Function at 0x411abc
Capabilities:
Create process on windows
Hide graphical window
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4124a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [0x4175e4]
mov edx, dword [0x418b28]
mov bl, byte [edx + eax]
cmp bl, 2
sete dl
mov eax, dword [esi + 0xe4]
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
jbe 0x411b16
cmp bl, 9
jb 0x411b1a
xor eax, eax
jmp 0x411b1c
mov al, 1
mov byte [ebp - 1], al
mov eax, dword [esi + 0x20]
mov dl, byte [ebp - 1]
call fcn.00405844
mov eax, dword [esi + 0x30]
mov dl, byte [ebp - 1]
call fcn.00405844
cmp byte [0x4175e4], 0
seta dl
mov eax, dword [esi + 0x30]
call fcn.004097cc
mov eax, dword [esi + 0xa4]
mov dl, byte [ebp - 1]
call fcn.00405844
mov eax, dword [esi + 0xa8]
mov dl, byte [ebp - 1]
call fcn.00405844
cmp byte [ebp - 1], 0
je 0x411bc4
mov eax, dword [esi + 0x18]
call fcn.0040a31c
mov edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040a2bc
sub edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040a31c
mov edx, edi
sub edx, eax
sub edx, 0x14
mov eax, dword [esi + 0xa4]
call fcn.0040a328
mov eax, dword [esi + 0xa8]
call fcn.0040a2bc
mov edi, eax
mov eax, dword [esi + 0xa8]
call fcn.0040a31c
add edi, eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.0040a2c8
cmp bl, 0xa
jae 0x411bf7
xor edi, edi
xor eax, eax
mov al, bl
cmp edi, eax
je 0x411be1
mov eax, esi
mov edx, edi
call fcn.00411a20
call fcn.00405854
inc edi
cmp edi, 0xa
jne 0x411bcb
xor edx, edx
mov dl, bl
mov eax, esi
call fcn.00411a20
call fcn.0040a05c
xor eax, eax
mov al, bl
cmp eax, 0xa
ja case.default.0x411c04
jmp dword [eax*4 + 0x411c0b]
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x24]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x418b14]
mov edx, 0xffffff
call fcn.0040a370
mov eax, dword [0x418b14]
mov dl, 1
call fcn.004072bc
mov eax, dword [esi + 0x34]
xor edx, edx
call fcn.004097cc
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0xd4]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0xd8]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x88]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x148]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x2c]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x38]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0xf8]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
push dword [eax + 0xac]
push 0x4124bc
lea edx, [ebp - 0x38]
mov eax, dword [esi + 0x48]
call fcn.004057fc
push dword [ebp - 0x38]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00401cb0
mov eax, 0x56
call fcn.00413ce0
test al, al
je 0x411ea9
mov eax, dword [esi + 0x9c]
call fcn.0040a768
test al, al
jne 0x411ea9
push dword [ebp - 0x10]
push 0x4124cc
mov eax, dword [0x41761c]
mov eax, dword [eax]
push dword [eax + 0xb0]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00401cb0
push dword [ebp - 0x10]
push 0x4124bc
lea edx, [ebp - 0x3c]
mov eax, dword [esi + 0x50]
call fcn.004057fc
push dword [ebp - 0x3c]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00401cb0
lea eax, [ebp - 0x14]
call fcn.00401a64
mov eax, 0x16
call fcn.00413ce0
test al, al
je 0x411f87
mov eax, dword [esi + 0x84]
call fcn.0040a768
test al, al
je 0x411f02
mov eax, dword [esi + 0x84]
call fcn.00409f04
test al, al
je 0x411f02
push 0x4124bc
mov eax, dword [0x41761c]
mov eax, dword [eax]
push dword [eax + 0x7c]
push 0x4124dc
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00401cb0
mov eax, dword [esi + 0x88]
call fcn.0040a768
test al, al
je 0x411f47
mov eax, dword [esi + 0x88]
call fcn.00409f04
test al, al
je 0x411f47
push dword [ebp - 0x14]
push 0x4124bc
mov eax, dword [0x41761c]
mov eax, dword [eax]
push dword [eax + 0x80]
push 0x4124dc
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00401cb0
mov eax, dword [esi + 0x8c]
call fcn.0040a768
test al, al
je 0x411f87
mov eax, dword [esi + 0x8c]
call fcn.00409f04
test al, al
je 0x411f87
push dword [ebp - 0x14]
push 0x4124bc
mov eax, dword [0x41761c]
mov eax, dword [eax]
push dword [eax + 0x84]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00401cb0
cmp dword [ebp - 0x14], 0
je 0x411fb2
push dword [ebp - 0x10]
push 0x4124cc
mov eax, dword [0x41761c]
mov eax, dword [eax]
push dword [eax + 0xb4]
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00401cb0
mov eax, dword [esi + 0xf8]
mov edx, dword [ebp - 0x10]
call fcn.00409ec8
jmp case.default.0x411c04
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0xf4]
mov eax, dword [esi + 0x24]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x44]
mov eax, dword [esi + 0x28]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x14]
mov eax, dword [esi + 0x68]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
mov eax, dword [esi + 0x34]
xor edx, edx
call fcn.004097cc
mov eax, dword [esi + 0x30]
xor edx, edx
call fcn.004097cc
call fcn.00411570
mov eax, dword [0x417654]
mov eax, dword [eax]
call fcn.0040a460
jmp case.default.0x411c04
mov eax, 0x27
call fcn.00413ce0
mov edx, eax
mov eax, dword [esi + 0xcc]
call fcn.00405844
mov eax, 0x4f
call fcn.00413ce0
mov edx, eax
mov eax, dword [esi + 0xd0]
call fcn.00405844
mov eax, 0x24
call fcn.00413ce0
mov edx, eax
mov eax, dword [esi + 0x100]
call fcn.00405844
mov eax, 0x34
call fcn.00413ce0
test al, al
je 0x412129
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x108]
mov eax, dword [esi + 0xf0]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x10c]
mov eax, dword [esi + 0xf4]
call fcn.00409ec8
mov eax, 0x34
call fcn.00413ce0
mov edx, eax
mov eax, dword [esi + 0xf0]
call fcn.00405844
mov eax, 0x34
call fcn.00413ce0
mov edx, eax
mov eax, dword [esi + 0xf4]
call fcn.00405844
mov eax, dword [esi + 0xf0]
mov edx, 0xffffff
call fcn.0040a370
mov eax, dword [esi + 0xf4]
mov edx, 0xffffff
call fcn.0040a370
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x13c]
mov eax, dword [esi + 0xc4]
call fcn.00409ec8
jmp 0x41213e
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov eax, dword [esi + 0xc4]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x18]
mov eax, dword [esi + 0xc0]
call fcn.00409ec8
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0xa4]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
mov eax, dword [esi + 0xc4]
mov edx, 0x41
call fcn.0040a350
mov eax, dword [esi + 0xd0]
mov edx, 0xffffff
call fcn.0040a370
mov eax, dword [esi + 0xcc]
mov edx, 0xffffff
call fcn.0040a370
mov eax, dword [esi + 0x100]
mov edx, 0xffffff
call fcn.0040a370
mov eax, dword [esi + 0xcc]
call fcn.00409f04
test al, al
jne 0x4121c7
mov eax, dword [esi + 0xd0]
mov edx, 0x98
call fcn.0040a2f8
mov eax, dword [esi + 0xd0]
call fcn.00409f04
test al, al
jne 0x4121e6
mov eax, dword [esi + 0x100]
mov edx, 0xb0
call fcn.0040a2f8
mov eax, dword [esi + 0xcc]
call fcn.00409f04
test al, al
jne 0x412214
mov eax, dword [esi + 0xd0]
call fcn.00409f04
test al, al
jne 0x412214
mov eax, dword [esi + 0x100]
mov edx, 0x98
call fcn.0040a2f8
mov eax, dword [esi + 0xcc]
call fcn.00409f04
test al, al
jne 0x412242
mov eax, dword [esi + 0xd0]
call fcn.00409f04
test al, al
je 0x412242
mov eax, dword [esi + 0x100]
mov edx, 0xb0
call fcn.0040a2f8
mov eax, dword [esi + 0x34]
mov dl, 1
call fcn.004097cc
mov eax, dword [esi + 0x34]
mov dl, 1
call fcn.004072bc
mov eax, dword [esi + 0x2c]
xor edx, edx
call fcn.004097cc
mov eax, dword [esi + 0xa8]
call fcn.00405854
jmp case.default.0x411c04
mov eax, dword [0x417658]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.00405854
mov eax, dword [esi + 0x18]
call fcn.00405854
push 0
mov eax, dword [0x417654]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x27
call fcn.00413ce0
test al, al
je 0x41230d
mov eax, dword [esi + 0xcc]
call fcn.0040a768
test al, al
je 0x41230d
lea ecx, [ebp - 0x10]
mov eax, dword [0x417664]
mov eax, dword [eax]
mov eax, dword [eax + 0xac]
xor edx, edx
call fcn.0040f01c
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x10]
call fcn.00403ee8
mov eax, dword [ebp - 0x40]
call fcn.00401de8
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 5
mov eax, dword [ebp - 0x10]
call fcn.00401de8
mov ebx, eax
push ebx
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x41230d
push 5
push 0
push 0
push ebx
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x4f
call fcn.00413ce0
test al, al
je 0x412372
mov eax, dword [esi + 0xd0]
call fcn.0040a768
test al, al
je 0x412372
lea ecx, [ebp - 0x10]
mov eax, dword [0x417664]
mov eax, dword [eax]
mov eax, dword [eax + 0xbc]
xor edx, edx
call fcn.0040f01c
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x10]
call fcn.00403ee8
mov eax, dword [ebp - 0x44]
call fcn.00401de8
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 5
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00401de8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x24
call fcn.00413ce0
test al, al
je 0x4123be
mov eax, dword [esi + 0x100]
call fcn.0040a768
test al, al
je 0x4123be
push 5
push 0
push 0
lea ecx, [ebp - 0x48]
mov eax, dword [0x417664]
mov eax, dword [eax]
mov eax, dword [eax + 0x94]
xor edx, edx
call fcn.0040f01c
mov eax, dword [ebp - 0x48]
call fcn.00401de8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x34
call fcn.00413ce0
test al, al
je 0x412446
mov eax, dword [esi + 0xf0]
call fcn.0040a768
test al, al
je 0x412446
call fcn.0040bf28
cmp al, 2
jbe 0x41243d
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x41243d
lea eax, [ebp - 0x20]
push eax
push 0x4124e0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x41243d
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
mov eax, 0x10
xor edx, edx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x34]
push edx
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 6
call sub.user32.dll_ExitWindowsEx
call fcn.0040195c
xor eax, eax
mov al, byte [0x4175e4]
mov edx, dword [0x418b28]
cmp byte [edx + eax + 1], 8
jne 0x412471
mov eax, dword [0x41761c]
mov eax, dword [eax]
mov edx, dword [eax + 0x68]
mov eax, dword [esi + 0x34]
call fcn.00409ec8
mov eax, dword [0x417654]
mov eax, dword [eax]
call fcn.0040a460
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4124ac
lea eax, [ebp - 0x48]
mov edx, 5
call fcn.00401a88
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00401a88
ret