Function at 0x40a18b
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov dword [esp + 0x1c], ecx
mov esi, ebx
push edi
mov ecx, 0x4006
mov dword [esp + 0x24], eax
mov byte [esp + 0xe], al
call fcn.0040dc10
mov dword [esp + 0x10], eax
test eax, eax
je 0x41c3d8
mov al, byte [0x435745]
mov byte [esp + 0xf], al
push 0x2f
pop edx
mov ecx, esi
call fcn.0040a574
mov esi, eax
test esi, esi
je 0x41c74c
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.msvcrt.dll_towlower]
movzx edi, ax
pop ecx
test di, di
je 0x41c74c
cmp edi, 0x3f
je 0x41c69a
cmp edi, 0x71
je 0x41c3ec
push 0x6b
pop eax
cmp edi, 0x63
je 0x40a27b
cmp di, ax
je 0x41c60d
cmp edi, 0x72
je 0x40a27b
cmp edi, 0x75
je 0x41c3fb
cmp edi, 0x61
je 0x41c407
cmp edi, 0x78
je 0x40a3cc
cmp edi, 0x79
je 0x41c413
cmp edi, 0x65
je 0x41c41f
cmp edi, 0x64
jne 0x40a530
mov edx, dword [ebp + 0xc]
lea eax, [esi + 4]
push eax
mov eax, esi
mov ecx, esi
sub eax, ebx
sar eax, 1
sub edx, eax
call fcn.0040f2e0
mov edi, dword [esp + 0x20]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
jmp 0x40a1cb
cmp di, ax
je 0x41c60d
mov dword [0x435748], 1
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40a298
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 2]
lea ecx, [eax + eax]
mov dword [esp + 0x1c], eax
call fcn.0040dc10
mov edi, eax
test edi, edi
je 0x41c61c
mov edx, dword [esp + 0x1c]
mov ecx, edi
push ebx
call fcn.0040f2e0
xor eax, eax
mov ecx, edi
mov word [esi], ax
call fcn.00409dce
cmp byte [esp + 0xe], 0
mov esi, eax
push 0x22
pop ebx
jne 0x40a351
cmp word [esi], bx
jne 0x40a3ee
mov edi, 0x4000
mov ecx, edi
call fcn.0040dc10
mov ebx, eax
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.0040dc10
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x41c686
test eax, eax
je 0x41c686
xor eax, eax
push 0x48
push eax
lea eax, [esp + 0x30]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [esi + 2]
push 0x22
pop edi
mov edx, edi
call fcn.0040a574
test eax, eax
je 0x40a351
lea ebx, [eax + 2]
mov edx, edi
mov ecx, ebx
call fcn.0040a574
test eax, eax
je 0x40a3f4
mov ebx, dword [esp + 0x10]
push 0x22
pop eax
cmp word [esi], ax
jne 0x40a398
add esi, 2
xor edx, edx
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x40a367
push 0x22
sub edi, ecx
mov ecx, esi
pop eax
mov edx, eax
sar edi, 1
call fcn.00410145
test eax, eax
je 0x40a398
xor ecx, ecx
mov edx, edi
mov word [eax], cx
add eax, 2
push eax
mov ecx, esi
call fcn.0040fb80
mov ecx, esi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40a39f
sub ecx, edx
sar ecx, 1
push 0xa
pop eax
mov word [esi + ecx*2], ax
mov ecx, dword [esp + 0x20]
mov dword [ecx + 8], esi
mov ecx, ebx
call fcn.0040dba0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [0x435745], 1
lea eax, [esi + 4]
push eax
mov edx, dword [ebp + 0xc]
mov eax, esi
sub eax, ebx
sar eax, 1
sub edx, eax
mov ecx, esi
call fcn.0040f2e0
jmp 0x40a1cb
mov ebx, dword [esp + 0x10]
jmp 0x40a398
movzx eax, word [ebx]
mov ecx, esi
mov dword [esp + 0x1c], eax
xor eax, eax
push 0x26
pop edx
mov word [ebx], ax
call fcn.0040a574
test eax, eax
jne 0x41c67a
push 0x3c
pop edx
mov ecx, esi
call fcn.0040a574
test eax, eax
jne 0x41c67a
push 0x3e
pop edx
mov ecx, esi
call fcn.0040a574
test eax, eax
jne 0x41c67a
push 0x40
pop edx
mov ecx, esi
call fcn.0040a574
test eax, eax
jne 0x41c67a
push 0x5e
pop edx
mov ecx, esi
call fcn.0040a574
test eax, eax
jne 0x41c67a
push 0x7c
pop edx
mov ecx, esi
call fcn.0040a574
test eax, eax
jne 0x41c67a
movzx eax, word [esi]
mov edi, esi
test ax, ax
je 0x41c67a
mov ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x40a49a
add edi, 2
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x40a47c
jmp 0x41c67a
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edi, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x5c], ecx
mov ecx, esi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x24]
jne 0x40a4b9
sub ecx, edx
mov eax, 0x2000
sar ecx, 1
cmp ecx, eax
jae 0x41c62d
mov ecx, dword [esp + 0x14]
mov edx, eax
push esi
call fcn.0040f2e0
push 0x40233c
mov edx, 0x2000
mov ecx, edi
call fcn.0040f2e0
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
mov word [ebx], ax
mov ebx, dword [esp + 0x10]
mov edx, ebx
push 0x2003
call fcn.0040f350
mov ecx, dword [esp + 0x14]
mov edi, eax
call fcn.0040dba0
mov ecx, dword [esp + 0x18]
call fcn.0040dba0
test edi, edi
je 0x40a355
jmp 0x41c64b
cmp edi, 0x66
je 0x41c46d
cmp edi, 0x76
je 0x41c4ca
cmp edi, 0x74
je 0x41c539
mov edx, dword [ebp + 0xc]
lea eax, [esi + 4]
push eax
mov eax, esi
mov ecx, esi
sub eax, ebx
sar eax, 1
sub edx, eax
call fcn.0040f2e0
cmp edi, 0x73
jne 0x40a1cb
mov byte [esp + 0xe], 1
jmp 0x40a1cb
xor eax, eax
push eax
call fcn.00411df0
test eax, eax
je 0x41c3d8
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov dword [0x44850c], 1
jmp 0x40a3d3
mov byte [0x44803c], 1
jmp 0x40a3d3
xor eax, eax
mov byte [0x44803c], al
jmp 0x40a3d3
xor eax, eax
mov byte [0x435745], al
jmp 0x40a3d3
mov edi, dword [ebp + 0xc]
mov eax, esi
sub eax, ebx
mov ecx, esi
sar eax, 1
sub edi, eax
lea eax, [esi + 4]
push eax
mov edx, edi
call fcn.0040f2e0
push 0x3a
pop eax
cmp word [esi], ax
jne 0x41c461
push 3
lea eax, [esi + 2]
push 0x403c1c
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x41c461
mov byte [0x435745], al
jmp 0x41c507
mov byte [0x435745], 1
jmp 0x41c51e
mov edi, dword [ebp + 0xc]
mov eax, esi
sub eax, ebx
mov ecx, esi
sar eax, 1
sub edi, eax
lea eax, [esi + 4]
push eax
mov edx, edi
call fcn.0040f2e0
push 0x3a
pop eax
cmp word [esi], ax
jne 0x41c4b6
push 3
lea eax, [esi + 2]
push 0x403c1c
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x41c4b6
push 0x20
pop eax
mov word [0x42d0d0], ax
mov word [0x42d0cc], ax
jmp 0x41c507
push 6
pop eax
push 4
mov word [0x42d0d0], ax
pop eax
mov word [0x42d0cc], ax
jmp 0x41c51e
mov edi, dword [ebp + 0xc]
mov eax, esi
sub eax, ebx
mov ecx, esi
sar eax, 1
sub edi, eax
lea eax, [esi + 4]
push eax
mov edx, edi
call fcn.0040f2e0
push 0x3a
pop eax
cmp word [esi], ax
jne 0x41c517
push 3
lea eax, [esi + 2]
push 0x403c1c
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x41c517
mov byte [0x435744], al
lea eax, [esi + 8]
jmp 0x41c50f
lea eax, [esi + 6]
push eax
mov edx, edi
jmp 0x40a3e2
mov byte [0x435744], 1
push 3
push 0x403c24
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40a1cb
jmp 0x41c50c
cmp byte [0x435745], 0
je 0x40a54b
push 0x3a
lea edi, [esi + 4]
pop eax
cmp word [edi], ax
jne 0x41c607
movzx eax, word [esi + 6]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x41c607
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
je 0x41c607
movzx eax, word [esi + 0xa]
push eax
call dword [sym.imp.msvcrt.dll_iswxdigit]
pop ecx
test eax, eax
jne 0x41c607
movzx eax, word [esi + 6]
push eax
call dword [sym.imp.msvcrt.dll_iswdigit]
pop ecx
movzx ecx, word [esi + 6]
test eax, eax
je 0x41c5a6
lea eax, [ecx - 0x30]
jmp 0x41c5b4
push ecx
call dword [sym.imp.msvcrt.dll_towlower]
pop ecx
push 0x57
pop ecx
sub ax, cx
movzx eax, ax
shl eax, 4
mov word [0x435754], ax
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.msvcrt.dll_iswdigit]
pop ecx
movzx ecx, word [esi + 8]
test eax, eax
je 0x41c5d9
lea eax, [ecx - 0x30]
jmp 0x41c5e7
push ecx
call dword [sym.imp.msvcrt.dll_towlower]
pop ecx
push 0x57
pop ecx
sub ax, cx
mov edx, dword [ebp + 0xc]
mov ecx, edi
movzx eax, ax
or word [0x435754], ax
lea eax, [esi + 0xa]
push eax
mov eax, esi
sub eax, ebx
sar eax, 1
sub edx, eax
call fcn.0040f2e0
push edi
jmp 0x40a3d7
mov dword [0x448038], 1
jmp 0x40a28e
xor eax, eax
push eax
call fcn.00411df0
test eax, eax
je 0x41c61c
jmp 0x41c3e4
xor ebx, ebx
push ebx
push 0x400023df
call fcn.00407834
pop ecx
pop ecx
push ebx
call fcn.00411df0
test eax, eax
je 0x41c63c
jmp 0x41c3e4
cmp edi, 3
jne 0x40a398
xor ebx, ebx
push ebx
push dword [0x435798]
call fcn.00407834
mov esi, dword [0x435798]
pop ecx
pop ecx
push ebx
call fcn.00411df0
test eax, eax
je 0x41c66a
push esi
jmp 0x41c3e6
mov eax, dword [esp + 0x1c]
mov word [ebx], ax
jmp 0x40a351
mov esi, dword [0x435798]
xor eax, eax
push eax
call fcn.00411df0
test eax, eax
je 0x41c68c
jmp 0x41c674
call fcn.0042984e
xor ebx, ebx
cmp dword [0x43158c], ebx
jne 0x41c731
push ebx
push 0x40002399
call fcn.0040630a
pop ecx
pop ecx
cmp dword [0x43158c], ebx
jne 0x41c731
push ebx
push 0x4000239a
call fcn.0040630a
pop ecx
pop ecx
cmp byte [esp + 0xf], bl
jne 0x41c6dd
cmp byte [0x435745], bl
je 0x41c731
cmp dword [0x43158c], ebx
jne 0x41c731
push ebx
push 0x4000239b
call fcn.0040630a
pop ecx
pop ecx
cmp dword [0x43158c], ebx
jne 0x41c731
push ebx
push 0x4000239c
call fcn.0040630a
pop ecx
pop ecx
cmp dword [0x43158c], ebx
jne 0x41c731
push ebx
push 0x4000239d
call fcn.0040630a
pop ecx
pop ecx
cmp dword [0x43158c], ebx
jne 0x41c731
push ebx
push 0x4000239e
call fcn.0040630a
pop ecx
pop ecx
mov byte [0x448047], bl
mov dword [0x4484fc], ebx
push ebx
call fcn.00411df0
test eax, eax
je 0x41c73d
jmp 0x41c3e4
mov ebx, dword [esp + 0x10]
jmp 0x40a3bc