Function at 0x1002f130
Capabilities:
Accept command line arguments
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046a8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ec
mov dword [ebp - 0x1b8], ecx
jmp 0x1002f166
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001cf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10004510
mov byte [ebp - 4], 1
mov eax, 0xf3acb482
push eax
lea ecx, [ebp - 0x152]
call fcn.1002f620
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c0]
push edx
lea ecx, [ebp - 0x44]
call fcn.10004e50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x152]
call fcn.1002f4a0
lea ecx, [ebp - 0x44]
call fcn.100011a0
push eax
lea ecx, [ebp - 0x28]
call fcn.100011a0
push eax
call sub.MSVCR90.dll_strstr
add esp, 8
test eax, eax
jne 0x1002f434
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [0x10086020]
call fcn.10008fe0
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c8]
call fcn.100011a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x158], esp
push eax
call fcn.10001cf0
mov dword [ebp - 0x1cc], eax
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], edx
mov byte [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x178], esp
push 0x1005a576
call fcn.10001cf0
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 4], 3
call fcn.1002ee80
add esp, 0x38
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x174]
call fcn.10001180
push 0x2fec1af2
lea ecx, [ebp - 0x183]
call fcn.1002f6a0
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x17c], esp
mov edx, dword [ebp - 0x1dc]
push edx
lea eax, [ebp - 0x28]
push eax
push ecx
call fcn.10009dd0
add esp, 0xc
mov dword [ebp - 0x1e0], eax
call fcn.1002f030
add esp, 0x1c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x183]
call fcn.10039e10
push 0x104
lea ecx, [ebp - 0x14c]
push ecx
push 0
mov edx, dword [0x1008806c]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExA
mov eax, dword [0x1008806c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10088074]
push ecx
call fcn.1002f0b0
add esp, 4
movzx edx, al
test edx, edx
je 0x1002f32a
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002f307
mov eax, dword [0x1008806c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3cad9f08
lea ecx, [ebp - 0x197]
call fcn.100292c0
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1e8]
push edx
call fcn.1001bf30
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x197]
call fcn.1001e790
mov ecx, 0x10088098
call fcn.100011a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002f44e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10001180
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10001180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret