Function at 0x1002eaf
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x10080d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push 7
pop ecx
xor eax, eax
push 7
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
lea edi, reloc.NETAPI32.dll_NetApiBufferFree
rep stosd dword es:[edi], eax
pop ecx
lea edi, reloc.NETAPI32.dll_NetApiBufferFree
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
push esi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], ebx
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x3b00
mov byte [ebp - 0x41c], 0
rep stosd dword es:[edi], eax
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1008c74], eax
cmp eax, esi
jne 0x1002f5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0x1001548
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0xc
jmp 0x1002f68
call fcn.01006650
test eax, eax
jne 0x1002f79
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0100493c
leave
ret
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jle 0x1003218
mov edi, esi
mov edx, dword [ebx + eax*4]
movzx ecx, word [edx]
lea esi, [eax + 1]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
cmp cx, 0x2d
je 0x1002fcc
cmp cx, 0x2f
je 0x1002fcc
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
jne 0x10031ee
cmp edi, 6
je 0x10031ee
cmp edi, 7
je 0x10031ee
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edx
jmp 0x10031bd
inc edx
inc edx
movzx eax, word [edx]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edx
jmp 0x10031b4
push eax
call dword [sym.imp.msvcrt.dll_towupper]
movzx eax, ax
cmp eax, 0x51
pop ecx
jg 0x10030dc
je 0x10030af
sub eax, 0x41
je 0x100308e
dec eax
dec eax
je 0x100306f
dec eax
je 0x1003041
dec eax
dec eax
je 0x1003035
sub eax, 6
je 0x1003027
sub eax, 4
jne 0x10031fe
mov dword [0x1008c4c], 1
jmp 0x10031a4
test edi, edi
jne 0x10031fe
inc edi
jmp 0x100319e
mov byte [ebp - 0x41c], 1
jmp 0x10031a4
test edi, edi
jne 0x10031fe
cmp esi, dword [ebp + 8]
jge 0x10031fe
cmp esi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
jne 0x10031fe
push 4
mov eax, dword [ebx + esi*4]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
inc esi
jmp 0x100319d
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x200
je 0x10031fe
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x3800
jmp 0x10031a4
test edi, edi
jne 0x10031fe
cmp esi, dword [ebp + 8]
jge 0x10031fe
cmp esi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
jne 0x10031fe
push 3
jmp 0x1003060
test edi, edi
jne 0x10031fe
cmp esi, dword [ebp + 8]
jge 0x10031fe
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
jne 0x10031fe
cmp esi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
jne 0x10031fe
push 6
jmp 0x1003060
sub eax, 0x52
je 0x1003197
dec eax
je 0x100317f
dec eax
je 0x1003132
dec eax
je 0x1003116
sub eax, 3
jne 0x10031fe
test edi, edi
jne 0x10031fe
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
jne 0x10031fe
push 7
jmp 0x100319d
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x3800
je 0x10031fe
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x200
jmp 0x10031a4
cmp esi, dword [ebp + 8]
jge 0x10031fe
cmp esi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
jne 0x10031fe
cmp word [ebp - 0x418], 8
jae 0x100316a
movzx eax, word [ebp - 0x418]
mov ecx, dword [ebx + esi*4]
inc dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [ebp + eax*4 - reloc.NETAPI32.dll_NetApiBufferFree], ecx
jmp 0x100317c
push dword [ebx + esi*4]
push 0x2744
push 0xfffffffffffffff4
call fcn.010044e9
add esp, 0xc
inc esi
jmp 0x10031a4
test edi, edi
jne 0x10031fe
cmp esi, dword [ebp + 8]
jge 0x10031fe
cmp esi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
jne 0x10031fe
push 5
jmp 0x1003060
test edi, edi
jne 0x10031fe
push 2
pop edi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
add dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 2
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
movzx eax, word [eax]
test ax, ax
jne 0x1002fdc
cmp esi, dword [ebp + 8]
mov eax, esi
jl 0x1002f87
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x3b00
je 0x1003205
cmp edi, 6
je 0x10031de
cmp edi, 7
jne 0x1003205
push 0x2746
push 0xfffffffffffffff4
call fcn.010044e9
pop ecx
pop ecx
jmp 0x10031fe
push edx
push 0x2745
push 0xfffffffffffffff4
call fcn.010044e9
add esp, 0xc
push dword [ebx]
call fcn.01002e7e
cmp edi, 6
je 0x100321f
cmp edi, 7
je 0x100321f
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
jne 0x100321f
push 0x2748
jmp 0x10031e3
cmp byte [ebp - 0x41c], 0
jne 0x1003232
cmp word [ebp - 0x418], 0
je 0x1003252
cmp edi, 6
je 0x1003248
cmp edi, 7
je 0x1003248
cmp edi, 5
je 0x1003248
push 0x2747
jmp 0x10031e3
cmp word [ebp - 0x418], 0
jne 0x1003266
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
mov dword [ebp - 0x47c], 0x100145c
cmp edi, 6
je 0x1003279
cmp edi, 7
je 0x1003279
cmp edi, 5
jne 0x1003426
movzx eax, word [ebp - 0x418]
and dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
and dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
test eax, eax
jle 0x10033f8
movzx eax, byte [ebp - 0x41c]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
mov esi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
lea esi, reloc.NETAPI32.dll_NetApiBufferFree
mov eax, dword [esi]
mov ecx, 0x1001544
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10032dd
test dx, dx
je 0x10032d9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10032dd
add eax, 4
add ecx, 4
test dx, dx
jne 0x10032b7
xor eax, eax
jmp 0x10032e2
sbb eax, eax
sbb eax, reloc.NETAPI32.dll_NetApiBufferFree
test eax, eax
jne 0x10032ec
mov dword [esi], 0x100145c
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push dword [ebp - 0x454]
push 0
push dword [esi]
call fcn.01003ed1
test eax, eax
jne 0x10033b5
mov edi, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
xor ebx, ebx
mov eax, dword [ebp + ebx*4 - reloc.NETAPI32.dll_NetApiBufferFree]
test eax, eax
je 0x1003354
mov ecx, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003345
test dx, dx
je 0x1003341
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003345
add eax, 4
add ecx, 4
test dx, dx
jne 0x100331f
xor eax, eax
jmp 0x100334a
sbb eax, eax
sbb eax, reloc.NETAPI32.dll_NetApiBufferFree
test eax, eax
je 0x1003354
inc ebx
cmp ebx, 8
jl 0x1003312
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
cmp dword [eax], 0
push edi
je 0x100338c
push dword [esi]
xor eax, eax
cmp byte [ebp - 0x41c], al
setne al
add eax, 0x2749
push eax
push 0xfffffffffffffff4
call fcn.010044e9
push dword [ebp - 0x448]
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x14
jmp 0x10033d3
mov dword [eax], edi
xor eax, eax
cmp byte [ebp - 0x41c], al
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
setne al
add eax, 0x274b
push eax
push 0xfffffffffffffff5
call fcn.010044e9
add esp, 0xc
jmp 0x10033d6
push eax
push dword [esi]
xor eax, eax
cmp byte [ebp - 0x41c], al
setne al
add eax, 0x274d
push eax
push 0xfffffffffffffff4
call fcn.010044e9
add esp, 0x10
and dword [esi], 0
movzx eax, word [ebp - 0x418]
inc dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
jl 0x10032a3
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
jne 0x1003426
xor eax, eax
cmp byte [ebp - 0x41c], al
setne al
add eax, 0x274f
push eax
push 0xfffffffffffffff4
call fcn.010044e9
pop ecx
pop ecx
mov dword [ebp - 0x47c], 0x100145c
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
mov ebx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
test ebx, ebx
jl 0x100379c
cmp ebx, 1
jle 0x10036f0
cmp ebx, 2
je 0x100367e
jle 0x100379c
cmp ebx, 5
jle 0x1003546
cmp ebx, 6
je 0x100349b
cmp ebx, 7
jne 0x100379c
cmp byte [ebp - 0x41c], 0
je 0x100347a
push 0x2733
push 0xfffffffffffffff5
call fcn.010044e9
pop ecx
pop ecx
push dword [ebp - 0x418]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
movzx eax, byte [ebp - 0x41c]
push eax
push 0
call fcn.01003c8c
jmp 0x10037aa
push dword [ebp - 0x424]
call fcn.01002e57
test al, al
je 0x10034cc
push dword [ebp - 0x424]
push 0x2732
push 0xfffffffffffffff4
call fcn.010044e9
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
add esp, 0xc
push dword [eax]
jmp 0x1003200
movzx ebx, word [ebp - 0x418]
xor edi, edi
cmp ebx, edi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
jle 0x10037aa
lea esi, reloc.NETAPI32.dll_NetApiBufferFree
mov eax, dword [esi]
test eax, eax
je 0x100352d
cmp word [ebp - 0x418], 1
jbe 0x1003516
push eax
xor eax, eax
cmp byte [ebp - 0x41c], al
setne al
add eax, 0x274b
push eax
push 0xfffffffffffffff5
call fcn.010044e9
add esp, 0xc
push dword [ebp - 0x41c]
push dword [ebp - 0x424]
push dword [esi]
call fcn.01002de6
test eax, eax
je 0x1003537
inc edi
cmp edi, ebx
jl 0x10034e3
jmp 0x10037aa
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
jmp 0x10037aa
push dword [ebp - 0x424]
call fcn.01002e57
push dword [ebp - 0x424]
test al, al
jne 0x10034b0
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push 0x5c
push dword [ebp - 0x420]
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10035a3
push dword [ebp - 0x420]
xor eax, eax
mov word [esi], ax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push 0x103
add esi, 2
push esi
jmp 0x10035bc
push 0x100145c
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push 0x103
push dword [ebp - 0x420]
mov esi, 0x104
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push esi
push eax
call fcn.01004cc2
xor eax, eax
mov word [ebp - 8], ax
add esp, 0x10
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
mov word [ebp - 0x442], si
cmp ebx, 4
jne 0x10035f8
push 2
pop esi
jmp 0x10035fa
xor esi, esi
cmp ebx, 5
sete byte [ebp - 0x43c]
cmp byte [ebp - 0x43c], 0
je 0x1003624
cmp byte [ebp - 0x41c], 0
je 0x1003624
push 0x2733
push 0xfffffffffffffff5
call fcn.010044e9
pop ecx
pop ecx
push dword [ebp - 0x418]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push dword [ebp - 0x430]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push dword [ebp - 0x41c]
push dword [ebp - 0x43c]
push esi
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call fcn.010025c9
test eax, eax
je 0x10037aa
push 0x2731
push 0xfffffffffffffff5
call fcn.010044e9
and dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
jmp 0x10037a8
push 0x103
push dword [ebp - 0x420]
mov esi, 0x104
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push esi
push eax
call fcn.01004cc2
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
add esp, 0x10
mov word [ebp - 0x210], ax
push 0x1001538
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push dword [ebp - 0x430]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov word [ebp - 0x45a], si
call fcn.0100222e
jmp 0x100365e
push 0x5c
push dword [ebp - 0x420]
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100372b
push dword [ebp - 0x420]
xor eax, eax
mov word [esi], ax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push 0x103
add esi, 2
push esi
jmp 0x1003744
push 0x100145c
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push 0x103
push dword [ebp - 0x420]
mov esi, 0x104
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push esi
push eax
call fcn.01004cc2
xor eax, eax
mov word [ebp - 8], ax
add esp, 0x10
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call edi
push dword [ebp - 0x430]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov word [ebp - 0x442], si
call fcn.01002919
test eax, eax
je 0x10037aa
and dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
jmp 0x10037aa
push 0x2751
push 0xfffffffffffffff4
call fcn.010044e9
pop ecx
pop ecx
xor esi, esi
mov eax, dword [ebp + esi*4 - reloc.NETAPI32.dll_NetApiBufferFree]
test eax, eax
je 0x10037bf
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
inc esi
cmp esi, 8
jl 0x10037ac
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_ExitProcess]