Function at 0x1004361
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
inc edi
test eax, eax
mov dword [ebp - 0x10c], edi
je 0x10048ab
cmp byte [eax], 0
je 0x10048ab
mov dword [ebp - 0x110], eax
mov ebx, 0x104
cmp dword [ebp - 0x10c], 0
je 0x10044b0
mov eax, dword [ebp - 0x110]
mov cl, byte [eax]
cmp cl, 0x20
je 0x10043d4
cmp cl, 9
je 0x10043d4
cmp cl, 0xd
je 0x10043d4
cmp cl, 0xa
je 0x10043d4
cmp cl, 0xb
je 0x10043d4
cmp cl, 0xc
jne 0x10043dd
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x10043b4
cmp byte [eax], 0
je 0x10044b0
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x110], eax
xor esi, esi
test edx, edx
jne 0x1004424
mov eax, dword [ebp - 0x110]
mov al, byte [eax]
cmp al, 0x20
je 0x1004499
cmp al, 9
je 0x1004499
cmp al, 0xd
je 0x1004499
cmp al, 0xa
je 0x1004499
cmp al, 0xb
je 0x1004499
cmp al, 0xc
je 0x1004499
jmp 0x1004428
test esi, esi
jne 0x1004499
mov eax, dword [ebp - 0x110]
mov al, byte [eax]
cmp al, 0x22
jne 0x1004470
mov eax, dword [ebp - 0x110]
inc eax
cmp byte [eax], 0x22
je 0x1004452
test edx, edx
jne 0x1004448
mov edx, edi
jmp 0x100444a
mov esi, edi
mov dword [ebp - 0x110], eax
jmp 0x100448a
cmp ecx, 0x103
jae 0x10047ba
mov byte [ebp + ecx - 0x108], 0x22
inc ecx
add dword [ebp - 0x110], 2
jmp 0x100448a
cmp ecx, 0x103
jae 0x10047ba
mov byte [ebp + ecx - 0x108], al
inc ecx
inc dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
cmp byte [eax], 0
jne 0x10043f2
test edx, edx
mov byte [ebp + ecx - 0x108], 0
je 0x10044f6
test esi, esi
jne 0x10044fa
and dword [ebp - 0x10c], 0
cmp dword [0x100deec], 0
je 0x10048a3
cmp byte [0x100dffe], 0
jne 0x10048a3
push ebx
mov esi, 0x100dffe
push esi
push dword [0x100db04]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100489c
push 0x5c
push esi
call fcn.01007573
mov byte [eax + 1], 0
jmp 0x10048a3
test esi, esi
jne 0x10044a9
cmp byte [ebp - 0x108], 0x2f
je 0x1004510
cmp byte [ebp - 0x108], 0x2d
jne 0x10047ba
movsx eax, byte [ebp - 0x107]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
movsx eax, al
sub eax, 0x3f
je 0x100487f
sub eax, 4
je 0x10047c1
dec eax
je 0x1004714
sub eax, 0xa
je 0x100469b
push 3
pop ecx
sub eax, ecx
je 0x1004650
dec eax
je 0x1004576
dec eax
dec eax
je 0x1004714
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x110]
cmp byte [eax], 0
jne 0x10043a1
jmp 0x10044b0
cmp byte [ebp - 0x106], 0
jne 0x100458d
mov dword [0x100daec], ecx
mov dword [0x100dee8], edi
jmp 0x1004562
cmp byte [ebp - 0x106], 0x3a
jne 0x100462a
cmp byte [ebp - 0x105], 0
mov dword [0x100daec], edi
je 0x1004562
lea esi, [ebp - 0x105]
movsx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
inc esi
sub eax, 0x41
je 0x1004613
sub eax, 3
je 0x100460a
sub eax, 5
je 0x1004601
sub eax, 5
je 0x10045f8
dec eax
dec eax
je 0x10045ec
sub eax, 3
je 0x10045e3
and dword [ebp - 0x10c], 0
jmp 0x1004620
or dword [0x100daec], 4
jmp 0x100461a
or dword [0x100e208], 0x80
jmp 0x1004620
and dword [0x100daec], 0xfffffffe
jmp 0x100461a
and dword [0x100daec], 0xfffffffd
jmp 0x100461a
or dword [0x100e208], 0x40
jmp 0x1004620
or dword [0x100daec], 2
mov dword [0x100dee8], edi
cmp byte [esi], 0
jne 0x10045af
jmp 0x1004562
push 0xffffffffffffffff
lea eax, [ebp - 0x107]
push eax
push 0xffffffffffffffff
push 0x100146c
push edi
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
dec eax
je 0x1004562
jmp 0x100455b
cmp byte [ebp - 0x106], 0
jne 0x1004667
mov word [0x100def8], 2
jmp 0x1004562
cmp byte [ebp - 0x106], 0x3a
jne 0x100455b
movsx eax, byte [ebp - 0x105]
push eax
call esi
cmp al, 0x31
je 0x1004659
cmp al, 0x41
je 0x100468f
cmp al, 0x55
je 0x1004659
jmp 0x100455b
mov word [0x100def8], di
jmp 0x1004562
cmp byte [ebp - 0x106], 0
jne 0x10046af
mov dword [0x100deec], edi
jmp 0x1004562
cmp byte [ebp - 0x106], 0x3a
jne 0x100455b
cmp byte [ebp - 0x105], 0
je 0x1004562
lea esi, [ebp - 0x105]
movsx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
inc esi
sub eax, 0x45
je 0x1004704
dec eax
dec eax
je 0x10046fc
sub eax, 0xf
je 0x10046f4
and dword [ebp - 0x10c], 0
jmp 0x100470a
mov dword [0x100def4], edi
jmp 0x100470a
mov dword [0x100def0], edi
jmp 0x100470a
mov dword [0x100deec], edi
cmp byte [esi], 0
jne 0x10046cf
jmp 0x1004562
cmp byte [ebp - 0x106], 0x3a
jne 0x100455b
xor eax, eax
cmp byte [ebp - 0x105], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x108]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x1004750
and dword [ebp - 0x10c], 0
jmp 0x1004877
lea eax, [ebp - 0x114]
push eax
push edi
mov dword [ebp - 0x114], esi
call fcn.01003589
test eax, eax
je 0x1004744
movsx eax, byte [ebp - 0x107]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
cmp al, 0x54
mov eax, dword [ebp - 0x114]
jne 0x1004788
add eax, esi
mov esi, 0x100dffe
jmp 0x100478f
add eax, esi
mov esi, 0x100defa
lea eax, [ebp + eax - 0x108]
push eax
push ebx
push esi
call fcn.01001f2e
push 0x10012e1
push ebx
push esi
call fcn.010074f0
mov eax, esi
push eax
call fcn.01002f7d
test eax, eax
jne 0x1004877
xor eax, eax
jmp 0x10048ad
cmp byte [ebp - 0x106], 0
jne 0x10047d5
mov dword [0x100dee4], edi
jmp 0x1004562
cmp byte [ebp - 0x106], 0x3a
jne 0x100455b
xor eax, eax
cmp byte [ebp - 0x105], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x108]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1004744
push 0x5b
push edi
call fcn.0100744e
test eax, eax
je 0x1004825
push 0x5d
push edi
call fcn.0100744e
test eax, eax
je 0x1004744
push 0x5d
push edi
call fcn.0100744e
test eax, eax
je 0x1004841
push 0x5b
push edi
call fcn.0100744e
test eax, eax
je 0x1004744
lea eax, [ebp - 0x114]
push eax
push edi
mov dword [ebp - 0x114], esi
call fcn.01003589
test eax, eax
je 0x1004744
mov eax, dword [ebp - 0x114]
add eax, esi
lea eax, [ebp + eax - 0x108]
push eax
push ebx
push 0x100e102
call fcn.01001f2e
xor edi, edi
inc edi
jmp 0x1004562
call fcn.01001b57
mov eax, dword [0x100cd70]
test eax, eax
je 0x1004894
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
jmp 0x10048ad
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006b7f
leave
ret 4