Function at 0x1005329
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
xor ebx, ebx
pop edi
cmp eax, ebx
mov dword [ebp - 4], edi
je 0x10057d6
cmp byte [eax], bl
je 0x10057d6
mov dword [ebp + 8], eax
cmp byte [eax], bl
je 0x1005796
cmp dword [ebp - 4], ebx
je 0x1005796
mov eax, dword [ebp + 8]
mov cl, byte [eax]
cmp cl, 0x20
je 0x1005387
cmp cl, 9
je 0x1005387
cmp cl, 0xd
je 0x1005387
cmp cl, 0xa
je 0x1005387
cmp cl, 0xb
je 0x1005387
cmp cl, 0xc
jne 0x1005390
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x1005367
cmp byte [eax], bl
je 0x1005796
xor ecx, ecx
xor edx, edx
mov dword [ebp + 8], eax
xor esi, esi
cmp edx, ebx
jne 0x10053c6
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x20
je 0x10053c2
cmp al, 9
je 0x10053c2
cmp al, 0xd
je 0x10053c2
cmp al, 0xa
je 0x10053c2
cmp al, 0xb
je 0x10053c2
cmp al, 0xc
jne 0x10053ca
cmp edx, ebx
je 0x100540c
cmp esi, ebx
jne 0x100540c
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x22
jne 0x10053fa
mov eax, dword [ebp + 8]
inc eax
cmp byte [eax], 0x22
je 0x10053eb
cmp edx, ebx
jne 0x10053e4
mov edx, edi
jmp 0x10053e6
mov esi, edi
mov dword [ebp + 8], eax
jmp 0x1005405
mov byte [ebp + ecx - 0x10c], 0x22
inc ecx
add dword [ebp + 8], 2
jmp 0x1005405
mov byte [ebp + ecx - 0x10c], al
inc ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x10053a1
cmp edx, ebx
mov byte [ebp + ecx - 0x10c], bl
je 0x1005423
cmp esi, ebx
jne 0x100542b
cmp edx, ebx
jne 0x1005793
cmp esi, ebx
jne 0x1005793
cmp byte [ebp - 0x10c], 0x2f
je 0x1005441
cmp byte [ebp - 0x10c], 0x2d
jne 0x100578f
movsx eax, byte [ebp - 0x10b]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
movsx eax, al
sub eax, 0x3f
je 0x1005768
sub eax, 4
je 0x10056c2
dec eax
je 0x100561d
sub eax, 0xa
je 0x10055ab
push 3
pop ecx
sub eax, ecx
je 0x1005561
dec eax
je 0x1005491
dec eax
dec eax
je 0x100561d
jmp 0x1005784
cmp byte [ebp - 0x10a], bl
jne 0x10054aa
mov dword [0x100b6cc], ecx
mov dword [0x100aaa8], edi
jmp 0x1005787
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005542
cmp byte [ebp - 0x109], bl
mov dword [0x100b6cc], edi
je 0x1005787
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x41
je 0x100552c
sub eax, 3
je 0x1005523
sub eax, 5
je 0x100551a
sub eax, 5
je 0x1005511
dec eax
dec eax
je 0x1005508
sub eax, 3
je 0x10054ff
mov dword [ebp - 4], ebx
jmp 0x1005539
or dword [0x100b6cc], 4
jmp 0x1005533
or byte [0x100adc8], 0x80
jmp 0x1005539
and dword [0x100b6cc], 0xfffffffe
jmp 0x1005533
and dword [0x100b6cc], 0xfffffffd
jmp 0x1005533
or dword [0x100adc8], 0x40
jmp 0x1005539
or dword [0x100b6cc], 2
mov dword [0x100aaa8], edi
cmp byte [esi], bl
jne 0x10054cf
jmp 0x1005787
lea eax, [ebp - 0x10b]
push eax
push 0x10014f4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1005787
jmp 0x1005784
cmp byte [ebp - 0x10a], bl
je 0x100559d
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005784
movsx eax, byte [ebp - 0x109]
push eax
call esi
cmp al, 0x31
je 0x100559d
cmp al, 0x41
je 0x1005591
cmp al, 0x55
je 0x100559d
jmp 0x1005784
mov word [0x100aab8], di
jmp 0x1005787
mov word [0x100aab8], 2
jmp 0x1005787
cmp byte [ebp - 0x10a], bl
jne 0x10055be
mov dword [0x100aaac], edi
jmp 0x1005787
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005784
cmp byte [ebp - 0x109], bl
je 0x1005787
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x45
je 0x100560e
dec eax
dec eax
je 0x1005606
sub eax, 0xf
je 0x10055fe
mov dword [ebp - 4], ebx
jmp 0x1005614
mov dword [0x100aab4], edi
jmp 0x1005614
mov dword [0x100aab0], edi
jmp 0x1005614
mov dword [0x100aaac], edi
cmp byte [esi], bl
jne 0x10055dd
jmp 0x1005787
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005784
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1005746
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010052ad
test eax, eax
je 0x1005746
movsx eax, byte [ebp - 0x10b]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
cmp al, 0x54
mov eax, dword [ebp - 8]
jne 0x100568c
add eax, esi
mov esi, 0x100abbe
lea eax, [ebp + eax - 0x10c]
push eax
jmp 0x100569b
add eax, esi
mov esi, 0x100aaba
lea eax, [ebp + eax - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10012fc
push esi
call fcn.01005b7d
mov eax, esi
push eax
call fcn.01002d91
test eax, eax
je 0x100578f
jmp 0x1005763
cmp byte [ebp - 0x10a], bl
jne 0x10056d5
mov dword [0x100aaa4], edi
jmp 0x1005787
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005784
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1005746
push 0x5b
push edi
call fcn.01005afd
test eax, eax
je 0x100571d
push 0x5d
push edi
call fcn.01005afd
test eax, eax
je 0x1005746
push 0x5d
push edi
call fcn.01005afd
test eax, eax
je 0x1005735
push 0x5b
push edi
call fcn.01005afd
test eax, eax
je 0x1005746
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010052ad
test eax, eax
jne 0x100574b
mov dword [ebp - 4], ebx
jmp 0x1005763
mov eax, dword [ebp - 8]
add eax, esi
lea eax, [ebp + eax - 0x10c]
push eax
push 0x100acc2
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop edi
jmp 0x1005787
call fcn.01001c02
mov eax, dword [0x100aa80]
cmp eax, ebx
je 0x100577d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
jmp 0x1005353
xor eax, eax
jmp 0x10057d8
mov dword [ebp - 4], ebx
cmp dword [0x100aaac], ebx
je 0x10057d1
cmp byte [0x100abbe], bl
jne 0x10057d1
mov esi, 0x100abbe
push 0x104
push esi
push dword [0x100b6dc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10057ce
push 0x5c
push esi
call fcn.01005b4b
mov byte [eax + 1], bl
jmp 0x10057d1
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
jmp 0x10057d8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4