Function at 0x4127a0
Capabilities:
Create process on windows
Hide graphical window
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41319c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [0x418610]
mov edx, dword [0x419804]
mov bl, byte [edx + eax]
cmp bl, 2
sete dl
mov eax, dword [esi + 0xe4]
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
jbe 0x4127fa
cmp bl, 9
jb 0x4127fe
xor eax, eax
jmp 0x412800
mov al, 1
mov byte [ebp - 1], al
mov eax, dword [esi + 0x20]
mov dl, byte [ebp - 1]
call fcn.00405f3c
mov eax, dword [esi + 0x30]
mov dl, byte [ebp - 1]
call fcn.00405f3c
cmp byte [0x418610], 0
seta dl
mov eax, dword [esi + 0x30]
call fcn.0040a074
mov eax, dword [esi + 0xa4]
mov dl, byte [ebp - 1]
call fcn.00405f3c
mov eax, dword [esi + 0xa8]
mov dl, byte [ebp - 1]
call fcn.00405f3c
cmp byte [ebp - 1], 0
je 0x4128a8
mov eax, dword [esi + 0x18]
call fcn.0040ab94
mov edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040ab34
sub edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040ab94
mov edx, edi
sub edx, eax
sub edx, 0x14
mov eax, dword [esi + 0xa4]
call fcn.0040aba0
mov eax, dword [esi + 0xa8]
call fcn.0040ab34
mov edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040ab94
add edi, eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.0040ab40
cmp bl, 0xa
jae 0x4128db
xor edi, edi
xor eax, eax
mov al, bl
cmp edi, eax
je 0x4128c5
mov eax, esi
mov edx, edi
call fcn.00412704
call fcn.00405f4c
inc edi
cmp edi, 0xa
jne 0x4128af
xor edx, edx
mov dl, bl
mov eax, esi
call fcn.00412704
call fcn.0040a904
xor eax, eax
mov al, bl
cmp eax, 0xa
ja case.default.0x4128e8
jmp dword [eax*4 + 0x4128ef]
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x24]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [esi + 0x34]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x4197fc]
mov edx, 0xffffff
call fcn.0040abe8
mov eax, dword [0x4197fc]
mov dl, 1
call fcn.00407a88
mov eax, dword [esi + 0x34]
xor edx, edx
call fcn.0040a074
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xd4]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xd8]
mov eax, dword [esi + 0x28]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x88]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x148]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x2c]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
mov ebx, dword [esi + 0x48]
xor edx, edx
mov eax, dword [ebx + 0x1e3]
call dword [ebx + 0x1df]
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xf8]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
push dword [eax + 0xac]
push 0x4131b4
lea edx, [ebp - 0x38]
mov eax, dword [esi + 0x48]
call fcn.00405ef4
push dword [ebp - 0x38]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00401c9c
mov eax, 0x56
call fcn.0041496c
test al, al
je 0x412b9e
mov eax, dword [esi + 0x9c]
call fcn.0040af9c
test al, al
jne 0x412b9e
push dword [ebp - 0x10]
push 0x4131c4
mov eax, dword [0x418644]
mov eax, dword [eax]
push dword [eax + 0xb0]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00401c9c
push dword [ebp - 0x10]
push 0x4131b4
lea edx, [ebp - 0x3c]
mov eax, dword [esi + 0x50]
call fcn.00405ef4
push dword [ebp - 0x3c]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00401c9c
lea eax, [ebp - 0x14]
call fcn.00401a50
mov eax, 0x16
call fcn.0041496c
test al, al
je 0x412c7c
mov eax, dword [esi + 0x84]
call fcn.0040af9c
test al, al
je 0x412bf7
mov eax, dword [esi + 0x84]
call fcn.0040a7ac
test al, al
je 0x412bf7
push 0x4131b4
mov eax, dword [0x418644]
mov eax, dword [eax]
push dword [eax + 0x7c]
push 0x4131d4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00401c9c
mov eax, dword [esi + 0x88]
call fcn.0040af9c
test al, al
je 0x412c3c
mov eax, dword [esi + 0x88]
call fcn.0040a7ac
test al, al
je 0x412c3c
push dword [ebp - 0x14]
push 0x4131b4
mov eax, dword [0x418644]
mov eax, dword [eax]
push dword [eax + 0x80]
push 0x4131d4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00401c9c
mov eax, dword [esi + 0x8c]
call fcn.0040af9c
test al, al
je 0x412c7c
mov eax, dword [esi + 0x8c]
call fcn.0040a7ac
test al, al
je 0x412c7c
push dword [ebp - 0x14]
push 0x4131b4
mov eax, dword [0x418644]
mov eax, dword [eax]
push dword [eax + 0x84]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00401c9c
cmp dword [ebp - 0x14], 0
je 0x412ca7
push dword [ebp - 0x10]
push 0x4131c4
mov eax, dword [0x418644]
mov eax, dword [eax]
push dword [eax + 0xb4]
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00401c9c
mov eax, dword [esi + 0xf8]
mov edx, dword [ebp - 0x10]
call fcn.0040a770
jmp case.default.0x4128e8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xf4]
mov eax, dword [esi + 0x24]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x44]
mov eax, dword [esi + 0x28]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x14]
mov eax, dword [esi + 0x68]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040a770
mov eax, dword [esi + 0x34]
xor edx, edx
call fcn.0040a074
mov eax, dword [esi + 0x30]
xor edx, edx
call fcn.0040a074
mov eax, esi
call fcn.004122a4
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040acd8
jmp case.default.0x4128e8
mov eax, 0x27
call fcn.0041496c
mov edx, eax
mov eax, dword [esi + 0xcc]
call fcn.00405f3c
mov eax, 0x4f
call fcn.0041496c
mov edx, eax
mov eax, dword [esi + 0xd0]
call fcn.00405f3c
mov eax, 0x24
call fcn.0041496c
mov edx, eax
mov eax, dword [esi + 0x100]
call fcn.00405f3c
mov eax, 0x34
call fcn.0041496c
test al, al
je 0x412e20
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x108]
mov eax, dword [esi + 0xf0]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x10c]
mov eax, dword [esi + 0xf4]
call fcn.0040a770
mov eax, 0x34
call fcn.0041496c
mov edx, eax
mov eax, dword [esi + 0xf0]
call fcn.00405f3c
mov eax, 0x34
call fcn.0041496c
mov edx, eax
mov eax, dword [esi + 0xf4]
call fcn.00405f3c
mov eax, dword [esi + 0xf0]
mov edx, 0xffffff
call fcn.0040abe8
mov eax, dword [esi + 0xf4]
mov edx, 0xffffff
call fcn.0040abe8
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x13c]
mov eax, dword [esi + 0xc4]
call fcn.0040a770
jmp 0x412e35
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov eax, dword [esi + 0xc4]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [esi + 0xc0]
call fcn.0040a770
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xa4]
mov eax, dword [esi + 0x34]
call fcn.0040a770
mov eax, dword [esi + 0xc4]
mov edx, 0x41
call fcn.0040abc8
mov eax, dword [esi + 0xd0]
mov edx, 0xffffff
call fcn.0040abe8
mov eax, dword [esi + 0xcc]
mov edx, 0xffffff
call fcn.0040abe8
mov eax, dword [esi + 0x100]
mov edx, 0xffffff
call fcn.0040abe8
mov eax, dword [esi + 0xcc]
call fcn.0040a7ac
test al, al
jne 0x412ebe
mov eax, dword [esi + 0xd0]
mov edx, 0x98
call fcn.0040ab70
mov eax, dword [esi + 0xd0]
call fcn.0040a7ac
test al, al
jne 0x412edd
mov eax, dword [esi + 0x100]
mov edx, 0xb0
call fcn.0040ab70
mov eax, dword [esi + 0xcc]
call fcn.0040a7ac
test al, al
jne 0x412f0b
mov eax, dword [esi + 0xd0]
call fcn.0040a7ac
test al, al
jne 0x412f0b
mov eax, dword [esi + 0x100]
mov edx, 0x98
call fcn.0040ab70
mov eax, dword [esi + 0xcc]
call fcn.0040a7ac
test al, al
jne 0x412f39
mov eax, dword [esi + 0xd0]
call fcn.0040a7ac
test al, al
je 0x412f39
mov eax, dword [esi + 0x100]
mov edx, 0xb0
call fcn.0040ab70
mov eax, dword [esi + 0x34]
mov dl, 1
call fcn.0040a074
mov eax, dword [esi + 0x34]
mov dl, 1
call fcn.00407a88
mov eax, dword [esi + 0x2c]
xor edx, edx
call fcn.0040a074
mov eax, dword [esi + 0xa8]
call fcn.00405f4c
jmp case.default.0x4128e8
mov eax, dword [0x418688]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00405f4c
mov eax, dword [esi + 0x18]
call fcn.00405f4c
push 0
mov eax, dword [0x418684]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x27
call fcn.0041496c
test al, al
je 0x413004
mov eax, dword [esi + 0xcc]
call fcn.0040af9c
test al, al
je 0x413004
lea ecx, [ebp - 0x10]
mov eax, dword [0x4186a4]
mov eax, dword [eax]
mov eax, dword [eax + 0xac]
xor edx, edx
call fcn.00410160
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00404068
mov eax, dword [ebp - 0x40]
call fcn.00401dd4
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 5
mov eax, dword [ebp - 0x10]
call fcn.00401dd4
mov ebx, eax
push ebx
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x413004
push 5
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x4f
call fcn.0041496c
test al, al
je 0x413069
mov eax, dword [esi + 0xd0]
call fcn.0040af9c
test al, al
je 0x413069
lea ecx, [ebp - 0x10]
mov eax, dword [0x4186a4]
mov eax, dword [eax]
mov eax, dword [eax + 0xbc]
xor edx, edx
call fcn.00410160
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00404068
mov eax, dword [ebp - 0x44]
call fcn.00401dd4
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 5
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00401dd4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x24
call fcn.0041496c
test al, al
je 0x4130b5
mov eax, dword [esi + 0x100]
call fcn.0040af9c
test al, al
je 0x4130b5
push 5
push 0
push 0
lea ecx, [ebp - 0x48]
mov eax, dword [0x4186a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x94]
xor edx, edx
call fcn.00410160
mov eax, dword [ebp - 0x48]
call fcn.00401dd4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x34
call fcn.0041496c
test al, al
je 0x41313d
mov eax, dword [esi + 0xf0]
call fcn.0040af9c
test al, al
je 0x41313d
call fcn.0040c790
cmp al, 2
jbe 0x413134
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x413134
lea eax, [ebp - 0x20]
push eax
push 0x4131d8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x413134
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
mov eax, 0x10
xor edx, edx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x34]
push edx
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 6
call sub.user32.dll_ExitWindowsEx
call fcn.00401948
xor eax, eax
mov al, byte [0x418610]
mov edx, dword [0x419804]
cmp byte [edx + eax + 1], 8
jne 0x413168
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.0040a770
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040acd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4131a3
lea eax, [ebp - 0x48]
mov edx, 5
call fcn.00401a74
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00401a74
ret