Function at 0x40a3e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55551c
mov eax, dword fs:[0]
push eax
mov eax, 0x1164
call fcn.004e7920
mov eax, dword [0x5b2070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1170], ecx
lea ecx, [ebp - 0x1148]
mov dword [ebp - 0x1150], 0
call fcn.0045de20
mov eax, dword [ebp - 0x1144]
cmp eax, 6
ja 0x40a449
jne 0x40a442
cmp dword [ebp - 0x1140], 2
jae 0x40a449
xor al, al
jmp 0x40a7d6
call fcn.00409140
test al, al
je 0x40a442
lea ecx, [ebp - 0x102c]
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0x102c], 0
call fcn.004585e0
mov dword [ebp - 4], 0
xor eax, eax
push 0xf
mov dword [ebp - 0x1158], 0
lea ecx, [ebp - 0x1168]
mov dword [ebp - 0x1154], 0
push str.ModifyHiberboot
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
call fcn.00403570
mov byte [ebp - 4], 1
xor eax, eax
push 0x17
mov dword [ebp - 0x1018], 0
lea ecx, [ebp - 0x1028]
mov dword [ebp - 0x1014], 0
push str.SOFTWARE2345SafeCenter
mov dword [ebp - 0x1150], 1
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
call fcn.00403570
mov dword [ebp - 4], 2
lea eax, [ebp - 0x116c]
push eax
lea eax, [ebp - 0x1168]
mov dword [ebp - 0x1150], 3
push eax
lea eax, [ebp - 0x1028]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.00458e60
test al, al
je 0x40a552
cmp dword [ebp - 0x116c], 1
mov byte [ebp - 0x1149], 0
je 0x40a559
mov byte [ebp - 0x1149], 1
mov dword [ebp - 4], 1
mov esi, 3
mov dword [ebp - 0x1150], esi
and esi, 0xfffffffd
mov dword [ebp - 0x1150], esi
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a5b4
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a5aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abb7
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov dword [ebp - 4], eax
and esi, 0xfffffffe
mov dword [ebp - 0x1150], esi
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40a61d
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a613
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abbc
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
cmp byte [ebp - 0x1149], al
jne 0x40a7a8
movups xmm0, xmmword [str._c_powercfg__h_on]
mov eax, dword [0x584fa8]
push 0xfdc
movups xmmword [ebp - 0x1010], xmm0
mov dword [ebp - 0xff0], eax
lea eax, [ebp - 0xfec]
movups xmm0, xmmword [0x584f98]
push 0
push eax
movups xmmword [ebp - 0x1000], xmm0
call fcn.00501c30
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0
push 0
push eax
push str.cmd.exe
push 0x584fbc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov ecx, 0x5ba2b4
cmp edi, 0x20
jg 0x40a7f1
push 2
call fcn.004a7700
mov esi, eax
test esi, esi
je 0x40a7a8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1010]
push edi
push eax
lea eax, [ebp - 0x1028]
push 0x584fc0
push eax
call fcn.004a7d10
add esp, 0x10
lea eax, [ebp - 0x1028]
mov ecx, 0x5ba2b4
push 0x5b
push str.RC::RCHiberbootFlag::Restore
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectprotectsdk_srcprotectlogistics_srcutils_rchiberbootflag.cpp
push eax
push 2
call fcn.004a7770
cmp esi, 1
jbe 0x40a747
lea eax, [ebp - 0x1028]
mov ecx, 0x5ba2b4
push eax
call fcn.004a7b20
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a78b
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a781
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abc1
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov byte [ebp - 0x1149], 0
mov dword [ebp - 4], 0xffffffff
push 8
push dword [ebp - 0x102c]
call fcn.004e649f
mov al, byte [ebp - 0x1149]
add esp, 8
mov dword [ebp - 0x102c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e645e
mov esp, ebp
pop ebp
ret
push 4
call fcn.004a7700
mov esi, eax
test esi, esi
je 0x40a8e8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1028]
push 0x58511c
push eax
call fcn.004a7d10
add esp, 0xc
lea eax, [ebp - 0x1028]
mov ecx, 0x5ba2b4
push 0x5f
push str.RC::RCHiberbootFlag::Restore
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectprotectsdk_srcprotectlogistics_srcutils_rchiberbootflag.cpp
push eax
push 4
call fcn.004a7770
cmp esi, 1
jbe 0x40a887
lea eax, [ebp - 0x1028]
mov ecx, 0x5ba2b4
push eax
call fcn.004a7b20
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a8cb
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a8c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abc6
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
push str.HiberbootEnabled
lea ecx, [ebp - 0x1028]
call fcn.004032e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1168]
push str.SystemCurrentControlSetControlSession_ManagerPower
call fcn.004032e0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1028]
push 1
push eax
lea eax, [ebp - 0x1168]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.00458f60
test al, al
sete byte [ebp - 0x1149]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40a979
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a96f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abcb
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a9d9
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a9cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abd0
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
cmp byte [ebp - 0x1149], al
jne 0x40a7a8
push str.SYSTEMCurrentControlSetControlPower
lea ecx, [ebp - 0x1168]
call fcn.004032e0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1168]
push 1
push dword [ebp - 0x1170]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.00458f60
test al, al
sete al
mov byte [ebp - 0x1149], al
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40aa86
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40aa76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abd5
push edx
push ecx
call fcn.004e649f
mov al, byte [ebp - 0x1149]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], cx
test al, al
jne 0x40a7a8
push str.ModifyHiberboot
lea ecx, [ebp - 0x1028]
call fcn.004032e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1168]
push str.SOFTWARE2345SafeCenter
call fcn.004032e0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x1028]
push 0
push eax
lea eax, [ebp - 0x1168]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.00458f60
mov byte [ebp - 0x1149], al
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40ab39
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ab2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abda
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40ab95
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ab8b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abdf
push edx
push ecx
call fcn.004e649f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
jmp 0x40a7af
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
call fcn.0050ba48
int3