Function at 0x4062f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x40107c
push esi
push edi
mov dword [esp + 0x18], eax
mov esi, 0x106
mov dword [esp + 0x1c], eax
xor ecx, ecx
push esi
lea eax, [esp + 0xb4]
mov byte [esp + 0x17], cl
push eax
push ecx
mov byte [esp + 0x1e], cl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406361
cmp eax, esi
je 0x406361
push ecx
lea ecx, [esp + 0xb4]
call fcn.00407e1f
mov dword [0x4116e0], eax
mov eax, dword [ebp + 8]
push 3
add eax, 0xfffffffe
pop edi
cmp eax, edi
ja 0x4067e4
mov esi, dword [ebx + 4]
mov al, byte [esi]
cmp al, 0x2d
je 0x406383
cmp al, 0x2f
jne 0x4067e4
inc esi
push 0x4011fc
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x406408
push 0x401204
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x406408
push 0x401208
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x4063f4
push 0x401210
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x4063f4
push 0x401214
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x4067e4
push 0x1000
call fcn.00406b94
pop ecx
xor ebx, ebx
jmp 0x4067d9
mov dword [0x411f00], 0x40b00c
mov dword [esp + 0x18], 0x401208
jmp 0x40641a
mov dword [0x411f00], 0x40b220
mov dword [esp + 0x18], 0x4011fc
cmp dword [ebp + 8], edi
jl 0x4067e4
push 0x40121c
push dword [ebx + 8]
xor eax, eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x406449
xor esi, esi
mov dword [esp + 0x1c], 0x40121c
jmp 0x4064ad
push 0x401220
push dword [ebx + 8]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x40646a
xor esi, esi
mov dword [esp + 0x1c], 0x401220
inc esi
jmp 0x4064ad
mov eax, dword [ebx + 8]
movzx eax, byte [eax]
push eax
call dword [sym.imp.msvcrt.dll_isalpha]
pop ecx
test eax, eax
je 0x4067e4
mov eax, dword [ebx + 8]
cmp byte [eax + 1], 0x3a
jne 0x4067e4
cmp byte [eax + 2], 0
jne 0x4067e4
movsx ax, byte [eax]
push 2
pop esi
mov dword [esp + 0x1c], 0x401224
movzx eax, ax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
cmp eax, 4
je 0x4064ba
cmp eax, 5
jne 0x406524
cmp eax, edi
jle 0x406524
push 0x40122c
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x406519
push 0x401234
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x406519
push 0x40123c
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x406512
push 0x401244
push dword [ebx + edi*4]
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x4067e4
mov byte [esp + 0x12], 1
jmp 0x40651e
mov byte [esp + 0x13], 1
inc edi
cmp edi, dword [ebp + 8]
jl 0x4064be
cmp dword [0x411f00], 0x40b220
mov eax, 0x411f10
mov dword [0x411f14], eax
mov dword [0x411f10], eax
jne 0x406546
push 0x100e
jmp 0x40654b
push 0x100f
call fcn.00406b94
pop ecx
push 0x101d
call fcn.00406b94
mov eax, 0x411f08
pop ecx
mov dword [0x411f0c], eax
mov dword [0x411f08], eax
call fcn.0040577f
mov ebx, eax
test ebx, ebx
jns 0x406594
push 0x1004
call fcn.00406b94
pop ecx
push ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.00406be0
jmp 0x40679f
mov ecx, 0x4011ac
mov edx, 0x405820
push ecx
call fcn.004073d8
mov ebx, eax
test ebx, ebx
jns 0x4065b1
push 0x1010
jmp 0x40657b
cmp esi, 1
je 0x4065bb
cmp esi, 2
jne 0x4065da
xor edi, edi
mov edx, 0x405670
push edi
mov ecx, 0x401150
call fcn.004073d8
mov ebx, eax
test ebx, ebx
jns 0x4065dc
push 0x1005
jmp 0x40657b
xor edi, edi
sub esi, edi
je 0x4066ed
sub esi, 1
je 0x4066c9
sub esi, 1
jne 0x406768
mov ebx, dword [esp + 0x14]
mov ecx, ebx
call fcn.0040779a
cmp eax, 0xffffffff
jne 0x40661a
push 0x1008
call fcn.00406b94
mov ebx, 0xc0000001
jmp 0x40679e
xor edx, edx
mov ecx, eax
mov eax, dword [0x411f08]
inc edx
shl edx, cl
mov esi, 0x411f08
mov ecx, edi
cmp eax, esi
je 0x4066b5
test ecx, ecx
jne 0x406642
test dword [eax + 8], edx
je 0x406642
mov ecx, eax
jmp 0x406645
mov dword [eax + 0xc], edi
mov eax, dword [eax]
cmp eax, esi
jne 0x406635
test ecx, ecx
je 0x4066b5
cmp dword [ecx + 0xc], edi
jne 0x40667a
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x40665e
mov eax, dword [ecx + 0x14]
push eax
movzx eax, bx
push eax
push 0x100a
call fcn.00406b94
add esp, 0xc
mov ebx, 0xc0000001
jmp 0x40679f
cmp byte [esp + 0x12], 0
je 0x406768
mov ecx, dword [ecx + 0x14]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
call fcn.00406e39
mov esi, dword [esp + 0x14]
mov ebx, eax
test ebx, ebx
js 0x4066a8
mov ecx, esi
call fcn.00405398
mov ebx, eax
test esi, esi
je 0x4066db
mov ecx, esi
call fcn.00406a57
jmp 0x4066db
movzx eax, bx
push eax
push 0x1009
call fcn.00406b94
pop ecx
jmp 0x406610
cmp byte [esp + 0x12], 0
je 0x406768
call fcn.004056f5
mov ebx, eax
test ebx, ebx
jns 0x406768
push 0x1082
jmp 0x40657b
lea ecx, [esp + 0x20]
call fcn.00406cb8
mov ebx, eax
test ebx, ebx
jns 0x406706
push 0x1006
jmp 0x40657b
push dword [esp + 0x20]
xor edx, edx
or ecx, 0xffffffff
push edi
inc edx
call fcn.0040547f
mov ecx, dword [esp + 0x20]
mov ebx, eax
call fcn.00406a57
test ebx, ebx
jns 0x40672f
push 0x1007
jmp 0x40657b
cmp byte [esp + 0x12], 0
je 0x406768
lea ecx, [esp + 0x24]
call fcn.00406c3b
mov ebx, eax
test ebx, ebx
jns 0x40674f
push 0x1080
jmp 0x40657b
mov ecx, dword [esp + 0x24]
call fcn.00405398
mov ebx, eax
test ebx, ebx
jns 0x406768
push 0x1081
jmp 0x40657b
mov cl, byte [esp + 0x13]
call fcn.0040625f
mov ebx, eax
test ebx, ebx
js 0x40677e
push 0x100d
jmp 0x40678b
cmp ebx, 0x8000000d
jne 0x406794
push 0x100c
call fcn.00406b94
mov ebx, edi
jmp 0x40679e
push 0x100b
call fcn.00406b94
pop ecx
call fcn.00405437
mov edi, dword [0x411f10]
mov eax, 0x411f10
cmp edi, eax
je 0x4067cf
mov ecx, dword [edi + 8]
mov esi, dword [edi]
call fcn.00406a57
mov ecx, edi
call fcn.00406a57
mov eax, 0x411f10
mov edi, esi
cmp esi, eax
jne 0x4067b3
mov dword [0x411f14], eax
mov dword [0x411f10], eax
call fcn.00406c1e
test ebx, ebx
jns 0x4067ff
jmp 0x4067fc
push 0x1021
call fcn.00406b94
pop ecx
call fcn.00406c1e
mov dword [esp + 0x18], 0x40124c
xor ebx, ebx
inc ebx
mov esi, dword [0x41043c]
lea edi, [esp + 0x40]
push 0x410450
push 0x410438
push 0x405210
lea esi, [esi - 0x10]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x4c]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [0x410458], esi
mov dword [0x41045c], esi
call dword [sym.imp.ADVAPI32.dll_EventRegister]
test eax, eax
jne 0x40684c
mov ecx, dword [0x41043c]
movzx eax, word [ecx]
push eax
push ecx
call fcn.004052a7
cmp dword [0x410438], 4
jbe 0x406992
mov ecx, dword [0x410444]
mov edi, 0x2000
and ecx, edi
mov eax, esi
or eax, ecx
je 0x406992
mov ecx, dword [0x41044c]
mov eax, ecx
and eax, edi
cmp esi, dword [0x410448]
jne 0x406992
cmp eax, ecx
jne 0x406992
movzx eax, byte [esp + 0x13]
lea ecx, [esp + 0x70]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
movzx eax, byte [esp + 0x12]
mov dword [esp + 0x2c], eax
call fcn.0040534a
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x80]
call fcn.0040534a
lea eax, [esp + 0x28]
xor edx, edx
push 4
mov dword [esp + 0x94], eax
lea eax, [esp + 0x30]
pop ecx
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov al, byte [0x404f84]
mov ecx, 0x404ef9
movzx eax, word [0x404efa]
sub ecx, 0x404ee8
mov dword [esp + 0x34], eax
or ecx, 0xb000000
mov eax, dword [0x41043c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x54], edx
movzx eax, word [eax]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x50]
push eax
push 6
push edx
push edx
lea eax, [esp + 0x40]
mov dword [esp + 0x6c], 2
push eax
push dword [0x410454]
mov dword [esp + 0x78], 0x404f04
push dword [0x410450]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 0x37
mov dword [esp + 0x88], 1
call dword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
xor esi, esi
push dword [0x410454]
push dword [0x410450]
call dword [sym.imp.ADVAPI32.dll_EventUnregister]
mov ecx, dword [esp + 0x2c4]
mov eax, ebx
pop edi
mov dword [0x410450], esi
mov dword [0x410454], esi
mov dword [0x410438], esi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a3a0
mov esp, ebp
pop ebp
ret