Function at 0x10027000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025e9d9
mov eax, dword fs:[0]
push eax
sub esp, 0x1b0
mov eax, dword [0x102fb070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1bc], ebx
mov ecx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x24]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x30]
push eax
push edx
push esi
push edi
push ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
push str._bid_:_d__type_:_d__childtype_:_d__fid_:_d__lineMode_:_d
push eax
call fcn.1005aa51
add esp, 0x1c
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 1
call fcn.1006f9d1
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1006ffd2
push str.10681241
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1006f9ee
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x100270aa
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10069240
add esp, 8
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x100270c3
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1007005d
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x1002710d
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027103
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027427
push edx
push ecx
call fcn.10053aa5
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x10027162
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027158
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002742c
push edx
push ecx
call fcn.10053aa5
add esp, 8
push str.91474361
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1006f9ee
mov byte [ebp - 4], 5
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x40]
cmovae edx, dword [ebp + 8]
cmp dword [ebp - 0x44], 8
push edx
cmovae ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], 8
push str.13120011
cmovae eax, dword [ebp - 0x40]
push ecx
push str.41201514
push eax
push str.91474361
push str.80812412
lea eax, [ebp - 0x28]
push str._s__s_s__s_s__s_s
push eax
call fcn.1005aa51
add esp, 0x24
mov byte [ebp - 4], 6
call fcn.10063dd9
test al, al
je 0x100272b8
mov eax, dword [0x1030bab4]
test eax, eax
je 0x100272b8
cmp dword [eax + 4], 4
jl 0x100272b8
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
mov dword [ebp - 0x1ac], eax
jb 0x10027202
mov eax, dword [eax]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x14], 8
lea ebx, [ebp - 0x28]
push str.1200
cmovae ebx, dword [ebp - 0x28]
call fcn.1006397d
add esp, 4
lea ecx, [ebp - 0x1a8]
mov esi, eax
push 0
push 0
push 0x102ddbc0
push 0x28
push str.CTransferCMD::StartShadowProcess
push 4
call fcn.10025da0
mov dword [ebp - 0x1b8], eax
mov edi, 0x102de530
mov byte [ebp - 4], 7
test esi, esi
mov ecx, edi
cmovne ecx, esi
lea esi, [eax + 0x30]
push ecx
push esi
call fcn.10021c60
push 0x102de840
push esi
call fcn.10021c60
test ebx, ebx
mov eax, edi
cmovne eax, ebx
push eax
push esi
call fcn.10021c60
push 0x102ddf08
push esi
call fcn.10021c60
mov eax, dword [ebp - 0x1ac]
test eax, eax
cmovne edi, eax
push edi
push esi
call fcn.10021c60
mov ecx, dword [0x1030bab4]
add esp, 0x28
push dword [ebp - 0x1b8]
call fcn.10025f50
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 6
call fcn.100221e0
mov ebx, dword [ebp - 0x1bc]
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x100272c3
mov ecx, dword [ecx]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push 0
push ecx
push eax
call fcn.100694e6
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 8
jb 0x10027318
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002730e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027431
push edx
push ecx
call fcn.10053aa5
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x10027366
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002735c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027436
push edx
push ecx
call fcn.10053aa5
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.100633ea
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x100273bf
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100273b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002743b
push edx
push ecx
call fcn.10053aa5
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x10027409
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100273ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027440
push edx
push ecx
call fcn.10053aa5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10053a94
mov esp, ebp
pop ebp
ret 0x2c
call fcn.100d7e3e
call fcn.100d7e3e
call fcn.100d7e3e
call fcn.100d7e3e
call fcn.100d7e3e
call fcn.100d7e3e
int3