Function at 0x9fed80
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0xaf3c58]
sub esp, 0x18
test eax, eax
push ebx
push esi
jne 0x9feda1
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0x12
test cl, 1
je case.default.0x9fedae
mov eax, dword [esp + 0x24]
cmp eax, 7
ja case.default.0x9fedae
jmp dword [eax*4 + 0x9ff220]
mov esi, dword [esp + 0x28]
push esi
push str.process_start__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 1
je case.default.0x9fedae
test ch, 1
jne 0x9fedff
add eax, 0x10604
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea edx, [esp + 0x34]
push str.Process_starting:__s_nProcess_ID0x_x___d__nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push edx
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.Process_starting
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0x28]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.process_end__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 2
je case.default.0x9fedae
test ch, 1
jne 0x9fee8b
add eax, 0x10604
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea eax, [esp + 0x30]
push str.ExitProcess:__s_nProcess_ID0x_x_nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push eax
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.Process_ending
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0x24]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.dll_load_start__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 0x40
je case.default.0x9fedae
test ch, 2
jne 0x9fef17
add eax, 0x10684
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea ecx, [esp + 0x14]
push str.Loading_Module:__s_nProcess_ID0x_x_nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push ecx
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.Module_loading
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 8]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.dll_load_end__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 0x80
je case.default.0x9fedae
test ch, 2
jne 0x9fefa3
add eax, 0x10684
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea edx, [esp + 0x18]
push str.Unloading_Module:__s_nProcess_ID0x_x___d__nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push edx
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.Module_unloading
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0xc]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.Calling_DLL_PROCESS_ATTACH_for__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 4
je case.default.0x9fedae
test ch, 2
jne 0x9ff02f
add eax, 0x10684
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea eax, [esp + 0x1c]
push str.DLL_PROCESS_ATTACH:__s_nProcess_ID0x_x_nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push eax
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.DLL_PROCESS_ATTACH
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0x10]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.Calling_DLL_PROCESS_DETACH_for__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 8
je case.default.0x9fedae
test ch, 2
jne 0x9ff0bb
add eax, 0x10684
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea ecx, [esp + 0x20]
push str.DLL_PROCESS_DETACH:__s_nProcess_ID0x_x_nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push ecx
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.DLL_PROCESS_DETACH
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0x14]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.Calling_DLL_THREAD_ATTACH_for__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 0x10
je case.default.0x9fedae
test ch, 2
jne 0x9ff147
add eax, 0x10684
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea edx, [esp + 0x24]
push str.DLL_THREAD_ATTACH__s_nProcess_ID0x_x_nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push edx
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.DLL_THREAD_ATTACH
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0x18]
sete bl
jmp 0x9ff201
mov esi, dword [esp + 0x28]
push esi
push str.Calling_DLL_THREAD_DETACH_for__s_n
call fcn.009fe320
mov eax, dword [0xaf3c58]
add esp, 8
test eax, eax
je case.default.0x9fedae
mov ecx, dword [eax + 0x10600]
test cl, 0x20
je case.default.0x9fedae
test ch, 2
jne 0x9ff1c4
add eax, 0x10684
push eax
push esi
call fcn.009e3aa0
add esp, 8
test eax, eax
je case.default.0x9fedae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
lea eax, [esp + 0x28]
push str.DLL_THREAD_DETACH__s_nProcess_ID0x_x_nCommand_Line_s_nPress_OK_to_continue__Cancel_to_execute_breakpoint
push eax
call fcn.009e3530
mov eax, dword [eax]
add esp, 0x14
push 1
push str.DLL_PROCESS_DETACH
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
lea ecx, [esp + 0x1c]
sete bl
call fcn.009e3750
test bl, bl
je case.default.0x9fedae
pop esi
mov eax, 1
pop ebx
add esp, 0x18
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret