Function at 0x409f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55467c
mov eax, dword fs:[0]
push eax
mov eax, 0x1164
call fcn.004e6af0
mov eax, dword [0x5b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1170], ecx
lea ecx, [ebp - 0x1148]
mov dword [ebp - 0x1150], 0
call fcn.0045d0b0
mov eax, dword [ebp - 0x1144]
cmp eax, 6
ja 0x409ff9
jne 0x409ff2
cmp dword [ebp - 0x1140], 2
jae 0x409ff9
xor al, al
jmp 0x40a386
call fcn.00408f40
test al, al
je 0x409ff2
lea ecx, [ebp - 0x102c]
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0x102c], 0
call fcn.00457870
mov dword [ebp - 4], 0
xor eax, eax
push 0xf
mov dword [ebp - 0x1158], 0
lea ecx, [ebp - 0x1168]
mov dword [ebp - 0x1154], 0
push str.ModifyHiberboot
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
call fcn.00403570
mov byte [ebp - 4], 1
xor eax, eax
push 0x17
mov dword [ebp - 0x1018], 0
lea ecx, [ebp - 0x1028]
mov dword [ebp - 0x1014], 0
push str.SOFTWARE2345SafeCenter
mov dword [ebp - 0x1150], 1
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
call fcn.00403570
mov dword [ebp - 4], 2
lea eax, [ebp - 0x116c]
push eax
lea eax, [ebp - 0x1168]
mov dword [ebp - 0x1150], 3
push eax
lea eax, [ebp - 0x1028]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.004580f0
test al, al
je 0x40a102
cmp dword [ebp - 0x116c], 1
mov byte [ebp - 0x1149], 0
je 0x40a109
mov byte [ebp - 0x1149], 1
mov dword [ebp - 4], 1
mov esi, 3
mov dword [ebp - 0x1150], esi
and esi, 0xfffffffd
mov dword [ebp - 0x1150], esi
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a164
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a15a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a767
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov dword [ebp - 4], eax
and esi, 0xfffffffe
mov dword [ebp - 0x1150], esi
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40a1cd
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a1c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a76c
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
cmp byte [ebp - 0x1149], al
jne 0x40a358
movups xmm0, xmmword [str._c_powercfg__h_on]
mov eax, dword [0x583f20]
push 0xfdc
movups xmmword [ebp - 0x1010], xmm0
mov dword [ebp - 0xff0], eax
lea eax, [ebp - 0xfec]
movups xmm0, xmmword [0x583f10]
push 0
push eax
movups xmmword [ebp - 0x1000], xmm0
call fcn.00500e00
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0
push 0
push eax
push str.cmd.exe
push 0x583f34
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov ecx, 0x5b82b4
cmp edi, 0x20
jg 0x40a3a1
push 2
call fcn.004a6900
mov esi, eax
test esi, esi
je 0x40a358
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1010]
push edi
push eax
lea eax, [ebp - 0x1028]
push 0x583f38
push eax
call fcn.004a6f10
add esp, 0x10
lea eax, [ebp - 0x1028]
mov ecx, 0x5b82b4
push 0x5b
push str.RC::RCHiberbootFlag::Restore
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectprotectsdk_srcprotectlogistics_srcutils_rchiberbootflag.cpp
push eax
push 2
call fcn.004a6970
cmp esi, 1
jbe 0x40a2f7
lea eax, [ebp - 0x1028]
mov ecx, 0x5b82b4
push eax
call fcn.004a6d20
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a33b
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a331
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a771
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov byte [ebp - 0x1149], 0
mov dword [ebp - 4], 0xffffffff
push 8
push dword [ebp - 0x102c]
call fcn.004e566f
mov al, byte [ebp - 0x1149]
add esp, 8
mov dword [ebp - 0x102c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e562e
mov esp, ebp
pop ebp
ret
push 4
call fcn.004a6900
mov esi, eax
test esi, esi
je 0x40a498
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1028]
push 0x584094
push eax
call fcn.004a6f10
add esp, 0xc
lea eax, [ebp - 0x1028]
mov ecx, 0x5b82b4
push 0x5f
push str.RC::RCHiberbootFlag::Restore
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectprotectsdk_srcprotectlogistics_srcutils_rchiberbootflag.cpp
push eax
push 4
call fcn.004a6970
cmp esi, 1
jbe 0x40a437
lea eax, [ebp - 0x1028]
mov ecx, 0x5b82b4
push eax
call fcn.004a6d20
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a47b
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a471
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a776
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
push str.HiberbootEnabled
lea ecx, [ebp - 0x1028]
call fcn.004032e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1168]
push str.SystemCurrentControlSetControlSession_ManagerPower
call fcn.004032e0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1028]
push 1
push eax
lea eax, [ebp - 0x1168]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.004581f0
test al, al
sete byte [ebp - 0x1149]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40a529
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a51f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a77b
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a589
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a57f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a780
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
cmp byte [ebp - 0x1149], al
jne 0x40a358
push str.SYSTEMCurrentControlSetControlPower
lea ecx, [ebp - 0x1168]
call fcn.004032e0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1168]
push 1
push dword [ebp - 0x1170]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.004581f0
test al, al
sete al
mov byte [ebp - 0x1149], al
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40a636
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a626
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a785
push edx
push ecx
call fcn.004e566f
mov al, byte [ebp - 0x1149]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], cx
test al, al
jne 0x40a358
push str.ModifyHiberboot
lea ecx, [ebp - 0x1028]
call fcn.004032e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1168]
push str.SOFTWARE2345SafeCenter
call fcn.004032e0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x1028]
push 0
push eax
lea eax, [ebp - 0x1168]
push eax
push ecx
lea ecx, [ebp - 0x102c]
call fcn.004581f0
mov byte [ebp - 0x1149], al
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1154]
cmp edx, 8
jb 0x40a6e9
mov ecx, dword [ebp - 0x1168]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a6df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a78a
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1154], 7
mov word [ebp - 0x1168], ax
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x40a745
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a73b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a78f
push edx
push ecx
call fcn.004e566f
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
jmp 0x40a35f
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
call fcn.0050ac18
int3