Function at 0x102c2d5
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x84
push 0x103a270
call fcn.01034b08
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_HeapSetInformation]
push 0x8001
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetErrorMode]
mov esi, 0x103d540
push esi
call fcn.0102bd78
mov dword [0x103d560], 0x1007dc8
mov dword [section..data], esi
push 0x1007f94
call fcn.0102be49
mov eax, dword [section..data]
cmp eax, section..data
je 0x102c366
test dword [eax + 0x1c], 0x10000000
je 0x102c366
push 0x1007cb8
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102bcb9
push 0x103d060
push 0x103d068
push 0x102bc05
push 0x1007cc8
call fcn.0102bc5c
call fcn.010358bf
test eax, eax
jne 0x102c396
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x102c8f6
call fcn.01031514
test eax, eax
je 0x102c3ab
mov dword [ebp - 0x1c], 0xe0000235
jmp 0x102c8f6
call dword [sym.imp.SETUPAPI.dll_SetupGetNonInteractiveMode]
test eax, eax
jne 0x102c3c1
mov dword [ebp - 0x1c], 5
jmp 0x102c8f6
call fcn.01035d7f
test eax, eax
je 0x102c3b5
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
push ebx
push 0x18
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, ebx
jge 0x102c3f1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x102c38e
cmp dword [ebp - 0x58], ebx
je 0x102c8ef
cmp dword [ebp - 0x58], 0xffffffff
je 0x102c8ef
push dword [ebp - 0x58]
push ebx
push 0x40
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_OpenProcess]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x102c388
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebx
jne 0x102c431
mov dword [ebp - 0x1c], 0x57
jmp 0x102c8f6
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x102c458
test byte [ecx + 0x1c], 1
je 0x102c458
push eax
push 0x1007cb8
push 0xb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102bd0b
cmp dword [ebp + 8], 2
jl 0x102c425
lea eax, [ebp - 0x38]
push eax
mov ebx, 0x1007f8c
push ebx
mov edi, dword [ebp + 0xc]
push dword [edi + 4]
mov esi, dword [sym.imp.msvcrt.dll_swscanf]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c48c
mov dword [ebp - 0x1c], 0x57
xor ebx, ebx
jmp 0x102c8f6
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
test eax, eax
jle 0x102c8a8
cmp eax, 3
jle 0x102c688
cmp eax, 5
jle 0x102c4bf
cmp eax, 6
jne 0x102c8a8
call fcn.01034087
mov dword [ebp - 0x1c], eax
jmp 0x102c8af
cmp dword [ebp + 8], 2
jle 0x102c4d7
lea eax, [ebp - 0x28]
push eax
push ebx
push dword [edi + 8]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c4db
and dword [ebp - 0x28], 0
cmp dword [ebp + 8], 4
jle 0x102c4f7
lea eax, [ebp - 0x3c]
push eax
push 0x1007f84
push dword [edi + 0x10]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c4fe
mov dword [ebp - 0x3c], 0xffff
cmp dword [ebp + 8], 5
jle 0x102c51a
lea eax, [ebp - 0x54]
push eax
push 0x1007f78
push dword [edi + 0x14]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c522
and dword [ebp - 0x54], 0
and dword [ebp - 0x50], 0
cmp dword [ebp + 8], 6
jle 0x102c53e
lea eax, [ebp - 0x4c]
push eax
push 0x1007f78
push dword [edi + 0x18]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c546
or dword [ebp - 0x4c], 0xffffffff
or dword [ebp - 0x48], 0xffffffff
mov ebx, dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
test ebx, ebx
je 0x102c5bf
push 2
push 0
push 0
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentProcess]
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x102c719
cmp dword [ebp + 8], 8
jle 0x102c58c
lea eax, [ebp - 0x4c]
push eax
push 0x1007f78
push dword [edi + 0x20]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c594
and dword [ebp - 0x4c], 0
and dword [ebp - 0x48], 0
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x102c5d4
push 2
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentProcess]
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle]
test eax, eax
jne 0x102c5d8
jmp 0x102c719
push eax
push 0x2000000
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_OpenProcessToken]
jmp 0x102c568
and dword [ebp - 0x2c], 0
mov ebx, dword [ebp + 8]
cmp ebx, 9
jle 0x102c5f6
lea eax, [ebp - 0x30]
push eax
push 0x1007f8c
push dword [edi + 0x24]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c5fd
xor esi, esi
mov dword [ebp - 0x30], esi
jmp 0x102c5ff
xor esi, esi
cmp dword [ebp - 0x2c], esi
je 0x102c62f
push dword [ebp - 0x30]
push esi
push esi
push 0xf001f
push dword [ebp - 0x2c]
call dword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x34], esi
je 0x102c719
shr dword [ebp - 0x30], 1
cmp ebx, 0xa
jle 0x102c643
mov eax, dword [edi + 0x28]
cmp word [eax], si
je 0x102c643
mov ecx, eax
jmp 0x102c645
xor ecx, ecx
cmp ebx, 3
jle 0x102c652
mov eax, dword [edi + 0xc]
cmp word [eax], si
jne 0x102c654
xor eax, eax
cmp ebx, 7
jle 0x102c661
mov edi, dword [edi + 0x1c]
cmp word [edi], si
jne 0x102c663
xor edi, edi
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x3c]
push ecx
push eax
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x38]
call fcn.0102cfc9
jmp 0x102c4b7
cmp dword [ebp + 8], 2
jle 0x102c6a0
lea eax, [ebp - 0x28]
push eax
push ebx
push dword [edi + 8]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c6a4
and dword [ebp - 0x28], 0
cmp dword [ebp + 8], 6
jle 0x102c6c0
lea eax, [ebp - 0x54]
push eax
push 0x1007f78
push dword [edi + 0x18]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c6c8
and dword [ebp - 0x54], 0
and dword [ebp - 0x50], 0
cmp dword [ebp + 8], 7
jle 0x102c6e4
lea eax, [ebp - 0x4c]
push eax
push 0x1007f78
push dword [edi + 0x1c]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c6ec
or dword [ebp - 0x4c], 0xffffffff
or dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
mov ebx, dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentProcess]
test eax, eax
lea eax, [ebp - 0x20]
je 0x102c724
push 2
push 0
push 0
push eax
call ebx
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle]
test eax, eax
jne 0x102c735
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
jmp 0x102c4b7
push eax
push 0x2000000
call ebx
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_OpenProcessToken]
jmp 0x102c715
cmp dword [ebp + 8], 8
jle 0x102c751
lea eax, [ebp - 0x4c]
push eax
push 0x1007f6c
push dword [edi + 0x20]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c759
or dword [ebp - 0x4c], 0xffffffff
or dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x102c8a8
push 2
push 0
push 0
push 0x103d0a4
call ebx
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x102c719
cmp dword [ebp + 8], 9
jle 0x102c7a1
lea eax, [ebp - 0x4c]
push eax
push 0x1007f6c
push dword [edi + 0x24]
call esi
add esp, 0xc
cmp eax, 1
je 0x102c7a9
or dword [ebp - 0x4c], 0xffffffff
or dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
xor esi, esi
cmp eax, esi
je 0x102c8a8
push 2
push esi
push esi
push 0x103d0a0
call ebx
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x102c719
push esi
push esi
push esi
push esi
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
mov dword [0x103d09c], eax
cmp eax, esi
je 0x102c719
call fcn.01032cf0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x94], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x90], ecx
cmp dword [ebp + 8], 3
jle 0x102c815
mov ecx, dword [edi + 0xc]
cmp word [ecx], si
jne 0x102c817
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
cmp dword [ebp + 8], 4
jle 0x102c82b
mov ecx, dword [edi + 0x10]
cmp word [ecx], si
jne 0x102c82d
xor ecx, ecx
mov dword [ebp - 0x88], ecx
cmp dword [ebp + 8], 5
jle 0x102c841
mov edi, dword [edi + 0x14]
cmp word [edi], si
jne 0x102c843
xor edi, edi
mov dword [ebp - 0x84], edi
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x74], ecx
push eax
lea eax, [ebp - 0x94]
push eax
push 0x102bedc
call fcn.0102bf50
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x102c8af
test dword [ebp - 0x28], 0x200
jne 0x102c8af
cmp eax, 0x5b4
jne 0x102c888
call ebx
jmp 0x102c88a
xor eax, eax
push esi
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x84]
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
call fcn.0102c08b
jmp 0x102c8af
mov dword [ebp - 0x1c], 0x57
mov dword [ebp - 4], 0xfffffffe
jmp 0x102c485
mov dword [ebp - 0x1c], 0xd
cmp dword [ebp - 0x34], ebx
je 0x102c904
push dword [ebp - 0x34]
call dword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
cmp dword [ebp - 0x20], ebx
je 0x102c914
push dword [ebp - 0x20]
call esi
mov eax, dword [0x103d0a4]
cmp eax, ebx
je 0x102c920
push eax
call esi
mov eax, dword [0x103d0a0]
cmp eax, ebx
je 0x102c92c
push eax
call esi
mov eax, dword [0x103d09c]
cmp eax, ebx
je 0x102c938
push eax
call esi
cmp dword [ebp - 0x24], ebx
je 0x102c942
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x1c], ebx
jne 0x102c968
mov eax, dword [section..data]
mov esi, section..data
cmp eax, esi
je 0x102c991
test dword [eax + 0x1c], 0x40000
je 0x102c991
push ebx
push 0x1007cb8
push 0xc
jmp 0x102c986
mov eax, dword [section..data]
mov esi, section..data
cmp eax, esi
je 0x102c991
test byte [eax + 0x1c], 1
je 0x102c991
push dword [ebp - 0x1c]
push 0x1007cb8
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102bcdf
push 0x103d060
call fcn.0102bc88
mov eax, dword [section..data]
cmp eax, esi
je 0x102c9bf
test dword [eax + 0x1c], 0x10000000
je 0x102c9bf
push 0x1007cb8
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102bcb9
call fcn.01035540
call fcn.0102be97
push dword [ebp - 0x1c]
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ExitProcess]