Function at 0x30005bf0
Capabilities:
Accept command line arguments
Check os version
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x3021be88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30005c1a
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30005c23
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x28
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x30005c4d
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30005c4d
push ebx
popfd
mov dword [0x302739d0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x302739d0]
mov dword [ebp - 0x3f0], 0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x3f0]
push eax
push 0x18
lea eax, [ebp - 0x40c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x302466f4]
test eax, eax
js 0x30005c9f
cmp dword [ebp - 0x3f0], 0x18
jne 0x30005c9f
mov ecx, dword [ebp - 0x3f8]
jmp 0x30005ca1
xor ecx, ecx
mov eax, dword [0x302739d0]
mov dword [eax + 0xc], ecx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30005cbd
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30005cc6
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x104
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
mov dword [ebp - 0x3f4], edx
test ecx, ecx
je 0x30005cfb
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30005cfb
push ebx
popfd
mov eax, dword [0x302739d0]
mov dword [eax], edx
mov edx, dword [0x30272508]
mov ecx, edx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30005d10
push 0
push 0
sub ecx, esi
push 0x104
push dword [ebp - 0x3f4]
sar ecx, 1
lea eax, [ecx + 1]
push eax
push edx
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x302739d0]
mov ecx, dword [eax]
mov dword [eax + 0x24], 0x302704e4
mov al, byte [ecx]
test al, al
je 0x30005d67
cmp al, 0xa
jl 0x30005d5c
cmp al, 0x7e
jle 0x30005d5f
mov byte [ecx], 0x3f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x30005d54
mov dword [0x302739cc], 0
mov dword [0x3027399c], 0
call fcn.3001e300
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x30270340], 0
mov dword [0x302738e4], eax
je 0x30005ecb
mov ecx, eax
call fcn.30002410
mov ecx, dword [0x302738e4]
mov edx, eax
call fcn.3001e090
cmp dword [0x30270340], 0
je 0x30005ecb
cmp dword [0x30273994], 0
je 0x30005ecb
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [0x30272508]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x30005e0b
push str.CAPE_init:_Unable_to_open_main_executable_image
call fcn.30009b60
mov ebx, dword [ebp - 0x3f4]
add esp, 4
mov esi, dword [ebp - 0x3f0]
jmp 0x30005ea7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x30005e36
push str.CAPE_init:_Unable_to_get_size_of_main_executable_image
call fcn.30009b60
mov ebx, dword [ebp - 0x3f4]
add esp, 4
mov esi, dword [ebp - 0x3f0]
jmp 0x30005ea7
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x30005e62
push str.CAPE_init:_Unable_to_create_file_mapping_of_main_executable_image
call fcn.30009b60
mov esi, dword [ebp - 0x3f0]
add esp, 4
jmp 0x30005ea7
push esi
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x30005e85
push str.CAPE_init:_Unable_to_map_main_executable_image
call fcn.30009b60
add esp, 4
jmp 0x30005eb2
push esi
push str.CAPE_init:_Main_executable_image_temporarily_remapped_for_scanning_at_0x_p
call fcn.30009b40
mov ecx, dword [0x302738e4]
add esp, 8
call fcn.30002410
mov edx, eax
mov ecx, esi
call fcn.3001e090
test esi, esi
je 0x30005eb2
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x30005ebf
push ebx
call esi
test edi, edi
je 0x30005ecb
cmp edi, 0xffffffff
je 0x30005ecb
push edi
call esi
push 0x30273900
mov dword [0x30273900], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x30005f02
push str.CAPE_init:_Failed_to_get_OS_version
call fcn.30009b60
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
cmp dword [0x30270344], 0
je 0x3000605a
cmp dword [0x30273904], 6
jne 0x30005f26
cmp dword [0x30273908], 1
ja 0x30005f2c
jmp 0x3000605a
jbe 0x3000605a
mov eax, dword [0x3026d3e4]
lea ecx, [ebp - 0x3ec]
push 0x104
push ecx
push eax
mov dword [0x30239758], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jae 0x3000604d
push 0x28
lea eax, [ebp - 0x54]
push eax
push 0x301e52fc
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x3000604d
lea eax, [ebp - 0x54]
push eax
push str.SoftwareClassesCLSID_ls
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x3000604d
push str.AmsiDumper
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x3000604d
lea eax, [ebp - 0x54]
push eax
push str.SoftwareClassesCLSID_lsInProcServer32
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x3000604d
lea eax, [ebp - 0x3ec]
push eax
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x3000604d
push str.Both
push str.ThreadingModel
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x3000604d
lea eax, [ebp - 0x54]
push eax
push str.SoftwareMicrosoftAMSIProviders_ls
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x3000604d
push str.AmsiDumper
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x3000604d
push str.AmsiDumper_initialised._n
call fcn.30009b40
jmp 0x30006057
push str.AmsiDumper:_Is_CAPE_agent_running_elevated__Initialisation_failed
call fcn.30009b60
add esp, 4
mov ecx, dword fs:[4]
mov eax, dword fs:[8]
push ecx
push eax
push dword [0x302738e4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x302739d0]
push dword [0x3026d3e4]
push dword [eax + 8]
push str.Monitor_initialised:_32_bit_capemon_loaded_in_process__d_at_0x_x__thread__d__image_base_0x_x__stack_from_0x_x_0x_x_n
call fcn.30009b40
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str.Commandline:__s_n
call fcn.30009b40
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret