Function at 0x10006340
Capabilities:
Connect pipe
Copy file
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
mov bl, byte [ebp + 8]
push esi
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x10006361
lea eax, [ebx - 0x41]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x100b32d8], 0x1e361599
jne 0x10006556
push 0
push 0
push 0
push 0
push 0
push 0x100bdd00
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
call dword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnterSynchronizationBarrier]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CancelIoEx]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push 0
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor ecx, ecx
xor edx, edx
xor eax, eax
lock cmpxchg dword [edx], ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor eax, eax
lock inc dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push eax
push eax
call esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push 0
push 0x100bdd28
push 0
push 0x100bdd54
push 0
call dword [sym.imp.KERNEL32.dll_VerifyScripts]
lea eax, [ebx - 0x61]
cmp al, 0x19
ja 0x10006568
lea eax, [ebx - 0x47]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x1000657a
lea eax, [ebx + 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp bl, 0x2b
jne 0x10006589
mov al, 0x3e
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp bl, 0x2f
pop esi
setne al
dec al
and al, 0x3f
pop ebx
mov esp, ebp
pop ebp
ret 4