Function at 0x14003bbb0
Capabilities:
Create thread
Get session user name
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r14, rcx
mov rdi, r8
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp eax, 0x400
jne 0x14003c260
call fcn.14001f8e0
cmp eax, 1
je 0x14003c260
cmp dword [0x14008f43c], 1
jne 0x14003c260
xor edx, edx
lea rcx, [rbp + 0xd0]
mov r8d, 0x4d0
call fcn.14003fc80
mov dword [rbp + 0x100], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14003bc8b
cmp qword [rbp + 0x118], 0
jne 0x14003c260
cmp qword [rbp + 0x120], 0
jne 0x14003c260
cmp qword [rbp + 0x128], 0
jne 0x14003c260
cmp qword [rbp + 0x130], 0
jne 0x14003c260
call fcn.140018cc0
call fcn.140017ff0
cmp dword [0x14008f43c], 2
jne 0x14003c260
call fcn.140024cf0
cmp dword [0x14008f380], 5
jb 0x14003c265
cmp dword [0x14008f43c], 3
jne 0x14003c260
call fcn.140018c20
mov qword [0x14008f610], r14
call fcn.140036b40
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14003bce0
test rax, rax
je 0x14003bcf7
mov rcx, rdi
call fcn.14002bbb0
xor r15d, r15d
cmp dword [0x1400771b0], 1
mov esi, r15d
jne 0x14003bd0d
call fcn.1400190b0
mov esi, eax
mov edx, 0x16
lea rcx, [0x140089818]
call fcn.14000a850
mov rcx, rax
call fcn.14000ff30
lea rcx, str.User32
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087b80], rax
test rax, rax
je 0x14003bd50
call rax
cmp dword [0x14008f43c], 4
jne 0x14003c260
mov ebx, 0xdc
lea rcx, [rbp - 0x10]
mov r8d, ebx
xor edx, edx
call fcn.14003fc80
lea r8, [rbp - 0x10]
mov dword [rbp + 0x34], ebx
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov eax, dword [rbp + 0x9c]
mov ecx, dword [rbp + 0xa0]
mov dword [0x14008f288], eax
mov eax, dword [rbp + 0xa8]
mov dword [0x14008f290], eax
mov dword [0x14008f28c], ecx
test esi, esi
jne 0x14003bdd4
mov eax, dword [0x140077114]
cmp ecx, 0x438
mov edx, 0xb
cmovg eax, edx
cmp ecx, 0x5a0
mov edx, 0xc
cmovg eax, edx
mov dword [0x140077114], eax
inc dword [0x14008f43c]
call fcn.14001a340
xor edx, edx
lea rcx, [rbp + 0x5a0]
mov r8d, 0x208
call fcn.14003fc80
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x100
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [0x140091fd8]
mov word [0x140091fec], r15w
mov edx, 0x103
mov word [rbp + 0x7a0], r15w
lea rcx, [rbp + 0x5a0]
call fcn.140044dfc
lea r9, [rbp + 0x5a0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov qword [0x14008f668], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x14008f668], r15
je 0x14003be85
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003be85
lea rdx, [0x140091fd8]
mov rcx, rdi
call fcn.14003bb80
test rax, rax
je 0x14003c265
call fcn.140027ce0
cmp dword [0x14008f43c], 6
je 0x14003beb3
mov r9d, 1
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
call fcn.14002ffd0
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 0x50
xorps xmm1, xmm1
mov qword [0x14008f560], rax
lea rax, [0x140038860]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, 0x7f00
mov qword [rsp + 0x68], rax
xor ecx, ecx
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x5a0]
mov qword [rbp - 0x60], rax
mov rax, qword [0x14008f560]
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x14003c265
mov rax, qword [0x14008f610]
lea rdx, [rbp + 0x5a0]
mov qword [rsp + 0x58], r15
mov r9d, 0x80000000
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov eax, dword [0x14008f28c]
mov ecx, 0xa080080
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14008f320], rax
test rax, rax
je 0x14003c265
cmp dword [0x14008f400], 2
jge 0x14003c0ec
mov qword [rsp + 0x28], r15
lea r8, [0x14003adf0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x14008f320]
xor r9d, r9d
mov r8d, 0x3e8
mov qword [0x14008f580], rax
lea edx, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [0x14008f320]
xor r9d, r9d
mov edx, 0x46b
mov r8d, 0x1f4
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.14002a220
mov r11d, dword [0x14008f278]
mov r10d, eax
mov r9d, dword [0x14008f2f4]
mov ecx, r11d
mov r8d, dword [0x14008f47c]
mov ebx, dword [0x14008f288]
mov edx, ebx
imul ecx, r8d
mov dword [0x14008f270], eax
mov dword [rsp + 0x30], 0x4000
sub edx, ecx
imul ecx, r11d, 0x22
sub edx, r9d
sub edx, eax
mov eax, ebx
sub eax, ecx
sub eax, r9d
cmp eax, edx
mov eax, r11d
mov edx, 1
cmovl r8d, r15d
imul ecx, r11d, 0x78
imul eax, r8d
mov dword [0x14008f47c], r8d
sub ebx, eax
mov eax, dword [0x14008f28c]
sub ebx, r9d
mov dword [rsp + 0x28], eax
mov r9d, dword [0x14008f294]
sub ebx, r10d
mov dword [rsp + 0x20], ecx
mov r8d, ebx
mov rcx, qword [0x14008f320]
mov dword [0x14008f274], ebx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14008f320]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x14008f320]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x14002d8e0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f598], rax
call fcn.140030820
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14003c265
nop dword [rax + rax]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x14008f430], 1
jne 0x14003c16c
cmp dword [0x14008f434], r15d
mov dword [0x14008f430], r15d
jne 0x14003c16c
mov qword [rsp + 0x28], r15
lea r8, [0x14002d760]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f434], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f570], rax
cmp dword [0x14008f460], 1
jne 0x14003c1b4
cmp dword [0x14008f464], r15d
mov dword [0x14008f460], r15d
jne 0x14003c1b4
mov qword [rsp + 0x28], r15
lea r8, [0x140017730]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f464], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f588], rax
cmp dword [0x14008f438], 1
jne 0x14003c1fc
cmp dword [0x14008f45c], r15d
mov dword [0x14008f438], r15d
jne 0x14003c1fc
mov qword [rsp + 0x28], r15
lea r8, [0x14002d6e0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f45c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f578], rax
cmp dword [0x14008f468], 1
jne 0x14003c244
cmp dword [0x14008f46c], r15d
mov dword [0x14008f468], r15d
jne 0x14003c244
mov qword [rsp + 0x28], r15
lea r8, [0x14002c680]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f46c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f590], rax
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14003c110
jmp 0x14003c265
call fcn.14002ffd0
xor eax, eax
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14003e210
mov rbx, qword [rsp + 0x8f8]
add rsp, 0x8c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret