Function at 0x30005b70
Capabilities:
Accept command line arguments
Check os version
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x3021ae88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30005b9a
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30005ba3
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x28
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
test ecx, ecx
je 0x30005bcd
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30005bcd
push ebx
popfd
mov dword [0x302728d0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x302728d0]
mov dword [ebp - 0x3f0], 0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x3f0]
push eax
push 0x18
lea eax, [ebp - 0x40c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x30245644]
test eax, eax
js 0x30005c1f
cmp dword [ebp - 0x3f0], 0x18
jne 0x30005c1f
mov ecx, dword [ebp - 0x3f8]
jmp 0x30005c21
xor ecx, ecx
mov eax, dword [0x302728d0]
mov dword [eax + 0xc], ecx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x30005c3d
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x30005c46
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
push 0x104
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
mov dword [ebp - 0x3f4], edx
test ecx, ecx
je 0x30005c7b
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x30005c7b
push ebx
popfd
mov eax, dword [0x302728d0]
mov dword [eax], edx
mov edx, dword [0x3027144c]
mov ecx, edx
lea esi, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30005c90
push 0
push 0
sub ecx, esi
push 0x104
push dword [ebp - 0x3f4]
sar ecx, 1
lea eax, [ecx + 1]
push eax
push edx
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x302728d0]
mov ecx, dword [eax]
mov dword [eax + 0x24], 0x3026f420
mov al, byte [ecx]
test al, al
je 0x30005ce7
cmp al, 0xa
jl 0x30005cdc
cmp al, 0x7e
jle 0x30005cdf
mov byte [ecx], 0x3f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x30005cd4
mov dword [0x302728cc], 0
mov dword [0x3027289c], 0
call fcn.3001e4c0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x3026f27c], 0
mov dword [0x302727f0], eax
je 0x30005e55
mov ecx, eax
call fcn.30002520
mov ecx, dword [0x302727f0]
mov edx, eax
call fcn.3001e250
cmp dword [0x3026f27c], 0
je 0x30005e55
call fcn.3004d4c0
test al, al
je 0x30005e55
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [0x3027144c]
mov dword [0x30272894], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x30005d95
push str.CAPE_init:_Unable_to_open_main_executable_image
call fcn.30009b20
mov ebx, dword [ebp - 0x3f4]
add esp, 4
mov esi, dword [ebp - 0x3f0]
jmp 0x30005e31
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x30005dc0
push str.CAPE_init:_Unable_to_get_size_of_main_executable_image
call fcn.30009b20
mov ebx, dword [ebp - 0x3f4]
add esp, 4
mov esi, dword [ebp - 0x3f0]
jmp 0x30005e31
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x30005dec
push str.CAPE_init:_Unable_to_create_file_mapping_of_main_executable_image
call fcn.30009b20
mov esi, dword [ebp - 0x3f0]
add esp, 4
jmp 0x30005e31
push esi
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x30005e0f
push str.CAPE_init:_Unable_to_map_main_executable_image
call fcn.30009b20
add esp, 4
jmp 0x30005e3c
push esi
push str.CAPE_init:_Main_executable_image_temporarily_remapped_for_scanning_at_0x_p
call fcn.30009b00
mov ecx, dword [0x302727f0]
add esp, 8
call fcn.30002520
mov edx, eax
mov ecx, esi
call fcn.3001e250
test esi, esi
je 0x30005e3c
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x30005e49
push ebx
call esi
test edi, edi
je 0x30005e55
cmp edi, 0xffffffff
je 0x30005e55
push edi
call esi
push 0x30272800
mov dword [0x30272800], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x30005e8c
push str.CAPE_init:_Failed_to_get_OS_version
call fcn.30009b20
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
cmp dword [0x3026f280], 0
je 0x30005fe4
cmp dword [0x30272804], 6
jne 0x30005eb0
cmp dword [0x30272808], 1
ja 0x30005eb6
jmp 0x30005fe4
jbe 0x30005fe4
mov eax, dword [0x3026c324]
lea ecx, [ebp - 0x3ec]
push 0x104
push ecx
push eax
mov dword [0x302386b8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jae 0x30005fd7
push 0x28
lea eax, [ebp - 0x54]
push eax
push 0x301e42fc
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x30005fd7
lea eax, [ebp - 0x54]
push eax
push str.SoftwareClassesCLSID_ls
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x30005fd7
push str.AmsiDumper
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x30005fd7
lea eax, [ebp - 0x54]
push eax
push str.SoftwareClassesCLSID_lsInProcServer32
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x30005fd7
lea eax, [ebp - 0x3ec]
push eax
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x30005fd7
push str.Both
push str.ThreadingModel
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x30005fd7
lea eax, [ebp - 0x54]
push eax
push str.SoftwareMicrosoftAMSIProviders_ls
lea eax, [ebp - 0x1e4]
push 0xc8
push eax
call fcn.30001250
add esp, 0x10
test eax, eax
js 0x30005fd7
push str.AmsiDumper
push 0
lea edx, [ebp - 0x1e4]
call fcn.30001650
add esp, 8
test eax, eax
js 0x30005fd7
push str.AmsiDumper_initialised._n
call fcn.30009b00
jmp 0x30005fe1
push str.AmsiDumper:_Is_CAPE_agent_running_elevated__Initialisation_failed
call fcn.30009b20
add esp, 4
mov ecx, dword fs:[4]
mov eax, dword fs:[8]
push ecx
push eax
push dword [0x302727f0]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x302728d0]
push dword [0x3026c324]
push dword [eax + 8]
push str.Monitor_initialised:_32_bit_capemon_loaded_in_process__d_at_0x_x__thread__d__image_base_0x_x__stack_from_0x_x_0x_x_n
call fcn.30009b00
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push str.Commandline:__s_n
call fcn.30009b00
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret