Function at 0x1005255
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
xor ebx, ebx
pop edi
cmp eax, ebx
mov dword [ebp - 4], edi
je 0x1005702
cmp byte [eax], bl
je 0x1005702
mov dword [ebp + 8], eax
cmp byte [eax], bl
je 0x10056c2
cmp dword [ebp - 4], ebx
je 0x10056c2
mov eax, dword [ebp + 8]
mov cl, byte [eax]
cmp cl, 0x20
je 0x10052b3
cmp cl, 9
je 0x10052b3
cmp cl, 0xd
je 0x10052b3
cmp cl, 0xa
je 0x10052b3
cmp cl, 0xb
je 0x10052b3
cmp cl, 0xc
jne 0x10052bc
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x1005293
cmp byte [eax], bl
je 0x10056c2
xor ecx, ecx
xor edx, edx
mov dword [ebp + 8], eax
xor esi, esi
cmp edx, ebx
jne 0x10052f2
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x20
je 0x10052ee
cmp al, 9
je 0x10052ee
cmp al, 0xd
je 0x10052ee
cmp al, 0xa
je 0x10052ee
cmp al, 0xb
je 0x10052ee
cmp al, 0xc
jne 0x10052f6
cmp edx, ebx
je 0x1005338
cmp esi, ebx
jne 0x1005338
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x22
jne 0x1005326
mov eax, dword [ebp + 8]
inc eax
cmp byte [eax], 0x22
je 0x1005317
cmp edx, ebx
jne 0x1005310
mov edx, edi
jmp 0x1005312
mov esi, edi
mov dword [ebp + 8], eax
jmp 0x1005331
mov byte [ebp + ecx - 0x10c], 0x22
inc ecx
add dword [ebp + 8], 2
jmp 0x1005331
mov byte [ebp + ecx - 0x10c], al
inc ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x10052cd
cmp edx, ebx
mov byte [ebp + ecx - 0x10c], bl
je 0x100534f
cmp esi, ebx
jne 0x1005357
cmp edx, ebx
jne 0x10056bf
cmp esi, ebx
jne 0x10056bf
cmp byte [ebp - 0x10c], 0x2f
je 0x100536d
cmp byte [ebp - 0x10c], 0x2d
jne 0x10056bb
movsx eax, byte [ebp - 0x10b]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
movsx eax, al
sub eax, 0x3f
je 0x1005694
sub eax, 4
je 0x10055ee
dec eax
je 0x1005549
sub eax, 0xa
je 0x10054d7
push 3
pop ecx
sub eax, ecx
je 0x100548d
dec eax
je 0x10053bd
dec eax
dec eax
je 0x1005549
jmp 0x10056b0
cmp byte [ebp - 0x10a], bl
jne 0x10053d6
mov dword [0x100b6cc], ecx
mov dword [0x100aaa8], edi
jmp 0x10056b3
cmp byte [ebp - 0x10a], 0x3a
jne 0x100546e
cmp byte [ebp - 0x109], bl
mov dword [0x100b6cc], edi
je 0x10056b3
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x41
je 0x1005458
sub eax, 3
je 0x100544f
sub eax, 5
je 0x1005446
sub eax, 5
je 0x100543d
dec eax
dec eax
je 0x1005434
sub eax, 3
je 0x100542b
mov dword [ebp - 4], ebx
jmp 0x1005465
or dword [0x100b6cc], 4
jmp 0x100545f
or byte [0x100adc8], 0x80
jmp 0x1005465
and dword [0x100b6cc], 0xfffffffe
jmp 0x100545f
and dword [0x100b6cc], 0xfffffffd
jmp 0x100545f
or dword [0x100adc8], 0x40
jmp 0x1005465
or dword [0x100b6cc], 2
mov dword [0x100aaa8], edi
cmp byte [esi], bl
jne 0x10053fb
jmp 0x10056b3
lea eax, [ebp - 0x10b]
push eax
push 0x10014cc
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10056b3
jmp 0x10056b0
cmp byte [ebp - 0x10a], bl
je 0x10054c9
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056b0
movsx eax, byte [ebp - 0x109]
push eax
call esi
cmp al, 0x31
je 0x10054c9
cmp al, 0x41
je 0x10054bd
cmp al, 0x55
je 0x10054c9
jmp 0x10056b0
mov word [0x100aab8], di
jmp 0x10056b3
mov word [0x100aab8], 2
jmp 0x10056b3
cmp byte [ebp - 0x10a], bl
jne 0x10054ea
mov dword [0x100aaac], edi
jmp 0x10056b3
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056b0
cmp byte [ebp - 0x109], bl
je 0x10056b3
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x45
je 0x100553a
dec eax
dec eax
je 0x1005532
sub eax, 0xf
je 0x100552a
mov dword [ebp - 4], ebx
jmp 0x1005540
mov dword [0x100aab4], edi
jmp 0x1005540
mov dword [0x100aab0], edi
jmp 0x1005540
mov dword [0x100aaac], edi
cmp byte [esi], bl
jne 0x1005509
jmp 0x10056b3
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056b0
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1005672
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010051d9
test eax, eax
je 0x1005672
movsx eax, byte [ebp - 0x10b]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
cmp al, 0x54
mov eax, dword [ebp - 8]
jne 0x10055b8
add eax, esi
mov esi, 0x100abbe
lea eax, [ebp + eax - 0x10c]
push eax
jmp 0x10055c7
add eax, esi
mov esi, 0x100aaba
lea eax, [ebp + eax - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10012d4
push esi
call fcn.01005aa9
mov eax, esi
push eax
call fcn.01002cc6
test eax, eax
je 0x10056bb
jmp 0x100568f
cmp byte [ebp - 0x10a], bl
jne 0x1005601
mov dword [0x100aaa4], edi
jmp 0x10056b3
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056b0
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1005672
push 0x5b
push edi
call fcn.01005a29
test eax, eax
je 0x1005649
push 0x5d
push edi
call fcn.01005a29
test eax, eax
je 0x1005672
push 0x5d
push edi
call fcn.01005a29
test eax, eax
je 0x1005661
push 0x5b
push edi
call fcn.01005a29
test eax, eax
je 0x1005672
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010051d9
test eax, eax
jne 0x1005677
mov dword [ebp - 4], ebx
jmp 0x100568f
mov eax, dword [ebp - 8]
add eax, esi
lea eax, [ebp + eax - 0x10c]
push eax
push 0x100acc2
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop edi
jmp 0x10056b3
call fcn.01001b37
mov eax, dword [0x100aa80]
cmp eax, ebx
je 0x10056a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
jmp 0x100527f
xor eax, eax
jmp 0x1005704
mov dword [ebp - 4], ebx
cmp dword [0x100aaac], ebx
je 0x10056fd
cmp byte [0x100abbe], bl
jne 0x10056fd
mov esi, 0x100abbe
push 0x104
push esi
push dword [0x100b6dc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10056fa
push 0x5c
push esi
call fcn.01005a77
mov byte [eax + 1], bl
jmp 0x10056fd
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
jmp 0x1005704
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4