Function at 0x10027b10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023b5d9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x102cc06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1d4], ebx
mov ecx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x24]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x30]
push eax
push edx
push esi
push edi
push ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
push str._bid_:_d__type_:_d__childtype_:_d__fid_:_d__lineMode_:_d
push eax
call fcn.10047b56
add esp, 0x1c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.10057e16
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x90]
call fcn.10058487
push str._1382463573
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x90]
call fcn.10057ea3
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x10027bba
mov eax, dword [eax]
push 0x102b6048
push 0x102b605c
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10052716
add esp, 0x10
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x10027bdd
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x90]
call fcn.1005852c
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x10027c27
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027c1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027f3a
push edx
push ecx
call fcn.100451dd
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x10027c7f
mov ecx, dword [ebp - 0xa8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027c75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027f3f
push edx
push ecx
call fcn.100451dd
add esp, 8
push str._3399340260
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.10057ea3
mov byte [ebp - 4], 5
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x40]
cmovae edx, dword [ebp + 8]
cmp dword [ebp - 0x44], 8
push edx
cmovae ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], 8
push str._6488078983
cmovae eax, dword [ebp - 0x40]
push ecx
push str._3551683218
push eax
push str._3399340260
push str._4889671714
lea eax, [ebp - 0x28]
push str._s__s_s__s_s__s_s
push eax
call fcn.10047b56
add esp, 0x24
mov byte [ebp - 4], 6
call fcn.1004c3d3
test al, al
je 0x10027dcb
mov eax, dword [0x102db9b8]
test eax, eax
je 0x10027dcb
cmp dword [eax + 4], 4
jl 0x10027dcb
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
mov dword [ebp - 0x1cc], eax
jb 0x10027d1f
mov eax, dword [eax]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x14], 8
lea ebx, [ebp - 0x28]
push str.1200
cmovae ebx, dword [ebp - 0x28]
call fcn.1004bf5d
sub esp, 8
mov esi, eax
push 0x28
push str.CTransferCMD::StartShadowProcess
push ecx
lea ecx, [ebp - 0x1c8]
call fcn.100216e0
mov dword [ebp - 0x1d0], eax
mov edi, 0x102b5bd0
mov byte [ebp - 4], 7
test esi, esi
mov ecx, edi
cmovne ecx, esi
lea esi, [eax + 0x30]
push ecx
push esi
call fcn.1001cf70
push 0x102b6114
push esi
call fcn.1001cf70
test ebx, ebx
mov eax, edi
cmovne eax, ebx
push eax
push esi
call fcn.1001cf70
push 0x102b5554
push esi
call fcn.1001cf70
mov eax, dword [ebp - 0x1cc]
test eax, eax
cmovne edi, eax
push edi
push esi
call fcn.1001cf70
mov ecx, dword [0x102db9b8]
add esp, 0x28
push dword [ebp - 0x1d0]
call fcn.100218a0
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 6
call fcn.1001d4e0
mov ebx, dword [ebp - 0x1d4]
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x10027dd6
mov ecx, dword [ecx]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push 0
push ecx
push eax
call fcn.100529d6
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 8
jb 0x10027e2b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027e21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027f44
push edx
push ecx
call fcn.100451dd
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x10027e79
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027e6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027f49
push edx
push ecx
call fcn.100451dd
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10057e44
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x10027ed2
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027ec8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027f4e
push edx
push ecx
call fcn.100451dd
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x10027f1c
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10027f12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10027f53
push edx
push ecx
call fcn.100451dd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100451cc
mov esp, ebp
pop ebp
ret 0x2c
call fcn.100b1ddd
call fcn.100b1ddd
call fcn.100b1ddd
call fcn.100b1ddd
call fcn.100b1ddd
call fcn.100b1ddd
int3