Function at 0x650a0c
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x650a14
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x650e78
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x650e53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6d80f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x458]
cmp byte [eax + 0x44], 0
je 0x650a5c
push 1
push 0x650e88
call sub.winmm.dll_sndPlaySoundW
lea edx, [ebp - 0xc]
mov eax, dword [0x6d8488]
mov eax, dword [eax]
call fcn.00600ed8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00426df8
mov edx, dword [ebp - 8]
mov eax, dword [0x6d80ec]
mov ecx, 0x650eac
call fcn.0040b530
mov eax, dword [0x6d80ec]
mov eax, dword [eax]
call fcn.0040b2c4
push eax
push 0
call sub.user32.dll_FindWindowW
mov edx, dword [0x6d8450]
mov dword [edx], eax
mov eax, dword [0x6d7e4c]
cmp byte [eax], 0
jne 0x650d39
mov eax, dword [ebp - 4]
call fcn.006508cc
mov eax, dword [0x6df648]
cmp byte [eax + 0x215], 0
jne 0x650ad0
mov eax, dword [ebp - 4]
call fcn.005fb4c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e8]
mov edx, 0x650ed0
call fcn.0053f144
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, 0x650eec
call fcn.0053f144
mov eax, 0x3e8
call fcn.0064a0b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, 0x650efc
call fcn.0053f144
mov eax, 0x3e8
call fcn.0064a0b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, 0x650f0c
call fcn.0053f144
mov eax, 0x3e8
call fcn.0064a0b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov dl, 1
call fcn.0057e68c
mov eax, dword [0x6d80f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x130]
test eax, eax
jne 0x650b90
mov eax, dword [0x6df648]
mov eax, dword [eax + 0x58]
add eax, 0xc
push eax
mov eax, dword [0x6df648]
mov eax, dword [eax + 0x5c]
add eax, 0x1b
push eax
mov ecx, 0xffffffeb
mov edx, 0xfffffffa
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc8]
mov eax, dword [0x6df648]
call fcn.005f5c80
add eax, 6
lea edx, [ebp - 0x10]
call fcn.00425ff8
mov edx, dword [ebp - 0x10]
mov eax, 0x6df64c
call fcn.0040aa0c
mov eax, dword [0x6df648]
call fcn.005f5ca0
add eax, 0x15
lea edx, [ebp - 0x14]
call fcn.00425ff8
mov edx, dword [ebp - 0x14]
mov eax, 0x6df650
call fcn.0040aa0c
lea edx, [ebp - 0x18]
mov eax, dword [0x6df648]
mov eax, dword [eax + 0x58]
sub eax, 0xc
call fcn.00425ff8
mov edx, dword [ebp - 0x18]
mov eax, 0x6df654
call fcn.0040aa0c
lea edx, [ebp - 0x1c]
mov eax, dword [0x6df648]
mov eax, dword [eax + 0x5c]
sub eax, 0x1b
call fcn.00425ff8
mov edx, dword [ebp - 0x1c]
mov eax, 0x6df658
call fcn.0040aa0c
call fcn.004292dc
mov eax, dword [0x6d8690]
fstp qword [eax]
wait
xor eax, eax
push ebp
push 0x650c4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
mov eax, dword [eax + 0x74]
mov edx, 0xffffff
call fcn.00512704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650c59
mov eax, dword [0x6df648]
mov eax, dword [eax + 0x3e4]
mov dl, 1
call fcn.0057e68c
lea edx, [ebp - 0x20]
mov eax, dword [0x6d80f8]
mov eax, dword [eax]
call fcn.006bb554
mov edx, dword [ebp - 0x20]
mov eax, dword [0x6d8540]
call fcn.0040aa0c
push 0
mov edx, dword [0x6d8518]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, 0x650f1c
call fcn.0040b530
mov eax, dword [ebp - 0x24]
call fcn.0040b2c4
push eax
push 0x650f2c
push dword [0x6df64c]
push 0x650fa4
push dword [0x6df650]
push 0x650fc8
push dword [0x6df654]
push 0x650ff0
push dword [0x6df658]
push 0x651000
mov eax, dword [0x6d8540]
push dword [eax]
push 0x65103c
lea eax, [ebp - 0x28]
mov edx, 0xb
call fcn.0040b5b8
mov eax, dword [ebp - 0x28]
call fcn.0040b2c4
push eax
mov eax, dword [0x6d80ec]
mov eax, dword [eax]
call fcn.0040b2c4
push eax
push 0x651048
mov eax, dword [0x6d8450]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x6d7e4c]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, 0x651060
call fcn.0053f144
jmp 0x650e49
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
xor edx, edx
call fcn.0057e68c
xor eax, eax
push ebp
push 0x650d97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6d80f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x130]
test eax, eax
jne 0x650d7a
mov eax, dword [0x6df648]
call fcn.00650910
mov eax, dword [0x6d8488]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650da1
mov eax, dword [0x6df648]
mov eax, dword [eax + 0x3e4]
xor edx, edx
call fcn.0057e68c
xor eax, eax
push ebp
push 0x650de1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d4]
mov eax, dword [eax + 0x74]
mov edx, 0x808080
call fcn.00512704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650deb
xor eax, eax
push ebp
push 0x650e16
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x10
mov eax, dword [0x6d8450]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650e20
mov eax, dword [0x6d7e4c]
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, 0x651078
call fcn.0053f144
mov eax, dword [0x6d80f8]
mov eax, dword [eax]
xor edx, edx
call fcn.006ba734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650e5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650e7f
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.0040a68c
ret