Function at 0x420704
Capabilities:
Create process on windows
Hide graphical window
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x421109
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [0x4287ac]
mov edx, dword [0x42a058]
mov bl, byte [edx + eax]
cmp bl, 2
sete dl
mov eax, dword [esi + 0xe4]
mov ecx, dword [eax]
call dword [ecx + 8]
or bl, bl
jbe 0x42075e
cmp bl, 9
jb 0x420762
xor eax, eax
jmp 0x420764
mov al, 1
mov byte [ebp - 1], al
mov eax, dword [esi + 0x20]
mov dl, byte [ebp - 1]
call fcn.0040b8f0
mov dl, byte [ebp - 1]
mov eax, dword [esi + 0x30]
call fcn.0040b8f0
cmp byte [0x4287ac], 0
seta dl
mov eax, dword [esi + 0x30]
call fcn.0040b440
mov dl, byte [ebp - 1]
mov eax, dword [esi + 0xa4]
call fcn.0040b8f0
mov dl, byte [ebp - 1]
mov eax, dword [esi + 0xa8]
call fcn.0040b8f0
cmp byte [ebp - 1], 0
je 0x42080c
mov eax, dword [esi + 0x18]
call fcn.0040bc3c
mov edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040bbdc
sub edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040bc3c
mov edx, edi
sub edx, eax
mov eax, dword [esi + 0xa4]
sub edx, 0x14
call fcn.0040bc48
mov eax, dword [esi + 0xa8]
call fcn.0040bbdc
mov edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040bc3c
add edi, eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.0040bbe8
cmp bl, 0xa
jae 0x42083f
xor edi, edi
xor edx, edx
mov dl, bl
cmp edi, edx
je 0x420829
mov edx, edi
mov eax, esi
call fcn.00420668
call fcn.00407c68
inc edi
cmp edi, 0xa
jne 0x420813
xor edx, edx
mov eax, esi
mov dl, bl
call fcn.00420668
call fcn.0040b9e0
xor eax, eax
mov al, bl
cmp eax, 0xa
ja case.default.0x42084c
jmp dword [eax*4 + 0x420853]
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x24]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x42a050]
mov edx, 0xffffff
call fcn.0040bc90
mov eax, dword [0x42a050]
mov dl, 1
call fcn.0040d398
mov eax, dword [esi + 0x34]
xor edx, edx
call fcn.0040b440
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0xd4]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0xd8]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x88]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x148]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x2c]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov edx, 0x12
lea ecx, [ebp - 0x3c]
mov eax, dword [esi + 0x48]
call fcn.0040e04c
lea ebx, [ebp - 0x3c]
mov eax, dword [ebx + 4]
xor edx, edx
call dword [ebx]
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0xf8]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
push dword [eax + 0xac]
push 0x421120
lea edx, [ebp - 0x40]
mov eax, dword [esi + 0x48]
call fcn.0040dec0
push dword [ebp - 0x40]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004039b4
mov eax, 0x56
call fcn.00422b10
test al, al
je 0x420b0b
mov eax, dword [esi + 0x9c]
call fcn.0040c17c
or al, al
jne 0x420b0b
push dword [ebp - 0x10]
push 0x421130
mov eax, dword [0x4287f8]
mov eax, dword [eax]
push dword [eax + 0xb0]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004039b4
push dword [ebp - 0x10]
push 0x421120
lea edx, [ebp - 0x44]
mov eax, dword [esi + 0x50]
call fcn.0040dec0
push dword [ebp - 0x44]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004039b4
lea eax, [ebp - 0x14]
call fcn.00403694
mov eax, 0x16
call fcn.00422b10
or al, al
je 0x420be9
mov eax, dword [esi + 0x84]
call fcn.0040c17c
test al, al
je 0x420b64
mov eax, dword [esi + 0x84]
call fcn.0040b8ac
or al, al
je 0x420b64
push 0x421120
mov eax, dword [0x4287f8]
mov eax, dword [eax]
push dword [eax + 0x7c]
push 0x421140
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004039b4
mov eax, dword [esi + 0x88]
call fcn.0040c17c
test al, al
je 0x420ba9
mov eax, dword [esi + 0x88]
call fcn.0040b8ac
or al, al
je 0x420ba9
push dword [ebp - 0x14]
push 0x421120
mov eax, dword [0x4287f8]
mov eax, dword [eax]
push dword [eax + 0x80]
push 0x421140
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004039b4
mov eax, dword [esi + 0x8c]
call fcn.0040c17c
or al, al
je 0x420be9
mov eax, dword [esi + 0x8c]
call fcn.0040b8ac
test al, al
je 0x420be9
push dword [ebp - 0x14]
push 0x421120
mov eax, dword [0x4287f8]
mov eax, dword [eax]
push dword [eax + 0x84]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004039b4
cmp dword [ebp - 0x14], 0
je 0x420c14
push dword [ebp - 0x10]
push 0x421130
mov eax, dword [0x4287f8]
mov edx, 4
mov eax, dword [eax]
push dword [eax + 0xb4]
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004039b4
mov eax, dword [esi + 0xf8]
mov edx, dword [ebp - 0x10]
call fcn.0040b86c
jmp case.default.0x42084c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0xf4]
mov eax, dword [esi + 0x24]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x44]
mov eax, dword [esi + 0x28]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x14]
mov eax, dword [esi + 0x68]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov eax, dword [esi + 0x34]
xor edx, edx
call fcn.0040b440
xor edx, edx
mov eax, dword [esi + 0x30]
call fcn.0040b440
mov eax, esi
call fcn.0041fa58
mov eax, dword [0x428840]
mov eax, dword [eax]
call fcn.0040bd64
jmp case.default.0x42084c
mov eax, 0x27
call fcn.00422b10
mov edx, eax
mov eax, dword [esi + 0xcc]
call fcn.0040b8f0
mov eax, 0x4f
call fcn.00422b10
mov edx, eax
mov eax, dword [esi + 0xd0]
call fcn.0040b8f0
mov eax, 0x24
call fcn.00422b10
mov edx, eax
mov eax, dword [esi + 0x100]
call fcn.0040b8f0
mov eax, 0x34
call fcn.00422b10
test al, al
je 0x420d8d
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x108]
mov eax, dword [esi + 0xf0]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x10c]
mov eax, dword [esi + 0xf4]
call fcn.0040b86c
mov eax, 0x34
call fcn.00422b10
mov edx, eax
mov eax, dword [esi + 0xf0]
call fcn.0040b8f0
mov eax, 0x34
call fcn.00422b10
mov edx, eax
mov eax, dword [esi + 0xf4]
call fcn.0040b8f0
mov edx, 0xffffff
mov eax, dword [esi + 0xf0]
call fcn.0040bc90
mov eax, dword [esi + 0xf4]
mov edx, 0xffffff
call fcn.0040bc90
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x13c]
mov eax, dword [esi + 0xc4]
call fcn.0040b86c
jmp 0x420da2
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov eax, dword [esi + 0xc4]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [esi + 0xc0]
call fcn.0040b86c
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0xa4]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov edx, 0x41
mov eax, dword [esi + 0xc4]
call fcn.0040bc70
mov eax, dword [esi + 0xd0]
mov edx, 0xffffff
call fcn.0040bc90
mov eax, dword [esi + 0xcc]
mov edx, 0xffffff
call fcn.0040bc90
mov eax, dword [esi + 0x100]
mov edx, 0xffffff
call fcn.0040bc90
mov eax, dword [esi + 0xcc]
call fcn.0040b8ac
test al, al
jne 0x420e2b
mov edx, 0x98
mov eax, dword [esi + 0xd0]
call fcn.0040bc18
mov eax, dword [esi + 0xd0]
call fcn.0040b8ac
test al, al
jne 0x420e4a
mov eax, dword [esi + 0x100]
mov edx, 0xb0
call fcn.0040bc18
mov eax, dword [esi + 0xcc]
call fcn.0040b8ac
or al, al
jne 0x420e78
mov eax, dword [esi + 0xd0]
call fcn.0040b8ac
or al, al
jne 0x420e78
mov eax, dword [esi + 0x100]
mov edx, 0x98
call fcn.0040bc18
mov eax, dword [esi + 0xcc]
call fcn.0040b8ac
or al, al
jne 0x420ea6
mov eax, dword [esi + 0xd0]
call fcn.0040b8ac
test al, al
je 0x420ea6
mov eax, dword [esi + 0x100]
mov edx, 0xb0
call fcn.0040bc18
mov dl, 1
mov eax, dword [esi + 0x34]
call fcn.0040b440
mov dl, 1
mov eax, dword [esi + 0x34]
call fcn.0040d398
mov eax, dword [esi + 0x2c]
xor edx, edx
call fcn.0040b440
mov eax, dword [esi + 0xa8]
call fcn.00407c68
jmp case.default.0x42084c
mov eax, dword [0x428848]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00407c68
mov eax, dword [esi + 0x18]
call fcn.00407c68
push 0
mov eax, dword [0x428840]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x27
call fcn.00422b10
or al, al
je 0x420f71
mov eax, dword [esi + 0xcc]
call fcn.0040c17c
or al, al
je 0x420f71
lea ecx, [ebp - 0x10]
mov eax, dword [0x428864]
mov eax, dword [eax]
mov eax, dword [eax + 0xac]
xor edx, edx
call fcn.0041d480
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.00405c8c
mov eax, dword [ebp - 0x48]
call fcn.00403af4
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 5
mov eax, dword [ebp - 0x10]
call fcn.00403af4
mov ebx, eax
push ebx
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x420f71
push 5
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x4f
call fcn.00422b10
test al, al
je 0x420fd6
mov eax, dword [esi + 0xd0]
call fcn.0040c17c
or al, al
je 0x420fd6
lea ecx, [ebp - 0x10]
mov eax, dword [0x428864]
mov eax, dword [eax]
mov eax, dword [eax + 0xbc]
xor edx, edx
call fcn.0041d480
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
call fcn.00405c8c
mov eax, dword [ebp - 0x4c]
call fcn.00403af4
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 5
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403af4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x24
call fcn.00422b10
test al, al
je 0x421022
mov eax, dword [esi + 0x100]
call fcn.0040c17c
test al, al
je 0x421022
push 5
push 0
push 0
lea ecx, [ebp - 0x50]
mov eax, dword [0x428864]
mov eax, dword [eax]
mov eax, dword [eax + 0x94]
xor edx, edx
call fcn.0041d480
mov eax, dword [ebp - 0x50]
call fcn.00403af4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x34
call fcn.00422b10
test al, al
je 0x4210aa
mov eax, dword [esi + 0xf0]
call fcn.0040c17c
or al, al
je 0x4210aa
call fcn.0040d470
cmp al, 2
jbe 0x4210a1
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
or eax, eax
je 0x4210a1
lea eax, [ebp - 0x20]
push eax
push 0x421144
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4210a1
mov eax, 0x10
xor edx, edx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x34]
push edx
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 6
call sub.user32.dll_ExitWindowsEx
call fcn.0040359c
xor eax, eax
mov al, byte [0x4287ac]
mov edx, dword [0x42a058]
cmp byte [edx + eax + 1], 8
jne 0x4210d5
mov eax, dword [0x4287f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.0040b86c
mov eax, dword [0x428840]
mov eax, dword [eax]
call fcn.0040bd64
pop edx
pop ecx
pop ecx
xor eax, eax
mov dword fs:[eax], edx
push 0x421110
lea eax, [ebp - 0x50]
mov edx, 5
call fcn.004036b8
mov edx, 2
lea eax, [ebp - 0x14]
call fcn.004036b8
ret