Function at 0x401a25
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x40], 1
jne 0x402e21
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call 0x4012ab
mov dword [0x40b070], eax
cmp dword [0x40b064], ebx
jne 0x403a10
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
push ebp
mov edi, edi
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x40b050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x40b580
push edi
call fcn.00401711
push 0x401620
mov dword [0x40b578], 0x401528
mov dword [0x40b57c], 0x401538
mov dword [0x40b04c], edi
call fcn.00401bbd
mov eax, dword [0x40b088]
or eax, dword [0x40b08c]
push 0
pop ebx
jne 0x4013c7
cmp byte [0x40b040], bl
jne 0x4013a1
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
or eax, eax
je 0x401340
cmp dword [ebp - 0x114], 6
setb al
cmp al, bl
mov byte [0x40b041], al
jne 0x40139a
push 0x4016a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, ebx
je 0x402e82
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40169c
push esi
call edi
cmp eax, ebx
mov dword [0x40b05c], eax
je 0x402e82
push 0x40168c
push esi
call edi
cmp eax, ebx
mov dword [0x40b048], eax
je 0x4037b4
push 0x40167c
push esi
call edi
cmp eax, ebx
mov dword [0x40b060], eax
je 0x4037b4
mov byte [0x40b040], 1
cmp byte [0x40b041], bl
jne 0x4037c3
push 0x40b088
push 0x40b220
push 0x406d1f
push 0x40166c
call dword [0x40b048]
mov eax, dword [0x40b04c]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x403805
cmp dword [0x40b244], ebx
jne 0x40381c
push 0x40b094
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00402983
call fcn.00401e1e
call fcn.00401844
xor edi, edi
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x120], edi
call fcn.00401ca1
push ebx
push ebx
push edi
push ebx
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
mov dword [0x40b058], eax
call sub.iertutil.dll_Ordinal_46
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 0x25
call esi
or eax, eax
je 0x401457
call sub.iertutil.dll_Ordinal_32
cmp eax, edi
jne 0x401457
call sub.iertutil.dll_Ordinal_44
push dword [ebp - 0x11c]
call fcn.00401c0b
or eax, eax
jne 0x402da8
cmp dword [ebp - 0x128], ebx
jne 0x403885
push dword [ebp + 0x14]
push dword [ebp - 0x11c]
call sub.IEFRAME.dll_Ordinal_251
mov dword [ebp - 0x120], eax
call fcn.00402a5e
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x40b094
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0x40b040], bl
je 0x4014df
mov esi, dword [0x40b088]
mov eax, dword [0x40b08c]
mov ecx, esi
or ecx, eax
je 0x4014df
cmp byte [0x40b041], bl
jne 0x403918
push eax
push esi
call dword [0x40b060]
mov dword [0x40b088], ebx
mov dword [0x40b08c], ebx
call fcn.00402a71
lea eax, [ebp - 0x130]
push eax
push 0x4015f8
push 0x401548
push 0x80000002
mov dword [ebp - 0x130], ebx
call fcn.00402b3d
cmp dword [ebp - 0x130], ebx
pop edi
pop esi
pop ebx
jne 0x403939
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x120]
xor ecx, ebp
call fcn.0040165d
leave
ret 0x10
call fcn.004017b1
push 0x5c
push 0x401b40
call fcn.004021a4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40b090
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x403988
xor esi, esi
inc esi
mov eax, dword [0x40b084]
cmp eax, esi
je 0x4039a7
mov eax, dword [0x40b084]
test eax, eax
jne 0x402e2a
mov dword [0x40b084], esi
push 0x401b3c
push 0x401b30
call fcn.00401b94
pop ecx
or eax, eax
pop ecx
jne 0x403a3d
mov eax, dword [0x40b084]
cmp eax, esi
jne 0x401ad8
push 0x401b2c
push 0x401b1c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40b084], 2
cmp dword [ebp - 0x20], ebx
jne 0x401ae5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40b628], ebx
jne 0x4039b4
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x403a3d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x401b68
cmp cx, 0x22
je 0x402a24
inc eax
inc eax
jmp 0x401b00
cmp cx, bx
je 0x401b72
cmp dword [ebp - 0x1c], ebx
jne 0x401b0c
movzx ecx, word [eax]
cmp cx, bx
je 0x401274
cmp cx, 0x20
ja 0x401274
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x401b72
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x401b16
cmp dword [ebp - 0x128], ebx
jne 0x402dbc
lea eax, [ebp - 0x11c]
push eax
call fcn.00402ba7
mov dword [ebp - 0x124], ebx
call sub.iertutil.dll_Ordinal_325
push 0x25
movzx edi, al
call esi
or eax, eax
je 0x402de1
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x402e5b
cmp word [eax], bx
je 0x402e5b
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x402df0
call fcn.00402caa
cmp dword [ebp - 0x124], ebx
jne 0x40148a
push dword [ebp - 0x128]
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x11c]
call sub.IEFRAME.dll_Ordinal_250
jmp 0x401484
movzx ecx, word [ebp - 0x3c]
jmp 0x401281
mov dword [0x40b640], esi
jmp 0x401ab4
call sub.iertutil.dll_Ordinal_44
or eax, eax
jne 0x402de1
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x402de1
cmp edi, ebx
je 0x403894
jmp 0x402de1
mov byte [0x40b041], 1
jmp 0x40139a
mov dword [0x40b048], 0x407198
jmp 0x402e82
mov ecx, 0x40b220
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x40b08c], edx
lea edx, [ebp - 0x12c]
push edx
push 1
mov dword [0x40b088], eax
mov eax, 0x40166c
push eax
push ecx
push 0x406cad
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x4013c7
push ebx
push eax
push ecx
push 0x1bcf
push 0x403954
call fcn.00406c51
jmp 0x4013dc
cmp byte [0x40b041], bl
je 0x403834
test word [0x40b240], 0x100
jne 0x403865
jmp 0x4013e8
mov eax, dword [0x40b230]
mov edx, 0x100
and eax, edx
or eax, ebx
je 0x4013e8
mov eax, dword [0x40b238]
mov ecx, eax
and ecx, edx
cmp ecx, eax
jne 0x4013e8
cmp ebx, dword [0x40b23c]
jne 0x4013e8
push 0x403964
push 0x403978
push dword [0x40b08c]
push dword [0x40b088]
call fcn.00406d76
jmp 0x4013e8
mov dword [ebp - 0x120], 5
jmp 0x40148a
call fcn.00408ceb
mov esi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x4038e7
cmp esi, eax
jne 0x4038b0
call fcn.00407013
jmp 0x40390d
cmp esi, 0xa
jne 0x4038c1
push 2
call fcn.00408b71
jmp 0x402de1
cmp esi, 2
jne 0x402de1
call fcn.00408c67
cmp eax, 1
jne 0x402de1
push eax
call fcn.00408b71
or eax, eax
jge 0x4038a9
jmp 0x402de1
cmp esi, 2
je 0x403908
cmp esi, 0xa
je 0x403908
cmp esi, 1
jne 0x402de1
call fcn.00408c67
cmp eax, 2
jne 0x402de1
call fcn.00406e8f
mov dword [ebp - 0x124], eax
jmp 0x402de1
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
jmp 0x4014d3
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x401514
cmp eax, esi
jne 0x403997
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401a7b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401a67
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401ab4
push 0x40b628
call fcn.00407597
or eax, eax
pop ecx
je 0x401af1
push ebx
push 2
push ebx
call dword [0x40b628]
jmp 0x401af1
cmp dword [0x40b640], ebx
jne 0x403a1e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40b070]
jmp 0x403a49
mov eax, 0xff
mov dword [ebp - 4], 0xfffffffe
call fcn.004020dc
ret