Function at 0x1005247
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
xor ebx, ebx
pop edi
cmp eax, ebx
mov dword [ebp - 4], edi
je 0x10056f4
cmp byte [eax], bl
je 0x10056f4
mov dword [ebp + 8], eax
cmp byte [eax], bl
je 0x10056b4
cmp dword [ebp - 4], ebx
je 0x10056b4
mov eax, dword [ebp + 8]
mov cl, byte [eax]
cmp cl, 0x20
je 0x10052a5
cmp cl, 9
je 0x10052a5
cmp cl, 0xd
je 0x10052a5
cmp cl, 0xa
je 0x10052a5
cmp cl, 0xb
je 0x10052a5
cmp cl, 0xc
jne 0x10052ae
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x1005285
cmp byte [eax], bl
je 0x10056b4
xor ecx, ecx
xor edx, edx
mov dword [ebp + 8], eax
xor esi, esi
cmp edx, ebx
jne 0x10052e4
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x20
je 0x10052e0
cmp al, 9
je 0x10052e0
cmp al, 0xd
je 0x10052e0
cmp al, 0xa
je 0x10052e0
cmp al, 0xb
je 0x10052e0
cmp al, 0xc
jne 0x10052e8
cmp edx, ebx
je 0x100532a
cmp esi, ebx
jne 0x100532a
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x22
jne 0x1005318
mov eax, dword [ebp + 8]
inc eax
cmp byte [eax], 0x22
je 0x1005309
cmp edx, ebx
jne 0x1005302
mov edx, edi
jmp 0x1005304
mov esi, edi
mov dword [ebp + 8], eax
jmp 0x1005323
mov byte [ebp + ecx - 0x10c], 0x22
inc ecx
add dword [ebp + 8], 2
jmp 0x1005323
mov byte [ebp + ecx - 0x10c], al
inc ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x10052bf
cmp edx, ebx
mov byte [ebp + ecx - 0x10c], bl
je 0x1005341
cmp esi, ebx
jne 0x1005349
cmp edx, ebx
jne 0x10056b1
cmp esi, ebx
jne 0x10056b1
cmp byte [ebp - 0x10c], 0x2f
je 0x100535f
cmp byte [ebp - 0x10c], 0x2d
jne 0x10056ad
movsx eax, byte [ebp - 0x10b]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
movsx eax, al
sub eax, 0x3f
je 0x1005686
sub eax, 4
je 0x10055e0
dec eax
je 0x100553b
sub eax, 0xa
je 0x10054c9
push 3
pop ecx
sub eax, ecx
je 0x100547f
dec eax
je 0x10053af
dec eax
dec eax
je 0x100553b
jmp 0x10056a2
cmp byte [ebp - 0x10a], bl
jne 0x10053c8
mov dword [0x100b6cc], ecx
mov dword [0x100aaa8], edi
jmp 0x10056a5
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005460
cmp byte [ebp - 0x109], bl
mov dword [0x100b6cc], edi
je 0x10056a5
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x41
je 0x100544a
sub eax, 3
je 0x1005441
sub eax, 5
je 0x1005438
sub eax, 5
je 0x100542f
dec eax
dec eax
je 0x1005426
sub eax, 3
je 0x100541d
mov dword [ebp - 4], ebx
jmp 0x1005457
or dword [0x100b6cc], 4
jmp 0x1005451
or byte [0x100adc8], 0x80
jmp 0x1005457
and dword [0x100b6cc], 0xfffffffe
jmp 0x1005451
and dword [0x100b6cc], 0xfffffffd
jmp 0x1005451
or dword [0x100adc8], 0x40
jmp 0x1005457
or dword [0x100b6cc], 2
mov dword [0x100aaa8], edi
cmp byte [esi], bl
jne 0x10053ed
jmp 0x10056a5
lea eax, [ebp - 0x10b]
push eax
push 0x10014cc
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10056a5
jmp 0x10056a2
cmp byte [ebp - 0x10a], bl
je 0x10054bb
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056a2
movsx eax, byte [ebp - 0x109]
push eax
call esi
cmp al, 0x31
je 0x10054bb
cmp al, 0x41
je 0x10054af
cmp al, 0x55
je 0x10054bb
jmp 0x10056a2
mov word [0x100aab8], di
jmp 0x10056a5
mov word [0x100aab8], 2
jmp 0x10056a5
cmp byte [ebp - 0x10a], bl
jne 0x10054dc
mov dword [0x100aaac], edi
jmp 0x10056a5
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056a2
cmp byte [ebp - 0x109], bl
je 0x10056a5
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x45
je 0x100552c
dec eax
dec eax
je 0x1005524
sub eax, 0xf
je 0x100551c
mov dword [ebp - 4], ebx
jmp 0x1005532
mov dword [0x100aab4], edi
jmp 0x1005532
mov dword [0x100aab0], edi
jmp 0x1005532
mov dword [0x100aaac], edi
cmp byte [esi], bl
jne 0x10054fb
jmp 0x10056a5
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056a2
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1005664
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010051cb
test eax, eax
je 0x1005664
movsx eax, byte [ebp - 0x10b]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
cmp al, 0x54
mov eax, dword [ebp - 8]
jne 0x10055aa
add eax, esi
mov esi, 0x100abbe
lea eax, [ebp + eax - 0x10c]
push eax
jmp 0x10055b9
add eax, esi
mov esi, 0x100aaba
lea eax, [ebp + eax - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10012d4
push esi
call fcn.01005a9b
mov eax, esi
push eax
call fcn.01002cb8
test eax, eax
je 0x10056ad
jmp 0x1005681
cmp byte [ebp - 0x10a], bl
jne 0x10055f3
mov dword [0x100aaa4], edi
jmp 0x10056a5
cmp byte [ebp - 0x10a], 0x3a
jne 0x10056a2
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1005664
push 0x5b
push edi
call fcn.01005a1b
test eax, eax
je 0x100563b
push 0x5d
push edi
call fcn.01005a1b
test eax, eax
je 0x1005664
push 0x5d
push edi
call fcn.01005a1b
test eax, eax
je 0x1005653
push 0x5b
push edi
call fcn.01005a1b
test eax, eax
je 0x1005664
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010051cb
test eax, eax
jne 0x1005669
mov dword [ebp - 4], ebx
jmp 0x1005681
mov eax, dword [ebp - 8]
add eax, esi
lea eax, [ebp + eax - 0x10c]
push eax
push 0x100acc2
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop edi
jmp 0x10056a5
call fcn.01001b29
mov eax, dword [0x100aa80]
cmp eax, ebx
je 0x100569b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
jmp 0x1005271
xor eax, eax
jmp 0x10056f6
mov dword [ebp - 4], ebx
cmp dword [0x100aaac], ebx
je 0x10056ef
cmp byte [0x100abbe], bl
jne 0x10056ef
mov esi, 0x100abbe
push 0x104
push esi
push dword [0x100b6dc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10056ec
push 0x5c
push esi
call fcn.01005a69
mov byte [eax + 1], bl
jmp 0x10056ef
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
jmp 0x10056f6
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4