Function at 0x14003b3f0
Capabilities:
Create thread
Get session user name
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x14007b658]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r14, rcx
mov rdi, r8
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp eax, 0x400
jne 0x14003ba70
call fcn.14001f4d0
cmp eax, 1
je 0x14003ba70
cmp dword [0x14008e3ec], 1
jne 0x14003ba70
xor edx, edx
lea rcx, [rbp + 0xd0]
mov r8d, 0x4d0
call fcn.14003f490
mov dword [rbp + 0x100], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14003b4cb
cmp qword [rbp + 0x118], 0
jne 0x14003ba70
cmp qword [rbp + 0x120], 0
jne 0x14003ba70
cmp qword [rbp + 0x128], 0
jne 0x14003ba70
cmp qword [rbp + 0x130], 0
jne 0x14003ba70
call fcn.140018860
call fcn.140017ba0
cmp dword [0x14008e3ec], 2
jne 0x14003ba70
call fcn.1400248d0
cmp dword [0x14008e35c], 5
jb 0x14003ba75
cmp dword [0x14008e3ec], 3
jne 0x14003ba70
call fcn.1400187c0
mov qword [0x14008e588], r14
call fcn.140036630
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14003b520
test rax, rax
je 0x14003b537
mov rcx, rdi
call fcn.14002b780
xor r15d, r15d
cmp dword [0x1400761a0], 1
mov esi, r15d
jne 0x14003b54d
call fcn.140018c50
mov esi, eax
mov edx, 0x16
lea rcx, [0x140088768]
call fcn.14000a780
mov rcx, rax
call fcn.14000fc20
lea rcx, str.User32
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140086b70], rax
test rax, rax
je 0x14003b590
call rax
cmp dword [0x14008e3ec], 4
jne 0x14003ba70
mov ebx, 0xdc
lea rcx, [rbp - 0x10]
mov r8d, ebx
xor edx, edx
call fcn.14003f490
lea r8, [rbp - 0x10]
mov dword [rbp + 0x34], ebx
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov eax, dword [rbp + 0x9c]
mov ecx, dword [rbp + 0xa0]
mov dword [0x14008e270], eax
mov eax, dword [rbp + 0xa8]
mov dword [0x14008e278], eax
mov dword [0x14008e274], ecx
test esi, esi
jne 0x14003b614
mov eax, dword [0x140076104]
cmp ecx, 0x438
mov edx, 0xb
cmovg eax, edx
cmp ecx, 0x5a0
mov edx, 0xc
cmovg eax, edx
mov dword [0x140076104], eax
inc dword [0x14008e3ec]
call fcn.140019ee0
xor edx, edx
lea rcx, [rbp + 0x5a0]
mov r8d, 0x208
call fcn.14003f490
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x100
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [0x14008eb28]
mov word [0x14008eb3c], r15w
mov edx, 0x103
mov word [rbp + 0x7a0], r15w
lea rcx, [rbp + 0x5a0]
call fcn.14004460c
lea r9, [rbp + 0x5a0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov qword [0x14008e5f8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x14008e5f8], r15
je 0x14003b6c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003b6c5
lea rdx, [0x14008eb28]
mov rcx, rdi
call fcn.14003b3c0
test rax, rax
je 0x14003ba75
call fcn.1400278c0
cmp dword [0x14008e3ec], 6
je 0x14003b6f3
mov r9d, 1
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
call fcn.14002fa70
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 0x50
xorps xmm1, xmm1
mov qword [0x14008e538], rax
lea rax, [0x140038330]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, 0x7f00
mov qword [rsp + 0x68], rax
xor ecx, ecx
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x5a0]
mov qword [rbp - 0x60], rax
mov rax, qword [0x14008e538]
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x14003ba75
mov rax, qword [0x14008e588]
lea rdx, [rbp + 0x5a0]
mov qword [rsp + 0x58], r15
mov r9d, 0x80000000
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov eax, dword [0x14008e274]
mov ecx, 0xa080080
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14008e2f8], rax
test rax, rax
je 0x14003ba75
cmp dword [0x14008e3dc], 2
jge 0x14003b8fe
cmp byte [0x140076180], 1
jne 0x14003b81c
mov qword [rsp + 0x28], r15
lea r8, [0x14003a8e0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008e550], rax
mov rax, qword [0x14008e2f8]
xor r9d, r9d
mov r8d, 0x3e8
mov rcx, rax
lea edx, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [0x14008e2f8]
xor r9d, r9d
mov edx, 0x46b
mov r8d, 0x1f4
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.140029cf0
mov ecx, dword [0x14008e5ec]
mov edx, 1
mov r8d, dword [0x14008e270]
add ecx, 9
imul ecx, dword [0x14008e260]
mov r9d, dword [0x14008e2d0]
mov dword [0x14008d964], eax
mov dword [rsp + 0x30], r15d
sub r8d, ecx
imul ecx, dword [0x14008e260], 0x78
sub r8d, eax
mov eax, dword [0x14008e274]
mov dword [rsp + 0x28], eax
mov dword [0x14008e27c], r8d
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x14008e2f8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14008e2f8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x14008e2f8]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x14002d4c0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008e568], rax
call fcn.1400302c0
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14003ba75
nop dword [rax]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x14008e3e0], 1
jne 0x14003b97c
cmp dword [0x14008e3e4], r15d
mov dword [0x14008e3e0], r15d
jne 0x14003b97c
mov qword [rsp + 0x28], r15
lea r8, [0x14002d340]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008e3e4], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008e540], rax
cmp dword [0x14008e410], 1
jne 0x14003b9c4
cmp dword [0x14008e414], r15d
mov dword [0x14008e410], r15d
jne 0x14003b9c4
mov qword [rsp + 0x28], r15
lea r8, [0x140017300]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008e414], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008e558], rax
cmp dword [0x14008e3e8], 1
jne 0x14003ba0c
cmp dword [0x14008e40c], r15d
mov dword [0x14008e3e8], r15d
jne 0x14003ba0c
mov qword [rsp + 0x28], r15
lea r8, [0x14002d2c0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008e40c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008e548], rax
cmp dword [0x14008e418], 1
jne 0x14003ba54
cmp dword [0x14008e41c], r15d
mov dword [0x14008e418], r15d
jne 0x14003ba54
mov qword [rsp + 0x28], r15
lea r8, [0x14002c260]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008e41c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008e560], rax
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14003b920
jmp 0x14003ba75
call fcn.14002fa70
xor eax, eax
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14003da20
mov rbx, qword [rsp + 0x8f8]
add rsp, 0x8c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret