecx
je 0xa6375d
mov ecx, 0xc964a8
call fcn.00aba7d2
push ecx
test al, al
mov ecx, 0xc964a8
push 2
setne byte [ebp - 0x30]
push dword [ebp - 0x30]
call fcn.00ab9eeb
jmp 0xa634e5
cmp byte [edi + 0x209], 0
je 0xa6378b
mov ecx, 0xc964b8
call fcn.00b7b36e
push ecx
test al, al
mov ecx, 0xc964b8
push 2
setne byte [ebp - 0x30]
push dword [ebp - 0x30]
call fcn.00b74f99
jmp 0xa634e5
mov ecx, 0xc964c8
call fcn.00b7b3d6
push ecx
test al, al
mov ecx, 0xc964c8
push 2
setne byte [ebp - 0x30]
push dword [ebp - 0x30]
call fcn.00b74ff0
jmp 0xa634e5
mov eax, dword [edi + 0x220]
push ebx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x5c]
jmp 0xa634db
cmp dword [edi + 0x104], esi
jne 0xa637d6
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0xa63813
cmp dword [edi + 0x17c], esi
jne 0xa637ee
mov eax, dword [edi + 0x220]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xac]
jmp 0xa63804
cmp dword [edi + 0x180], esi
jne 0xa63819
mov eax, dword [edi + 0x220]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xb0]
push ebx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edi, dword [edi + 0x220]
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x30], eax
cmp eax, fcn.00a63b00
jne 0xa6383e
lea eax, [ebp - 0x25]
push eax
push edx
push ebx
push esi
push ecx
push edi
call fcn.00a63b00
jmp 0xa63855
lea esi, [ebp - 0x25]
push esi
mov esi, dword [ebp + 0xc]
push edx
push ebx
push esi
push ecx
push edi
mov ecx, eax
call dword [0xc99200]
call dword [ebp - 0x30]
cmp byte [ebp - 0x25], 0
mov dword [ebp - 0x34], eax
je 0xa634e5
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
push edx
push ebx
push esi
push ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_DefWindowProcW]
jmp 0xa634e8