Function at 0x1005230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 1
xor ebx, ebx
pop edi
cmp eax, ebx
mov dword [ebp - 4], edi
je 0x10056dd
cmp byte [eax], bl
je 0x10056dd
mov dword [ebp + 8], eax
cmp byte [eax], bl
je 0x100569d
cmp dword [ebp - 4], ebx
je 0x100569d
mov eax, dword [ebp + 8]
mov cl, byte [eax]
cmp cl, 0x20
je 0x100528e
cmp cl, 9
je 0x100528e
cmp cl, 0xd
je 0x100528e
cmp cl, 0xa
je 0x100528e
cmp cl, 0xb
je 0x100528e
cmp cl, 0xc
jne 0x1005297
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x100526e
cmp byte [eax], bl
je 0x100569d
xor ecx, ecx
xor edx, edx
mov dword [ebp + 8], eax
xor esi, esi
cmp edx, ebx
jne 0x10052cd
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x20
je 0x10052c9
cmp al, 9
je 0x10052c9
cmp al, 0xd
je 0x10052c9
cmp al, 0xa
je 0x10052c9
cmp al, 0xb
je 0x10052c9
cmp al, 0xc
jne 0x10052d1
cmp edx, ebx
je 0x1005313
cmp esi, ebx
jne 0x1005313
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x22
jne 0x1005301
mov eax, dword [ebp + 8]
inc eax
cmp byte [eax], 0x22
je 0x10052f2
cmp edx, ebx
jne 0x10052eb
mov edx, edi
jmp 0x10052ed
mov esi, edi
mov dword [ebp + 8], eax
jmp 0x100530c
mov byte [ebp + ecx - 0x10c], 0x22
inc ecx
add dword [ebp + 8], 2
jmp 0x100530c
mov byte [ebp + ecx - 0x10c], al
inc ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x10052a8
cmp edx, ebx
mov byte [ebp + ecx - 0x10c], bl
je 0x100532a
cmp esi, ebx
jne 0x1005332
cmp edx, ebx
jne 0x100569a
cmp esi, ebx
jne 0x100569a
cmp byte [ebp - 0x10c], 0x2f
je 0x1005348
cmp byte [ebp - 0x10c], 0x2d
jne 0x1005696
movsx eax, byte [ebp - 0x10b]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push eax
call esi
movsx eax, al
sub eax, 0x3f
je 0x100566f
sub eax, 4
je 0x10055c9
dec eax
je 0x1005524
sub eax, 0xa
je 0x10054b2
push 3
pop ecx
sub eax, ecx
je 0x1005468
dec eax
je 0x1005398
dec eax
dec eax
je 0x1005524
jmp 0x100568b
cmp byte [ebp - 0x10a], bl
jne 0x10053b1
mov dword [0x100b6cc], ecx
mov dword [0x100aaa8], edi
jmp 0x100568e
cmp byte [ebp - 0x10a], 0x3a
jne 0x1005449
cmp byte [ebp - 0x109], bl
mov dword [0x100b6cc], edi
je 0x100568e
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x41
je 0x1005433
sub eax, 3
je 0x100542a
sub eax, 5
je 0x1005421
sub eax, 5
je 0x1005418
dec eax
dec eax
je 0x100540f
sub eax, 3
je 0x1005406
mov dword [ebp - 4], ebx
jmp 0x1005440
or dword [0x100b6cc], 4
jmp 0x100543a
or byte [0x100adc8], 0x80
jmp 0x1005440
and dword [0x100b6cc], 0xfffffffe
jmp 0x100543a
and dword [0x100b6cc], 0xfffffffd
jmp 0x100543a
or dword [0x100adc8], 0x40
jmp 0x1005440
or dword [0x100b6cc], 2
mov dword [0x100aaa8], edi
cmp byte [esi], bl
jne 0x10053d6
jmp 0x100568e
lea eax, [ebp - 0x10b]
push eax
push 0x10014ac
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100568e
jmp 0x100568b
cmp byte [ebp - 0x10a], bl
je 0x10054a4
cmp byte [ebp - 0x10a], 0x3a
jne 0x100568b
movsx eax, byte [ebp - 0x109]
push eax
call esi
cmp al, 0x31
je 0x10054a4
cmp al, 0x41
je 0x1005498
cmp al, 0x55
je 0x10054a4
jmp 0x100568b
mov word [0x100aab8], di
jmp 0x100568e
mov word [0x100aab8], 2
jmp 0x100568e
cmp byte [ebp - 0x10a], bl
jne 0x10054c5
mov dword [0x100aaac], edi
jmp 0x100568e
cmp byte [ebp - 0x10a], 0x3a
jne 0x100568b
cmp byte [ebp - 0x109], bl
je 0x100568e
lea esi, [ebp - 0x109]
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, al
sub eax, 0x45
je 0x1005515
dec eax
dec eax
je 0x100550d
sub eax, 0xf
je 0x1005505
mov dword [ebp - 4], ebx
jmp 0x100551b
mov dword [0x100aab4], edi
jmp 0x100551b
mov dword [0x100aab0], edi
jmp 0x100551b
mov dword [0x100aaac], edi
cmp byte [esi], bl
jne 0x10054e4
jmp 0x100568e
cmp byte [ebp - 0x10a], 0x3a
jne 0x100568b
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100564d
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010051b4
test eax, eax
je 0x100564d
movsx eax, byte [ebp - 0x10b]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
cmp al, 0x54
mov eax, dword [ebp - 8]
jne 0x1005593
add eax, esi
mov esi, 0x100abbe
lea eax, [ebp + eax - 0x10c]
push eax
jmp 0x10055a2
add eax, esi
mov esi, 0x100aaba
lea eax, [ebp + eax - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10012b8
push esi
call fcn.01005a84
mov eax, esi
push eax
call fcn.01002ca1
test eax, eax
je 0x1005696
jmp 0x100566a
cmp byte [ebp - 0x10a], bl
jne 0x10055dc
mov dword [0x100aaa4], edi
jmp 0x100568e
cmp byte [ebp - 0x10a], 0x3a
jne 0x100568b
xor eax, eax
cmp byte [ebp - 0x109], 0x22
sete al
add eax, 3
mov esi, eax
lea edi, [ebp + esi - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100564d
push 0x5b
push edi
call fcn.01005a04
test eax, eax
je 0x1005624
push 0x5d
push edi
call fcn.01005a04
test eax, eax
je 0x100564d
push 0x5d
push edi
call fcn.01005a04
test eax, eax
je 0x100563c
push 0x5b
push edi
call fcn.01005a04
test eax, eax
je 0x100564d
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
call fcn.010051b4
test eax, eax
jne 0x1005652
mov dword [ebp - 4], ebx
jmp 0x100566a
mov eax, dword [ebp - 8]
add eax, esi
lea eax, [ebp + eax - 0x10c]
push eax
push 0x100acc2
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop edi
jmp 0x100568e
call fcn.01001b09
mov eax, dword [0x100aa80]
cmp eax, ebx
je 0x1005684
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
jmp 0x100525a
xor eax, eax
jmp 0x10056df
mov dword [ebp - 4], ebx
cmp dword [0x100aaac], ebx
je 0x10056d8
cmp byte [0x100abbe], bl
jne 0x10056d8
mov esi, 0x100abbe
push 0x104
push esi
push dword [0x100b6dc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10056d5
push 0x5c
push esi
call fcn.01005a52
mov byte [eax + 1], bl
jmp 0x10056d8
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
jmp 0x10056df
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4