Function at 0x10002fd8
Capabilities:
Accept command line arguments
Check os version
Create or open mutex on windows
Create thread
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xc4]
sub esp, 0x144
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0xc0], eax
mov al, byte [0x10021320]
mov ecx, dword [ebp + 0xcc]
mov byte [0x10021728], al
mov eax, dword [ebp + 0xd0]
push ebx
xor ebx, ebx
dec eax
mov dword [ebp - 0x58], ecx
mov dword [0x1002131c], ebx
mov dword [0x10021724], ebx
mov dword [0x10021318], ebx
mov dword [0x10021720], ebx
jne 0x10003215
mov dword [0x1002214c], ecx
cmp byte [0x100222a4], bl
jne 0x10003215
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x5c]
inc edi
push eax
mov byte [0x100222a4], 1
mov dword [ebp - 0x5c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
je 0x10003213
cmp dword [ebp - 0x5c], 5
jne 0x1000310c
mov ecx, dword [esi + 4]
mov eax, str.alwijlk85
call fcn.1000104c
test eax, eax
jne 0x1000310c
mov ecx, dword [esi + 8]
mov eax, str.mjigb62ds
call fcn.1000104c
test eax, eax
jne 0x1000310c
mov ecx, dword [esi + 0xc]
mov eax, str.mst26liss
call fcn.1000104c
test eax, eax
jne 0x1000310c
call fcn.10001603
lea eax, [ebp - 0x58]
push eax
push 2
push ebx
push 0x10021b28
push 0x80000002
call dword [0x1002220c]
test eax, eax
je 0x100030d3
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esi + 0x10]
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0x10]
push edi
push ebx
push 0x10005488
push dword [ebp - 0x58]
call dword [0x10022210]
test eax, eax
je 0x10003105
push dword [ebp - 0x58]
call dword [0x10022218]
push 4
jmp 0x100030cd
push 0x96
jmp 0x100030cd
push 0x110
lea eax, [ebp - 0x50]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.10001317
test al, al
je 0x10003142
cmp dword [ebp - 0x50], 6
jb 0x100031ef
call fcn.100014a1
test al, al
jne 0x100031ef
cmp dword [ebp - 0x50], 5
ja 0x10003162
call fcn.100013c8
test eax, eax
jne 0x100031ef
call fcn.10001552
test al, al
jne 0x10003178
call fcn.10001266
test al, al
je 0x10003213
push 0x22
mov esi, str.t
push esi
call fcn.100010a1
pop ecx
pop ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x10003213
mov byte [ebp - 0x80], bl
lea edi, [ebp - 0x7f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x80]
call fcn.10002407
push esi
push ebx
test eax, eax
jne 0x100031b2
push ebx
jmp 0x100031cd
xor eax, eax
mov dword [ebp - 0x68], 0xc
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x60], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call fcn.1000281d
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0x58]
push 0x10001ed5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10003213
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x57e40
jae 0x10003213
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.10002dec
pop edi
pop esi
mov ecx, dword [ebp + 0xc0]
xor eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.100037a0
add ebp, 0xc4
leave
ret 0xc