Function at 0x10060970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov bl, byte [esi]
cmp bl, 0x20
jb 0x10060ac0
movzx ecx, bl
lea eax, [esi + 1]
cmp bl, 0x80
jb 0x100609f0
movzx eax, byte [eax]
lea edi, [ecx - 0x7f]
mov ecx, dword [0x101800a4]
mov edx, ecx
mov ebx, dword [0x1017e694]
sub edx, eax
dec edx
lea eax, [ecx + edi]
cmp eax, ebx
ja 0x10060d51
cmp edx, dword [0x1017fff4]
jae 0x100609cd
lea eax, [ebx + 1]
add esi, 2
mov dword [0x101800a4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x100609e4
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x100609d1
mov dword [0x101800a4], ecx
add esi, 2
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 0x40
jb 0x10060a62
movzx edi, byte [esi + 2]
movzx eax, byte [eax]
inc edi
mov ebx, dword [0x1017e694]
shl ecx, 8
mov dword [ebp - 4], ecx
mov ecx, dword [0x101800a4]
mov edx, ecx
sub edx, dword [ebp - 4]
sub edx, eax
add edx, 0x3fff
lea eax, [ecx + edi]
cmp eax, ebx
ja 0x10060d51
cmp edx, dword [0x1017fff4]
jae 0x10060a43
lea eax, [ebx + 1]
add esi, 3
mov dword [0x101800a4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x10060a43
add esi, 3
mov dword [0x101800a4], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x101800a4]
lea edx, [ecx - 0x1f]
mov ecx, dword [0x1017e694]
lea edi, [ebx + edx]
cmp edi, ecx
ja 0x10060d51
cmp eax, dword [0x1017e07c]
jae 0x10060a9e
movzx eax, byte [esi]
lea edi, [ecx + 1]
add esi, 0xffffffe2
mov dword [0x101800a4], edi
add esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [esi]
add esp, 0xc
add esi, 0xffffffe2
mov dword [0x101800a4], edi
add esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 0x18
jb 0x10060b3f
movzx eax, byte [esi + 1]
mov ecx, dword [0x101800a4]
mov edx, ecx
movzx edi, byte [esi + 3]
shl eax, 8
inc edi
sub edx, eax
movzx eax, bl
mov ebx, dword [0x1017e694]
shl eax, 0x10
sub edx, eax
movzx eax, byte [esi + 2]
sub edx, eax
lea eax, [ecx + edi]
add edx, 0x17ffff
cmp eax, ebx
ja 0x10060d51
cmp edx, dword [0x1017fff4]
jae 0x10060b20
lea eax, [ebx + 1]
add esi, 4
mov dword [0x101800a4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x10060b20
add esi, 4
mov dword [0x101800a4], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 0x10
jb 0x10060bc7
movzx ecx, byte [esi + 3]
movzx edi, byte [esi + 4]
movzx eax, byte [esi + 1]
inc edi
shl ecx, 8
shl eax, 8
add edi, ecx
mov ecx, dword [0x101800a4]
mov edx, ecx
sub edx, eax
movzx eax, bl
mov ebx, dword [0x1017e694]
shl eax, 0x10
sub edx, eax
movzx eax, byte [esi + 2]
sub edx, eax
lea eax, [ecx + edi]
add edx, 0xfffff
cmp eax, ebx
ja 0x10060d51
cmp edx, dword [0x1017fff4]
jae 0x10060ba8
lea eax, [ebx + 1]
add esi, 5
mov dword [0x101800a4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x10060ba8
add esi, 5
mov dword [0x101800a4], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 8
jb 0x10060c33
movzx edx, byte [esi + 1]
lea eax, [esi + 2]
movzx ecx, bl
add edx, 0xfffff801
mov ebx, dword [0x101800a4]
shl ecx, 8
add edx, ecx
mov ecx, dword [0x1017e694]
lea edi, [ebx + edx]
cmp edi, ecx
ja 0x10060d51
cmp eax, dword [0x1017e07c]
jae 0x10060c05
lea edi, [ecx + 1]
jmp 0x10060c10
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx ecx, byte [esi]
movzx eax, byte [esi + 1]
shl ecx, 8
add eax, esi
mov dword [0x101800a4], edi
lea esi, [ecx - 0x7fd]
add esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 7
jne 0x10060c99
movzx ecx, byte [esi + 1]
lea eax, [esi + 3]
movzx edx, byte [esi + 2]
mov ebx, dword [0x101800a4]
inc edx
shl ecx, 8
add edx, ecx
mov ecx, dword [0x1017e694]
lea edi, [ebx + edx]
cmp edi, ecx
ja 0x10060d51
cmp eax, dword [0x1017e07c]
jae 0x10060c6d
lea edi, [ecx + 1]
jmp 0x10060c78
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx ecx, byte [esi + 1]
movzx eax, byte [esi + 2]
shl ecx, 8
add eax, esi
mov dword [0x101800a4], edi
lea esi, [ecx + 4]
add esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 6
jne 0x10060d10
movzx eax, byte [esi + 1]
mov edx, dword [0x101800a4]
mov ecx, edx
movzx edi, byte [esi + 4]
mov ebx, dword [0x1017e694]
inc edi
shl eax, 0x10
sub ecx, eax
movzx eax, byte [esi + 2]
shl eax, 8
sub ecx, eax
movzx eax, byte [esi + 3]
sub ecx, eax
lea eax, [edx + edi]
dec ecx
cmp eax, ebx
ja 0x10060d51
cmp ecx, dword [0x1017fff4]
jae 0x10060cf1
lea eax, [ebx + 1]
add esi, 5
mov dword [0x101800a4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
inc edx
sub edi, 1
jne 0x10060cf1
add esi, 5
mov dword [0x101800a4], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 4
jne 0x10060d8b
movzx ecx, byte [esi + 4]
movzx edi, byte [esi + 5]
movzx eax, byte [esi + 1]
inc edi
mov ebx, dword [0x1017e694]
shl ecx, 8
shl eax, 0x10
add edi, ecx
mov ecx, dword [0x101800a4]
mov edx, ecx
sub edx, eax
movzx eax, byte [esi + 2]
shl eax, 8
sub edx, eax
movzx eax, byte [esi + 3]
sub edx, eax
lea eax, [ecx + edi]
dec edx
cmp eax, ebx
jbe 0x10060d59
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp edx, dword [0x1017fff4]
jae 0x10060d75
lea eax, [ebx + 1]
add esi, 6
mov dword [0x101800a4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x10060d75
mov dword [0x101800a4], ecx
add esi, 6
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret