Function at 0x402bc5
Capabilities:
Terminate process

Disassembly:
call fcn.004029a1
push 0x5c
push 0x402cd8
call fcn.00402944
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40f070
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x405154
xor esi, esi
inc esi
mov eax, dword [0x40f06c]
cmp eax, esi
je 0x405173
mov eax, dword [0x40f06c]
test eax, eax
jne 0x4044e3
mov dword [0x40f06c], esi
push 0x402cd4
push 0x402ccc
call fcn.0040331e
pop ecx
pop ecx
test eax, eax
jne 0x405209
mov eax, dword [0x40f06c]
cmp eax, esi
jne 0x402c78
push 0x402cc8
push 0x402cbc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40f06c], 2
cmp dword [ebp - 0x20], ebx
jne 0x402c85
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40fc80], ebx
jne 0x405180
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x405209
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x402d00
cmp cx, 0x22
je 0x404238
inc eax
inc eax
jmp 0x402ca0
cmp cx, bx
je 0x402d0a
cmp dword [ebp - 0x1c], ebx
jne 0x402cac
movzx ecx, word [eax]
cmp cx, bx
je 0x402d1f
cmp cx, 0x20
ja 0x402d1f
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x402d0a
test byte [ebp - 0x40], 1
je 0x4044db
movzx ecx, word [ebp - 0x3c]
push ecx
push eax
push ebx
push 0x400000
call 0x402d57
mov dword [0x40f058], eax
cmp dword [0x40f04c], ebx
jne 0x4051dc
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40f074
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00402a1d
xor esi, esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x420], esi
call fcn.00403439
xor ebx, ebx
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x418], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
mov dword [0x40f048], eax
call sub.iertutil.dll_Ordinal_46
mov dword [ebp - 0x41c], eax
call sub.iertutil.dll_IEGetTabWindowExports
mov edi, dword [sym.imp.SHLWAPI.dll_IsOS]
mov esi, eax
neg esi
sbb esi, esi
push 0x25
inc esi
call edi
test eax, eax
je 0x402dea
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x402dea
call sub.iertutil.dll_Ordinal_44
test eax, eax
je 0x404693
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x424], ebx
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x402e4f
cmp dword [ebp - 0x418], ebx
je 0x402e4f
push 0x402ee8
push dword [ebp - 0x418]
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x402e4f
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00403a11
push 2
push 4
lea eax, [ebp - 0x424]
push eax
push 4
push 0x40382c
push 0x401390
call dword [0x40fc84]
cmp dword [ebp - 0x41c], ebx
jne 0x402eb3
push 0x25
xor esi, esi
call edi
test eax, eax
je 0x402e78
mov eax, dword [ebp - 0x418]
cmp eax, ebx
je 0x404498
cmp word [eax], bx
je 0x404498
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x402e87
call fcn.00404134
cmp esi, ebx
jne 0x402eb3
call fcn.004043cb
test eax, eax
je 0x402e9f
push 0x4088a1
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push dword [ebp + 0x14]
push dword [ebp - 0x418]
call sub.IEFRAME.dll_Ordinal_101
mov dword [ebp - 0x420], eax
call fcn.00404983
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x40f074
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032ff
leave
ret 0x10
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x402cb6
cmp edi, 2
je 0x4046b9
cmp edi, 0xa
je 0x4046b9
cmp edi, 1
jne 0x402e78
call fcn.0040441d
cmp eax, 2
jne 0x402e78
jmp 0x4046b9
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x402e78
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x402e78
call fcn.0040462c
mov edi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x4043ea
cmp edi, eax
jne 0x40508f
call fcn.0040452b
mov esi, eax
jmp 0x402e78
push 0xa
pop ecx
jmp 0x402d2d
mov dword [0x40fcc4], esi
jmp 0x402c54
cmp dword [ebp - 0x41c], ebx
jne 0x404fea
cmp esi, ebx
je 0x402dea
jmp 0x404fea
test eax, eax
jge 0x4044cf
jmp 0x402e78
call fcn.00408775
jmp 0x4044d4
mov edi, 0x206
push edi
lea eax, [ebp - 0x412]
push ebx
push eax
mov word [ebp - 0x414], bx
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call sub.msvcrt.dll_memset
mov eax, dword [0x40fc90]
add esp, 0x18
cmp eax, ebx
jne 0x40502a
call fcn.0040865d
mov edi, 0x104
push edi
lea ecx, [ebp - 0x414]
push ecx
xor ecx, ecx
cmp esi, ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
setne cl
lea ecx, [ecx + ecx + 0x2bf]
push ecx
push eax
call esi
mov eax, dword [0x40fc90]
cmp eax, ebx
jne 0x40505d
call fcn.0040865d
push edi
lea ecx, [ebp - 0x20c]
push ecx
push 0x2d3
push eax
call esi
push 0x30
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x420], ebx
jmp 0x402eb3
cmp edi, 0xa
jne 0x4050a0
push 2
call fcn.0040b9b0
jmp 0x402e78
cmp edi, 2
jne 0x402e78
call fcn.0040441d
cmp eax, 1
jne 0x402e78
push eax
call fcn.0040b9b0
jmp 0x4046ac
cmp eax, esi
jne 0x405163
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x402c1b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402c07
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x402c54
push 0x40fc80
call fcn.00409a9f
pop ecx
test eax, eax
je 0x402c91
push ebx
push 2
push ebx
call dword [0x40fc80]
jmp 0x402c91
cmp dword [0x40fcc4], ebx
jne 0x4051ea
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40f058]
jmp 0x405215
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00403794
ret