Function at 0x14003ba20
Capabilities:
Create thread
Get session user name
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r14, rcx
mov rdi, r8
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp eax, 0x400
jne 0x14003c091
call fcn.14001f760
cmp eax, 1
je 0x14003c091
cmp dword [0x14008f3fc], 1
jne 0x14003c091
xor edx, edx
lea rcx, [rbp + 0xd0]
mov r8d, 0x4d0
call fcn.14003fab0
mov dword [rbp + 0x100], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14003bafb
cmp qword [rbp + 0x118], 0
jne 0x14003c091
cmp qword [rbp + 0x120], 0
jne 0x14003c091
cmp qword [rbp + 0x128], 0
jne 0x14003c091
cmp qword [rbp + 0x130], 0
jne 0x14003c091
call fcn.140018af0
call fcn.140017e30
cmp dword [0x14008f3fc], 2
jne 0x14003c091
call fcn.140024b60
cmp dword [0x14008f36c], 5
jb 0x14003c096
cmp dword [0x14008f3fc], 3
jne 0x14003c091
call fcn.140018a50
mov qword [0x14008f598], r14
call fcn.1400369e0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14003bb50
test rax, rax
je 0x14003bb67
mov rcx, rdi
call fcn.14002ba10
xor r15d, r15d
cmp dword [0x1400771b0], 1
mov esi, r15d
jne 0x14003bb7d
call fcn.140018ee0
mov esi, eax
mov edx, 0x16
lea rcx, [0x140089778]
call fcn.14000a780
mov rcx, rax
call fcn.14000fe30
lea rcx, str.User32
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140087b80], rax
test rax, rax
je 0x14003bbc0
call rax
cmp dword [0x14008f3fc], 4
jne 0x14003c091
mov ebx, 0xdc
lea rcx, [rbp - 0x10]
mov r8d, ebx
xor edx, edx
call fcn.14003fab0
lea r8, [rbp - 0x10]
mov dword [rbp + 0x34], ebx
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov eax, dword [rbp + 0x9c]
mov ecx, dword [rbp + 0xa0]
mov dword [0x14008f280], eax
mov eax, dword [rbp + 0xa8]
mov dword [0x14008f288], eax
mov dword [0x14008f284], ecx
test esi, esi
jne 0x14003bc44
mov eax, dword [0x140077114]
cmp ecx, 0x438
mov edx, 0xb
cmovg eax, edx
cmp ecx, 0x5a0
mov edx, 0xc
cmovg eax, edx
mov dword [0x140077114], eax
inc dword [0x14008f3fc]
call fcn.14001a170
xor edx, edx
lea rcx, [rbp + 0x5a0]
mov r8d, 0x208
call fcn.14003fab0
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x100
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [0x140091fb8]
mov word [0x140091fcc], r15w
mov edx, 0x103
mov word [rbp + 0x7a0], r15w
lea rcx, [rbp + 0x5a0]
call fcn.140044c2c
lea r9, [rbp + 0x5a0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov qword [0x14008f608], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x14008f608], r15
je 0x14003bcf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003bcf5
lea rdx, [0x140091fb8]
mov rcx, rdi
call fcn.14003b9f0
test rax, rax
je 0x14003c096
call fcn.140027b50
cmp dword [0x14008f3fc], 6
je 0x14003bd23
mov r9d, 1
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
call fcn.14002fe30
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 0x50
xorps xmm1, xmm1
mov qword [0x14008f548], rax
lea rax, [0x1400386e0]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, 0x7f00
mov qword [rsp + 0x68], rax
xor ecx, ecx
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x5a0]
mov qword [rbp - 0x60], rax
mov rax, qword [0x14008f548]
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x14003c096
mov rax, qword [0x14008f598]
lea rdx, [rbp + 0x5a0]
mov qword [rsp + 0x58], r15
mov r9d, 0x80000000
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov eax, dword [0x14008f284]
mov ecx, 0xa080080
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14008f308], rax
test rax, rax
je 0x14003c096
cmp dword [0x14008f3ec], 2
jge 0x14003bf22
mov qword [rsp + 0x28], r15
lea r8, [0x14003ac60]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x14008f308]
xor r9d, r9d
mov r8d, 0x3e8
mov qword [0x14008f560], rax
lea edx, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [0x14008f308]
xor r9d, r9d
mov edx, 0x46b
mov r8d, 0x1f4
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.140029f80
mov ecx, dword [0x14008f5fc]
mov edx, 1
mov r8d, dword [0x14008f280]
add ecx, 9
imul ecx, dword [0x14008f270]
mov r9d, dword [0x14008f2e0]
mov dword [0x14008e974], eax
mov dword [rsp + 0x30], r15d
sub r8d, ecx
imul ecx, dword [0x14008f270], 0x78
sub r8d, eax
mov eax, dword [0x14008f284]
mov dword [rsp + 0x28], eax
mov dword [0x14008f28c], r8d
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x14008f308]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14008f308]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x14008f308]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x14002d750]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f578], rax
call fcn.140030680
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14003c096
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x14008f3f0], 1
jne 0x14003bf9d
cmp dword [0x14008f3f4], r15d
mov dword [0x14008f3f0], r15d
jne 0x14003bf9d
mov qword [rsp + 0x28], r15
lea r8, [0x14002d5d0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f3f4], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f550], rax
cmp dword [0x14008f420], 1
jne 0x14003bfe5
cmp dword [0x14008f424], r15d
mov dword [0x14008f420], r15d
jne 0x14003bfe5
mov qword [rsp + 0x28], r15
lea r8, [0x140017590]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f424], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f568], rax
cmp dword [0x14008f3f8], 1
jne 0x14003c02d
cmp dword [0x14008f41c], r15d
mov dword [0x14008f3f8], r15d
jne 0x14003c02d
mov qword [rsp + 0x28], r15
lea r8, [0x14002d550]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f41c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f558], rax
cmp dword [0x14008f428], 1
jne 0x14003c075
cmp dword [0x14008f42c], r15d
mov dword [0x14008f428], r15d
jne 0x14003c075
mov qword [rsp + 0x28], r15
lea r8, [0x14002c4f0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14008f42c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14008f570], rax
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14003bf41
jmp 0x14003c096
call fcn.14002fe30
xor eax, eax
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14003e040
mov rbx, qword [rsp + 0x8f8]
add rsp, 0x8c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret