Function at 0x30006190
Capabilities:
Accept command line arguments
Check os version
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x30215e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x300061ba
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x300061c3
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x28
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x300061ed
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x300061ed
push ebx
popfd
mov dword [0x3026ed74], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x3026ed74]
mov dword [ebp - 0x3f0], 0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x3f0]
push eax
push 0x18
lea eax, [ebp - 0x40c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x30240a4c]
test eax, eax
js 0x3000623f
cmp dword [ebp - 0x3f0], 0x18
jne 0x3000623f
mov ecx, dword [ebp - 0x3f8]
jmp 0x30006241
xor ecx, ecx
mov eax, dword [0x3026ed74]
mov dword [eax + 0xc], ecx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3000625d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30006266
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x104
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
mov dword [ebp - 0x3f4], edx
test ecx, ecx
je 0x3000629b
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3000629b
push ebx
popfd
mov eax, dword [0x3026ed74]
mov dword [eax], edx
mov edx, dword [0x3026d8a8]
mov ecx, edx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x300062b0
push 0
push 0
sub ecx, esi
push 0x104
push dword [ebp - 0x3f4]
sar ecx, 1
lea eax, [ecx + 1]
push eax
push edx
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x3026ed74]
mov ecx, dword [eax]
mov dword [eax + 0x24], 0x3026b488
mov al, byte [ecx]
test al, al
je 0x30006307
cmp al, 0xa
jl 0x300062fc
cmp al, 0x7e
jle 0x300062ff
mov byte [ecx], 0x3f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x300062f4
mov dword [0x3026ed70], 0
mov dword [0x3026ed3c], 0
call fcn.3001ec70
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x3026b2e8], 0
mov dword [0x3026ec90], eax
je 0x3000646b
mov ecx, eax
call fcn.30002650
mov ecx, dword [0x3026ec90]
mov edx, eax
call fcn.3001e9f0
cmp dword [0x3026b2e8], 0
je 0x3000646b
cmp dword [0x3026ed34], 0
je 0x3000646b
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [0x3026d8a8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x300063ab
push str.CAPE_init:_Unable_to_open_main_executable_image
call fcn.3000a0f0
mov ebx, dword [ebp - 0x3f4]
add esp, 4
mov esi, dword [ebp - 0x3f0]
jmp 0x30006447
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x300063d6
push str.CAPE_init:_Unable_to_get_size_of_main_executable_image
call fcn.3000a0f0
mov ebx, dword [ebp - 0x3f4]
add esp, 4
mov esi, dword [ebp - 0x3f0]
jmp 0x30006447
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x30006402
push str.CAPE_init:_Unable_to_create_file_mapping_of_main_executable_image
call fcn.3000a0f0
mov esi, dword [ebp - 0x3f0]
add esp, 4
jmp 0x30006447
push esi
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x30006425
push str.CAPE_init:_Unable_to_map_main_executable_image
call fcn.3000a0f0
add esp, 4
jmp 0x30006452
push esi
push str.CAPE_init:_Main_executable_image_temporarily_remapped_for_scanning_at_0x_p
call fcn.3000a0d0
mov ecx, dword [0x3026ec90]
add esp, 8
call fcn.30002650
mov edx, eax
mov ecx, esi
call fcn.3001e9f0
test esi, esi
je 0x30006452
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x3000645f
push ebx
call esi
test edi, edi
je 0x3000646b
cmp edi, 0xffffffff
je 0x3000646b
push edi
call esi
push 0x3026eca0
mov dword [0x3026eca0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x300064a2
push str.CAPE_init:_Failed_to_get_OS_version
call fcn.3000a0f0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
cmp dword [0x3026b2ec], 0
je 0x300065fa
cmp dword [0x3026eca4], 6
jne 0x300064c6
cmp dword [0x3026eca8], 1
ja 0x300064cc
jmp 0x300065fa
jbe 0x300065fa
mov eax, dword [0x30267724]
lea ecx, [ebp - 0x3ec]
push 0x104
push ecx
push eax
mov dword [0x30233b18], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jae 0x300065ed
push 0x28
lea eax, [ebp - 0x54]
push eax
push 0x301e02fc
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x300065ed
lea eax, [ebp - 0x54]
push eax
push str.SoftwareClassesCLSID_ls
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x300065ed
push str.AmsiDumper
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x300065ed
lea eax, [ebp - 0x54]
push eax
push str.SoftwareClassesCLSID_lsInProcServer32
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x300065ed
lea eax, [ebp - 0x3ec]
push eax
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x300065ed
push str.Both
push str.ThreadingModel
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x300065ed
lea eax, [ebp - 0x54]
push eax
push str.SoftwareMicrosoftAMSIProviders_ls
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x300065ed
push str.AmsiDumper
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x300065ed
push str.AmsiDumper_initialised._n
call fcn.3000a0d0
jmp 0x300065f7
push str.AmsiDumper:_Is_CAPE_agent_running_elevated__Initialisation_failed
call fcn.3000a0f0
add esp, 4
mov ecx, dword fs:[4]
mov eax, dword fs:[8]
push ecx
push eax
push dword [0x3026ec90]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x3026ed74]
push dword [0x30267724]
push dword [eax + 8]
push str.Monitor_initialised:_32_bit_capemon_loaded_in_process__d_at_0x_x__thread__d__image_base_0x_x__stack_from_0x_x_0x_x_n
call fcn.3000a0d0
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str.Commandline:__s_n
call fcn.3000a0d0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret