Function at 0x4062eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x40b064]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x402e04
push esi
push edi
mov dword [esp + 0x18], eax
mov esi, 0x106
mov dword [esp + 0x1c], eax
xor ecx, ecx
push esi
lea eax, [esp + 0xb4]
mov byte [esp + 0x17], cl
push eax
push ecx
mov byte [esp + 0x1e], cl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406352
cmp eax, esi
je 0x406352
lea ecx, [esp + 0xb0]
call fcn.00407d51
mov dword [0x411600], eax
mov eax, dword [ebp + 8]
push 3
add eax, 0xfffffffe
pop edi
cmp eax, edi
ja 0x4067d5
mov esi, dword [ebx + 4]
mov al, byte [esi]
cmp al, 0x2d
je 0x406374
cmp al, 0x2f
jne 0x4067d5
inc esi
push 0x402f84
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x4063f9
push 0x402f8c
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x4063f9
push 0x402f90
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x4063e5
push 0x402f98
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x4063e5
push 0x402f9c
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x4067d5
push 0x1000
call fcn.00406b5a
pop ecx
xor ebx, ebx
jmp 0x4067ca
mov dword [0x411ef0], 0x40b044
mov dword [esp + 0x18], 0x402f90
jmp 0x40640b
mov dword [0x411ef0], 0x40b030
mov dword [esp + 0x18], 0x402f84
cmp dword [ebp + 8], edi
jl 0x4067d5
push 0x402fa4
push dword [ebx + 8]
xor eax, eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x40643a
xor esi, esi
mov dword [esp + 0x1c], 0x402fa4
jmp 0x40649e
push 0x402fa8
push dword [ebx + 8]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x40645b
xor esi, esi
mov dword [esp + 0x1c], 0x402fa8
inc esi
jmp 0x40649e
mov eax, dword [ebx + 8]
movzx eax, byte [eax]
push eax
call dword [sym.imp.msvcrt.dll_isalpha]
pop ecx
test eax, eax
je 0x4067d5
mov eax, dword [ebx + 8]
cmp byte [eax + 1], 0x3a
jne 0x4067d5
cmp byte [eax + 2], 0
jne 0x4067d5
movsx ax, byte [eax]
push 2
pop esi
mov dword [esp + 0x1c], 0x402fac
movzx eax, ax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
cmp eax, 4
je 0x4064ab
cmp eax, 5
jne 0x406515
cmp eax, edi
jle 0x406515
push 0x402fb4
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x40650a
push 0x402fbc
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x40650a
push 0x402fc4
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x406503
push 0x402fcc
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x4067d5
mov byte [esp + 0x12], 1
jmp 0x40650f
mov byte [esp + 0x13], 1
inc edi
cmp edi, dword [ebp + 8]
jl 0x4064af
cmp dword [0x411ef0], 0x40b030
mov eax, 0x411ef8
mov dword [0x411efc], eax
mov dword [0x411ef8], eax
jne 0x406537
push 0x100e
jmp 0x40653c
push 0x100f
call fcn.00406b5a
pop ecx
push 0x101d
call fcn.00406b5a
mov eax, 0x411f00
pop ecx
mov dword [0x411f04], eax
mov dword [0x411f00], eax
call fcn.00405795
mov ebx, eax
test ebx, ebx
jns 0x406585
push 0x1004
call fcn.00406b5a
pop ecx
push ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.00406ba1
jmp 0x406790
mov ecx, 0x402f34
mov edx, 0x405830
push ecx
call fcn.0040736c
mov ebx, eax
test ebx, ebx
jns 0x4065a2
push 0x1010
jmp 0x40656c
cmp esi, 1
je 0x4065ac
cmp esi, 2
jne 0x4065cb
xor edi, edi
mov edx, 0x405690
push edi
mov ecx, 0x402ed8
call fcn.0040736c
mov ebx, eax
test ebx, ebx
jns 0x4065cd
push 0x1005
jmp 0x40656c
xor edi, edi
sub esi, edi
je 0x4066de
sub esi, 1
je 0x4066ba
sub esi, 1
jne 0x406759
mov ebx, dword [esp + 0x14]
mov ecx, ebx
call fcn.00407718
cmp eax, 0xffffffff
jne 0x40660b
push 0x1008
call fcn.00406b5a
mov ebx, 0xc0000001
jmp 0x40678f
xor edx, edx
mov ecx, eax
mov eax, dword [0x411f00]
inc edx
shl edx, cl
mov esi, 0x411f00
mov ecx, edi
cmp eax, esi
je 0x4066a6
test ecx, ecx
jne 0x406633
test dword [eax + 8], edx
je 0x406633
mov ecx, eax
jmp 0x406636
mov dword [eax + 0xc], edi
mov eax, dword [eax]
cmp eax, esi
jne 0x406626
test ecx, ecx
je 0x4066a6
cmp dword [ecx + 0xc], edi
jne 0x40666b
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x40664f
mov eax, dword [ecx + 0x14]
push eax
movzx eax, bx
push eax
push 0x100a
call fcn.00406b5a
add esp, 0xc
mov ebx, 0xc0000001
jmp 0x406790
cmp byte [esp + 0x12], 0
je 0x406759
mov ecx, dword [ecx + 0x14]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
call fcn.00406de1
mov esi, dword [esp + 0x14]
mov ebx, eax
test ebx, ebx
js 0x406699
mov ecx, esi
call fcn.004053c3
mov ebx, eax
test esi, esi
je 0x4066cc
mov ecx, esi
call fcn.00406a2c
jmp 0x4066cc
movzx eax, bx
push eax
push 0x1009
call fcn.00406b5a
pop ecx
jmp 0x406601
cmp byte [esp + 0x12], 0
je 0x406759
call fcn.00405710
mov ebx, eax
test ebx, ebx
jns 0x406759
push 0x1082
jmp 0x40656c
lea ecx, [esp + 0x20]
call fcn.00406c6a
mov ebx, eax
test ebx, ebx
jns 0x4066f7
push 0x1006
jmp 0x40656c
push dword [esp + 0x20]
xor edx, edx
or ecx, 0xffffffff
push edi
inc edx
call fcn.004054a0
mov ecx, dword [esp + 0x20]
mov ebx, eax
call fcn.00406a2c
test ebx, ebx
jns 0x406720
push 0x1007
jmp 0x40656c
cmp byte [esp + 0x12], 0
je 0x406759
lea ecx, [esp + 0x24]
call fcn.00406bf2
mov ebx, eax
test ebx, ebx
jns 0x406740
push 0x1080
jmp 0x40656c
mov ecx, dword [esp + 0x24]
call fcn.004053c3
mov ebx, eax
test ebx, ebx
jns 0x406759
push 0x1081
jmp 0x40656c
mov cl, byte [esp + 0x13]
call fcn.00406256
mov ebx, eax
test ebx, ebx
js 0x40676f
push 0x100d
jmp 0x40677c
cmp ebx, 0x8000000d
jne 0x406785
push 0x100c
call fcn.00406b5a
mov ebx, edi
jmp 0x40678f
push 0x100b
call fcn.00406b5a
pop ecx
call fcn.0040545d
mov edi, dword [0x411ef8]
mov eax, 0x411ef8
cmp edi, eax
je 0x4067c0
mov ecx, dword [edi + 8]
mov esi, dword [edi]
call fcn.00406a2c
mov ecx, edi
call fcn.00406a2c
mov eax, 0x411ef8
mov edi, esi
cmp esi, eax
jne 0x4067a4
mov dword [0x411efc], eax
mov dword [0x411ef8], eax
call fcn.00406bda
test ebx, ebx
jns 0x4067f0
jmp 0x4067ed
push 0x1021
call fcn.00406b5a
pop ecx
call fcn.00406bda
mov dword [esp + 0x18], 0x402fd4
xor ebx, ebx
inc ebx
mov esi, dword [0x40b004]
lea edi, [esp + 0x40]
push 0x40b018
push section..data
push 0x405250
lea esi, [esi - 0x10]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x4c]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [0x40b020], esi
mov dword [0x40b024], esi
call dword [sym.imp.ADVAPI32.dll_EventRegister]
test eax, eax
jne 0x40683d
mov ecx, dword [0x40b004]
movzx eax, word [ecx]
push eax
push ecx
call fcn.004052e2
cmp dword [section..data], 4
jbe 0x406983
mov ecx, dword [0x40b00c]
mov edi, 0x2000
and ecx, edi
mov eax, esi
or eax, ecx
je 0x406983
mov ecx, dword [0x40b014]
mov eax, ecx
and eax, edi
cmp esi, dword [0x40b010]
jne 0x406983
cmp eax, ecx
jne 0x406983
movzx eax, byte [esp + 0x13]
lea ecx, [esp + 0x70]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
movzx eax, byte [esp + 0x12]
mov dword [esp + 0x2c], eax
call fcn.00405380
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x80]
call fcn.00405380
lea eax, [esp + 0x28]
xor edx, edx
push 4
mov dword [esp + 0x94], eax
lea eax, [esp + 0x30]
pop ecx
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov al, byte [0x404fc4]
mov ecx, 0x404f39
movzx eax, word [0x404f3a]
sub ecx, 0x404f28
mov dword [esp + 0x34], eax
or ecx, 0xb000000
mov eax, dword [0x40b004]
mov dword [esp + 0x50], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x54], edx
movzx eax, word [eax]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x50]
push eax
push 6
push edx
push edx
lea eax, [esp + 0x40]
mov dword [esp + 0x6c], 2
push eax
push dword [0x40b01c]
mov dword [esp + 0x78], 0x404f44
push dword [0x40b018]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 0x37
mov dword [esp + 0x88], 1
call dword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
xor esi, esi
push dword [0x40b01c]
push dword [0x40b018]
call dword [sym.imp.ADVAPI32.dll_EventUnregister]
mov ecx, dword [esp + 0x2c4]
mov eax, ebx
pop edi
mov dword [0x40b018], esi
mov dword [0x40b01c], esi
mov dword [section..data], esi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a430
mov esp, ebp
pop ebp
ret