Function at 0x41b805
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4f8004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x234], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push esi
mov dword [ebp - 0x228], esi
call ebx
test eax, eax
je 0x41c2fd
push edi
push esi
call ebx
lea eax, [eax*2 + 2]
push eax
push 0x40
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push esi
mov dword [ebp - 0x238], edi
call ebx
lea eax, [eax*2 + 2]
push eax
push 0x40
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x228]
mov esi, eax
mov dword [ebp - 0x220], esi
call ebx
lea eax, [eax*2 + 2]
push eax
push 0x40
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 0x228]
mov edx, edi
push eax
mov dword [ebp - 0x224], eax
call fcn.00411058
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
pop ecx
mov dword [ebp - 0x230], CreateMappedBitmap
mov ecx, dword [ebp - 0x224]
mov edx, edi
push esi
call fcn.00411058
pop ecx
test eax, eax
je 0x41c2e8
cmp dword [ebp - 0x22c], 0
jne 0x41c19b
push 0x4c3c58
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41b902
mov dword [0x5235ec], 2
inc eax
jmp 0x41b918
push 0x4c3c5c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41b923
inc eax
mov dword [0x5235ec], eax
mov dword [ebp - 0x22c], eax
jmp case.0x41bb35.64
movzx eax, word [edi]
cmp eax, 0x2f
je 0x41b937
push 0x2d
pop ecx
cmp ax, cx
jne 0x41c19b
mov ecx, edi
call fcn.00410f99
push 0x4c3c68
push edi
call ebx
test eax, eax
je 0x41c18e
push 0x4c3c74
push edi
call ebx
test eax, eax
je 0x41c18e
push 0x4c3c78
push edi
call ebx
test eax, eax
je 0x41c18e
push str.UNICODE
push edi
call ebx
test eax, eax
je 0x41c17f
push 0x4c3c94
push edi
call ebx
test eax, eax
je 0x41c17f
push 0x4c3c98
push edi
call ebx
test eax, eax
je 0x41c170
push str.UNICODE_BE
push edi
call ebx
test eax, eax
je 0x41c170
push str.UTF8
push edi
call ebx
test eax, eax
je 0x41c161
push 0x4c3cd0
push edi
call ebx
test eax, eax
je 0x41c161
push str.UTF8SIG
push edi
call ebx
test eax, eax
je 0x41c152
push str.UTF_8SIG
push edi
call ebx
test eax, eax
je 0x41c152
push str.UTF8SIGNATURE
push edi
call ebx
test eax, eax
je 0x41c152
push str.UTF_8SIGNATURE
push edi
call ebx
test eax, eax
je 0x41c152
push str.UTF8_SIGNATURE
push edi
call ebx
test eax, eax
je 0x41c152
push str.UTF_8_SIGNATURE
push edi
call ebx
test eax, eax
je 0x41c152
push str.CRLF
push edi
call ebx
test eax, eax
je 0x41c145
push 0x4c2dc4
push edi
call ebx
test eax, eax
je 0x41c145
push 0x4c3d88
push edi
call ebx
test eax, eax
jne 0x41ba69
mov dword [0x522fb8], 2
jmp case.0x41bb35.64
push 0x4c3d90
push edi
call ebx
test eax, eax
jne 0x41ba84
mov dword [0x522fb8], 3
jmp case.0x41bb35.64
push 6
push str.appid
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x41bad9
push 0x20
lea eax, [edi + 0xc]
push eax
push 0x523a18
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push 0x4bc6e8
push 0x523a18
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
push 0x523a18
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne case.0x41bb35.64
push str._default_
push 0x523a18
jmp 0x41bbd7
push 7
push str.sysmru
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x41bb1f
push 8
lea eax, [edi + 0xe]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push 0x4bc6e8
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
xor eax, eax
cmp word [ebp - 0x14], 0x31
sete al
inc eax
mov dword [0x5235e0], eax
jmp case.0x41bb35.64
push edi
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [eax]
add eax, 0xffffffc1
cmp eax, 0x1b
ja case.0x41bb35.64
jmp dword [eax*4 + 0x41c30d]
xor eax, eax
mov dword [0x5235fc], eax
inc eax
mov dword [0x5233cc], eax
lea eax, [edi + 2]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x53
xor ecx, ecx
pop edx
cmp word [eax], dx
sete cl
mov dword [0x523d94], ecx
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x5235fc], eax
xor eax, eax
jmp 0x41bb44
push 0x30
lea eax, [edi + 2]
pop ecx
cmp word [eax], cx
je 0x41bbcd
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x4f
pop ecx
cmp word [eax], cx
je 0x41bbcd
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je case.0x41bb35.64
push 0x104
push edi
push 0x522d98
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov ecx, 0x522d98
call fcn.00410fe6
push 0x522d98
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
jmp case.0x41bb35.64
push 0x4c3db8
push 0x522d98
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x524fcc], eax
jmp case.0x41bb35.64
lea ecx, [edi + 2]
movzx eax, word [ecx]
push 0x30
pop edx
cmp ax, dx
je 0x41bc19
push 0x2d
pop edx
cmp ax, dx
je 0x41bc19
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x4f
pop ecx
cmp word [eax], cx
je 0x41bc19
push 2
pop eax
jmp 0x41bc1c
xor eax, eax
inc eax
mov dword [0x523da4], eax
jmp case.0x41bb35.64
push 4
push str.POS:
push edi
mov esi, edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x41bd04
lea esi, [edi + 6]
add esi, 2
push 0x30
pop eax
cmp word [esi], ax
je 0x41be97
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x4f
pop ecx
cmp word [eax], cx
je 0x41be97
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
cmp word [eax], 0x44
je 0x41be73
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x53
pop ecx
cmp word [eax], cx
je 0x41be73
movzx eax, word [esi]
push eax
push str.FLTRBM
call dword [sym.imp.SHLWAPI.dll_StrChrIW]
test eax, eax
je 0x41bdd1
xor eax, eax
inc eax
mov dword [0x523a14], eax
xor eax, eax
mov dword [0x523a60], eax
cmp word [esi], ax
je 0x41bdb9
push 0x40
xor ebx, ebx
pop edi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [eax]
sub eax, 0x42
je 0x41bd8b
sub eax, 4
je 0x41bd7f
sub eax, 6
je 0x41bd72
sub eax, 1
je 0x41bd61
sub eax, 5
je 0x41bd54
dec eax
sub eax, 1
jne 0x41bd9b
mov eax, dword [0x523a60]
and eax, 0xffffff9f
or eax, 0x10
jmp 0x41bd96
push 3
push 0x4c3dcc
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x41bd1e
lea esi, [edi + 4]
jmp 0x41bc41
movzx ecx, word [edi + 2]
cmp ecx, 0x3a
jne 0x41bd2f
lea esi, [edi + 2]
jmp 0x41bc41
cmp dword [ebp - 0x234], 0
je 0x41bc41
mov esi, dword [ebp - 0x220]
cmp ecx, 0x54
jne case.0x41bb35.64
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
pop ecx
jmp case.0x41bb35.64
mov eax, dword [0x523a60]
and eax, 0xffffffbb
or eax, 8
jmp 0x41bd96
mov eax, dword [0x523a60]
test eax, eax
cmove eax, edi
or eax, 0x80
jmp 0x41bd96
mov eax, dword [0x523a60]
and eax, 0xffffffb7
or eax, 4
jmp 0x41bd96
mov eax, dword [0x523a60]
and eax, 0xffffffc3
or eax, edi
jmp 0x41bd96
mov eax, dword [0x523a60]
and eax, 0xffffffaf
or eax, 0x20
mov dword [0x523a60], eax
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
cmp word [esi], bx
jne 0x41bcbb
mov edi, dword [ebp - 0x238]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, dword [ebp - 0x220]
push esi
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41b8c1
mov esi, dword [ebp - 0x220]
mov edx, edi
push esi
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je case.0x41bb35.64
push 0x52a130
push 0x52a12c
push 0x52a128
push 0x52a124
push 0x52a120
push str._i__i__i__i__i
push edi
call fcn.0040f550
mov ecx, eax
add esp, 0x1c
cmp ecx, 4
je 0x41be19
cmp ecx, 5
jne case.0x41bb35.64
xor eax, eax
xor edx, edx
inc edx
mov dword [0x523a60], eax
mov eax, dword [0x52a128]
cmp eax, edx
mov dword [0x523a14], edx
cmovl eax, dword [ebp - 0x230]
mov dword [0x52a128], eax
mov eax, dword [0x52a12c]
cmp eax, edx
cmovl eax, dword [ebp - 0x230]
mov dword [0x52a12c], eax
mov eax, dword [0x52a130]
test eax, eax
cmovne eax, edx
mov dword [0x52a130], eax
cmp ecx, 4
jne case.0x41bb35.64
xor eax, eax
mov dword [0x52a130], eax
jmp case.0x41bb35.64
xor eax, eax
push 0x4c
inc eax
push esi
mov dword [0x523a14], eax
call dword [sym.imp.SHLWAPI.dll_StrChrIW]
neg eax
sbb eax, eax
neg eax
add eax, 2
mov dword [0x523a60], eax
jmp 0x41bdb9
xor eax, eax
inc eax
mov dword [0x523a14], eax
jmp 0x41be8d
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je case.0x41bb35.64
push 0x80
push edi
push 0x523a68
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
xor eax, eax
inc eax
mov dword [0x523d9c], eax
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x5235e8], eax
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x523b88], eax
jmp case.0x41bb35.64
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je case.0x41bb35.64
mov eax, dword [0x523a5c]
test eax, eax
je 0x41bf0f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov dword [0x523a5c], eax
jmp case.0x41bb35.64
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je case.0x41bb35.64
push 0x52a5bc
push 0x5278a8
push str._i__i
push edi
call fcn.0040f550
xor ecx, ecx
add esp, 0x10
inc ecx
cmp eax, ecx
je 0x41bf5b
cmp eax, 2
jne case.0x41bb35.64
mov dword [0x523d90], ecx
jmp case.0x41bb35.64
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2d
pop eax
push eax
push edi
call ebx
push 1
xor ecx, ecx
test eax, eax
pop eax
push 0x52
mov esi, ecx
push edi
cmovne esi, eax
call ebx
push 1
xor ecx, ecx
test eax, eax
pop eax
push 0x42
mov ebx, ecx
push edi
cmovne ebx, eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
xor ecx, ecx
mov edx, edi
test eax, eax
push 1
pop eax
cmovne ecx, eax
mov dword [ebp - 0x23c], ecx
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.00411058
pop ecx
test eax, eax
je 0x41bdb3
mov eax, dword [0x5235dc]
test eax, eax
je 0x41bfd0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov dword [0x5235dc], eax
xor eax, eax
inc eax
mov dword [0x523b8c], eax
test esi, esi
je 0x41bff0
push 3
pop eax
mov dword [0x523b8c], eax
test ebx, ebx
je 0x41bffc
or eax, 4
mov dword [0x523b8c], eax
cmp dword [ebp - 0x23c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, dword [ebp - 0x220]
je case.0x41bb35.64
and eax, 0xfffffffb
or eax, 8
mov dword [0x523b8c], eax
jmp case.0x41bb35.64
lea ecx, [edi + 2]
movzx eax, word [ecx]
push 0x30
pop edx
cmp ax, dx
je 0x41c04f
push 0x2d
pop edx
cmp ax, dx
je 0x41c04f
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x4f
pop ecx
cmp word [eax], cx
je 0x41c04f
push 2
pop eax
jmp 0x41c052
xor eax, eax
inc eax
mov dword [0x5235f8], eax
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x523a64], eax
jmp case.0x41bb35.64
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je case.0x41bb35.64
mov eax, dword [0x5235e4]
test eax, eax
je 0x41c08c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov dword [0x5235e4], eax
xor eax, eax
inc eax
mov dword [0x523b78], eax
jmp case.0x41bb35.64
mov eax, dword [0x5235e4]
test eax, eax
je 0x41c0be
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [0x5235e4], eax
jmp 0x41c0c0
xor eax, eax
mov dword [0x526cd8], eax
jmp 0x41c098
mov eax, dword [0x5235e4]
test eax, eax
je 0x41c0de
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [0x5235e4], eax
mov dword [0x526cd8], 0x22
jmp 0x41c098
mov eax, dword [0x5235e4]
test eax, eax
je 0x41c101
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [0x5235e4], eax
mov dword [0x526cd8], 0x23
jmp 0x41c098
xor eax, eax
inc eax
mov dword [0x523b68], eax
jmp case.0x41bb35.64
push esi
mov edx, edi
mov ecx, esi
call fcn.00411058
xor eax, eax
inc eax
pop ecx
mov dword [0x5235ec], eax
mov dword [ebp - 0x234], eax
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x523800], eax
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x522fb8], eax
jmp case.0x41bb35.64
mov dword [0x523b80], 5
jmp case.0x41bb35.64
mov dword [0x523b80], 4
jmp case.0x41bb35.64
mov dword [0x523b80], 3
jmp case.0x41bb35.64
mov dword [0x523b80], 2
jmp case.0x41bb35.64
xor eax, eax
inc eax
mov dword [0x523b80], eax
jmp case.0x41bb35.64
push dword [ebp - 0x228]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
lea eax, [eax*2 + 2]
push eax
push 0x40
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x224]
mov ebx, eax
call esi
push dword [ebp - 0x228]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, esi
mov dword [0x523a10], eax
mov eax, dword [0x5235d8]
test eax, eax
je 0x41c1ea
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x20c
push 0x40
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [ebp - 0x224]
push 0x104
push esi
push eax
mov dword [0x5235d8], eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push dword [0x5235d8]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x41c287
push dword [0x5235d8]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x41c287
push dword [0x5235d8]
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
jne 0x41c287
push 0x523808
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push dword [0x5235d8]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
push eax
push dword [0x5235d8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4c2ebc
push dword [0x5235d8]
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
cmp dword [0x523b6c], 0x20
jge 0x41c2d7
push esi
mov edx, ebx
mov ecx, esi
call fcn.00411058
pop ecx
test eax, eax
je 0x41c2d7
push ebx
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push ebx
call dword [sym.imp.SHLWAPI.dll_StrDupW]
mov ecx, dword [0x523b6c]
mov dword [ecx*4 + 0x527600], eax
inc ecx
mov dword [0x523b6c], ecx
cmp ecx, 0x20
jl 0x41c2a1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
mov esi, dword [ebp - 0x220]
jmp 0x41c2ee
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call ebx
push esi
call ebx
push dword [ebp - 0x224]
call ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00486c63
leave
ret