Function at 0x1400aaff0
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140263a80]
xor rax, rsp
mov qword [rbp - 8], rax
movzx eax, cl
dec eax
cmp eax, 0xc
ja case.default.0x1400ab028
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0xab3fc]
add rcx, rdx
jmp rcx
lea r8, str.::20D04FE0_3AEA_1069_A2D8_08002B30309D
xor edx, edx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
lea r8, str.wmplayer.exe
jmp 0x1400ab031
lea r8, str.Excel.exe
jmp 0x1400ab031
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.default.0x1400ab028
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor edx, edx
mov dword [rbp - 0x18], 1
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov dword [rbp - 0xc], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.default.0x1400ab028
mov edx, 0x80020003
lea ecx, [rax + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.default.0x1400ab028
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor edx, edx
mov dword [rbp - 0x18], 1
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov dword [rbp - 0xc], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.default.0x1400ab028
mov edx, 0x80020003
lea ecx, [rax + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.default.0x1400ab028
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor edx, edx
mov dword [rbp - 0x18], 1
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov dword [rbp - 0xc], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.default.0x1400ab028
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.POWRPROF.dll_SetSuspendState]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
lea r9, [0x1402485e0]
jmp 0x1400ab3bd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.default.0x1400ab028
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor edx, edx
mov dword [rbp - 0x18], 1
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov dword [rbp - 0xc], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.default.0x1400ab028
xor r8d, r8d
xor edx, edx
mov cl, 1
call qword [sym.imp.POWRPROF.dll_SetSuspendState]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.default.0x1400ab028
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor edx, edx
mov dword [rbp - 0x18], 1
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov dword [rbp - 0xc], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne case.default.0x1400ab028
mov edx, 0x80020003
lea ecx, [rax + 5]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
lea r8, str.calc.exe
jmp 0x1400ab031
mov rax, qword [0x140267e70]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400ab37e
mov dword [rbp - 0x20], 1
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov r8d, dword [rbp - 0x20]
xor edx, edx
test eax, eax
mov rax, qword [0x140267e70]
cmovs r8d, edx
jmp 0x1400ab383
xor edx, edx
mov r8d, edx
mov rcx, qword [rax + 8]
test rcx, rcx
je case.default.0x1400ab028
mov rax, qword [rcx]
test r8d, r8d
sete dl
xor r8d, r8d
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret
lea r9, [0x1402485e2]
jmp 0x1400ab3bd
lea r9, [0x1402485e1]
mov rcx, qword [0x140268120]
xor edx, edx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rdx
lea r8d, [rdx + 9]
mov dword [rsp + 0x20], 4
mov rdx, qword [rcx + 8]
call fcn.140076b40
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401d0310
add rsp, 0x60
pop rbp
ret