Function at 0xa83d80
Capabilities:
Create process on windows
Create thread
Lock the desktop

Disassembly:
push 0x204
mov eax, 0xafc73d
call fcn.00af8e2b
mov esi, dword [ebp + 0xc]
mov ecx, 0x1f7
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
cmp esi, ecx
ja 0xa8445d
je 0xa84454
lea eax, [esi - 0x191]
cmp eax, 0x30
ja case.0xa83dc1.406
movzx eax, byte [eax + 0xa84660]
jmp dword [eax*4 + 0xa845f8]
push 0
push 0x2001
push 0
push 0xb77900
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
jmp case.0xa83dc1.406
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_UpdateWindow]
push 0x64
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea ecx, [edi - 0x1c]
call fcn.00b74bd3
push edi
call fcn.00a81950
push dword [0xc9585c]
call dword [sym.imp.SHELL32.dll_Ordinal_54]
jmp case.0xa83dc1.406
cmp byte [edi + 0x102], 0
jne case.0xa83dc1.406
cmp byte [ebp + 0x18], 0
lea ecx, [edi - 0x1c]
je 0xa83e31
call fcn.00b793d6
jmp case.0xa83dc1.406
mov eax, dword [0xc96fc8]
neg eax
sbb eax, eax
add eax, 3
push eax
call fcn.00a39580
cmp dword [0xc96fc8], 0
lea ecx, [ebp - 0x1cd]
sete byte [ebp - 0x1cd]
call fcn.00b66b9b
jmp case.0xa83dc1.406
lea ecx, [edi - 0x1c]
call fcn.00b76d8e
jmp case.0xa83dc1.406
lea ecx, [edi - 0x1c]
call fcn.00b7a717
jmp case.0xa83dc1.406
cmp byte [edi + 0x102], 0
jne case.0xa83dc1.406
push 1
push ecx
lea ecx, [edi - 0x1c]
call fcn.00a38a5a
jmp case.0xa83dc1.406
cmp byte [edi + 0x102], 0
jne case.0xa83dc1.406
push 0
push 0
lea ecx, [edi - 0x1c]
call fcn.00a390aa
jmp case.0xa83dc1.406
cmp byte [edi + 0x102], 0
jne case.0xa83dc1.406
push ecx
push 0xa16634
lea ecx, [ebp - 0x1c8]
call fcn.00a49d15
mov esi, 0x9d6254
lea ecx, [ebp - 0x1c8]
push 1
mov dword [ebp - 0x1c8], esi
call fcn.00b75fe7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c8]
call fcn.00b76cbd
push 0
push 0
lea ecx, [edi - 0x1c]
call fcn.00b7a636
push 0
lea ecx, [ebp - 0x1c8]
call fcn.00a581ed
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x1c8], esi
call fcn.00a587ba
lea ecx, [ebp - 0x110]
call fcn.00a4aca5
lea ecx, [ebp - 0x11c]
call fcn.00a48c27
lea ecx, [ebp - 0x184]
call fcn.00a7d7ad
cmp dword [ebp - 0x1ac], 1
jne 0xa83f6c
mov dword [ebp - 0x1ac], 2
call fcn.00ab6005
lea edx, [ebp - 0x1a4]
mov ecx, dword [eax + 4]
call fcn.00b5d2a9
cmp dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1ac], 3
je case.0xa83dc1.406
lea ecx, [ebp - 0x1c4]
call fcn.00a59db6
jmp case.0xa83dc1.406
push 0
push 2
xor dl, dl
pop ecx
call fcn.00bbc5b1
jmp case.0xa83dc1.406
push dword [edi - 0x18]
xor ecx, ecx
mov dl, 1
inc ecx
jmp 0xa83f9a
test byte [0xc96fc0], 1
je 0xa83fcd
lea eax, [ebp - 0x20]
mov edx, 0x9f8568
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
mov eax, dword [edi + 0x204]
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xcc]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [edi + 0x204]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x120]
mov ecx, esi
call dword [0xc99200]
call esi
test byte [0xc96fc0], 1
je case.0xa83dc1.406
lea eax, [ebp - 0x30]
mov edx, 0x9f8548
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
jmp case.0xa83dc1.406
push 0x38
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x3c
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 0x200], 0x9fcd98
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x1fc], 0x9fcd8c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.00b68048
jmp case.0xa83dc1.406
and dword [ebp - 0x1cc], 0
push ecx
push 0xa16634
lea ecx, [ebp - 0x10c]
call fcn.00a49d15
push 1
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x9d6254
call fcn.00b75fe7
push edi
mov dword [ebp - 4], 1
call fcn.00b67ee0
test eax, eax
je 0xa841f9
lea ecx, [edi - 0x1c]
cmp esi, 0x193
jne 0xa840db
mov eax, 0x217
jmp 0xa840ed
xor eax, eax
cmp esi, 0x194
setne al
lea eax, [eax*2 + 0x218]
push eax
call fcn.00a37ecc
push 1
push 0
push 3
push 0
push edi
call fcn.00a4a910
xor eax, eax
push eax
push eax
push eax
cmp esi, 0x193
jne 0xa84166
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
test ax, ax
je 0xa8412a
and dword [ebp - 0x1cc], 0
jmp 0xa84159
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x1cc], esi
test esi, esi
jle 0xa8414d
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x1cc], esi
test esi, esi
js 0xa84159
mov dword [ebp - 0x1cc], 0x80004005
lea ecx, [ebp - 0x10c]
call fcn.00b67f00
jmp 0xa841d3
xor eax, eax
cmp esi, 0x194
setne al
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
test ax, ax
je 0xa8418d
and dword [ebp - 0x1cc], 0
jmp 0xa841b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x1cc], eax
test eax, eax
jle 0xa841ad
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x1cc], eax
test eax, eax
js 0xa841b9
mov dword [ebp - 0x1cc], 0x80004005
lea ecx, [ebp - 0x10c]
cmp esi, 0x194
jne 0xa841ce
call fcn.00b76d4e
jmp 0xa841d3
call fcn.00b75cfb
and dword [edi + 0x84], 0
push 0
push 0x1f4
push 0x12
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetTimer]
xor eax, eax
push eax
push eax
push 3
push eax
push edi
call fcn.00a4a910
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x10c]
call fcn.00a581ed
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x9d6254
call fcn.00a587ba
lea ecx, [ebp - 0x54]
call fcn.00a4aca5
lea ecx, [ebp - 0x60]
call fcn.00a48c27
lea ecx, [ebp - 0xc8]
call fcn.00a7d7ad
cmp dword [ebp - 0xf0], 1
jne 0xa84260
mov dword [ebp - 0xf0], 2
call fcn.00ab6005
lea edx, [ebp - 0xe8]
mov ecx, dword [eax + 4]
call fcn.00b5d2a9
cmp dword [ebp - 0xfc], 0
mov dword [ebp - 0xf0], 3
je case.0xa83dc1.406
lea ecx, [ebp - 0x108]
jmp 0xa83f89
mov eax, dword [edi + 0x204]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd0]
mov ecx, esi
call dword [0xc99200]
call esi
jmp case.0xa83dc1.406
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xdc]
jmp 0xa84597
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xe4]
jmp 0xa84597
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xe8]
jmp 0xa84597
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf0]
jmp 0xa84597
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xec]
jmp 0xa84597
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xe0]
jmp 0xa84597
push esi
call fcn.00b77c6a
jmp case.0xa83dc1.406
mov esi, 0x9f02f0
mov edx, 0x9f9c90
push 0
mov ecx, esi
call fcn.00a57919
neg eax
mov edx, esi
push ecx
sbb eax, eax
mov ecx, reloc.SHCORE.dll_Ordinal_1
inc eax
push 4
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0x1cc]
push eax
push 4
push 0x9f9c90
call fcn.00b6073b
test eax, eax
jle 0xa8436d
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xa84387
mov edx, 0x1648
mov ecx, dword [ebp + 4]
push eax
push 0x9f9bd4
call fcn.00ab606d
jmp case.0xa83dc1.406
push 0
push 1
push 0x5ca
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1ce]
lea ecx, [ebp - 0x1cf]
mov byte [ebp - 0x1ce], 0
mov byte [ebp - 0x1cf], al
call fcn.00b66d30
jmp case.0xa83dc1.406
mov esi, 0x9f02f0
mov edx, 0x9f1d90
push 0
mov ecx, esi
call fcn.00a57919
neg eax
mov edx, esi
push ecx
sbb eax, eax
mov ecx, reloc.SHCORE.dll_Ordinal_1
inc eax
push 4
mov dword [ebp - 0x1d4], eax
lea eax, [ebp - 0x1d4]
push eax
push 4
push 0x9f1d90
call fcn.00b6073b
test eax, eax
jle 0xa8440b
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xa84417
mov edx, 0x1652
jmp 0xa84374
push 0
push 0xa
push 0x5ca
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
jmp case.0xa83dc1.406
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf4]
jmp 0xa84597
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf8]
jmp 0xa84597
push 0
push 4
jmp 0xa83f97
mov eax, 0x280
cmp esi, eax
ja 0xa84560
je 0xa844a8
cmp esi, 0x1fa
je 0xa84535
cmp esi, 0x205
je 0xa844df
cmp esi, 0x206
je 0xa844c5
cmp esi, 0x207
je 0xa844b6
cmp esi, 0x26f
jbe case.0xa83dc1.406
cmp esi, 0x274
ja case.0xa83dc1.406
push esi
lea ecx, [edi - 0x1c]
call fcn.00aba48f
jmp case.0xa83dc1.406
push 0x1f
lea ecx, [edi - 0x1c]
call fcn.00b7934e
jmp case.0xa83dc1.406
push 0
push 0
push 0x5b4
push dword [0xc95994]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_PostMessageW]
jmp case.0xa83dc1.406
mov al, byte [0xc96fc3]
test al, 4
je 0xa8451d
lea eax, [ebp - 0x40]
mov edx, 0x9f8178
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
mov al, byte [0xc96fc3]
test al, 4
je 0xa8451d
lea eax, [ebp - 0x50]
mov edx, 0x9f80d8
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
call fcn.00b76e96
test eax, eax
je case.0xa83dc1.406
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp case.0xa83dc1.406
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_UpdateWindow]
push 0x64
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea ecx, [edi - 0x1c]
call fcn.00b74bd3
push dword [ebp + 0x10]
push ecx
push ecx
lea ecx, [edi - 0x1c]
call fcn.00b77814
jmp case.0xa83dc1.406
sub esi, 0x1388
je 0xa845d1
sub esi, 1
je 0xa845b4
sub esi, 0x8ca7
je 0xa845a4
sub esi, 0x35
je 0xa84589
sub esi, 0x21
jne case.0xa83dc1.406
push esi
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_91]
jmp case.0xa83dc1.406
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd4]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
jmp case.0xa83dc1.406
mov eax, dword [edi + 0x204]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd8]
jmp 0xa84597
push 3
call dword [sym.imp.SHLWAPI.dll_Ordinal_413]
test eax, eax
je case.0xa83dc1.406
xor eax, eax
push eax
push eax
push 0xd
push 0xffffffffffffffff
push eax
call dword [sym.imp.WINSTA.dll_WinStationSetInformationW]
jmp case.0xa83dc1.406
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_UpdateWindow]
push 0x64
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
push dword [0xc9585c]
call dword [sym.imp.SHELL32.dll_Ordinal_254]
call fcn.00af8dd5
ret 0x14