Function at 0x11c1c9a
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x40], 1
jne 0x11c2fbb
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x11c0000
call 0x11c12a3
mov dword [0x11cc070], eax
cmp dword [0x11cc064], ebx
jne 0x11c387e
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x11cc050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11cc588
push esi
call fcn.011c1891
push 0x11c1674
mov dword [0x11cc580], 0x11c1550
mov dword [0x11cc584], 0x11c1560
mov dword [0x11cc04c], esi
call fcn.011c1e3d
mov eax, dword [0x11cc088]
or eax, dword [0x11cc08c]
push 0
pop ebx
jne 0x11c13bf
cmp byte [0x11cc040], bl
jne 0x11c1399
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x11c1338
cmp dword [ebp - 0x114], 6
setb al
mov byte [0x11cc041], al
cmp al, bl
jne 0x11c1392
push 0x11c1828
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x11c2fea
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x11c181c
push edi
call esi
mov dword [0x11cc05c], eax
cmp eax, ebx
je 0x11c2fea
push 0x11c180c
push edi
call esi
mov dword [0x11cc048], eax
cmp eax, ebx
je 0x11c361c
push 0x11c17fc
push edi
call esi
mov dword [0x11cc060], eax
cmp eax, ebx
je 0x11c361c
mov byte [0x11cc040], 1
cmp byte [0x11cc041], bl
jne 0x11c362b
push 0x11cc088
push 0x11cc228
push 0x11c6f19
push 0x11c17ec
call dword [0x11cc048]
mov eax, dword [0x11cc04c]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x11c366d
cmp dword [0x11cc24c], ebx
jne 0x11c3684
push 0x11cc09c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.011c2c3a
call fcn.011c200e
call fcn.011c1b20
xor esi, esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x11c], esi
call fcn.011c1e8b
push ebx
push ebx
push esi
mov edi, eax
push ebx
mov dword [ebp - 0x124], edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
mov dword [0x11cc058], eax
call fcn.011c18d3
cmp eax, ebx
je 0x11c143f
push eax
call fcn.011c217a
call sub.iertutil.dll_Ordinal_46
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 0x25
call esi
test eax, eax
je 0x11c1461
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x11c1461
call sub.iertutil.dll_Ordinal_44
push 0x11c1648
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push edi
call fcn.011c1fd5
test eax, eax
jne 0x11c36f2
push edi
call fcn.011c19d9
test eax, eax
jne 0x11c14b0
push edi
call fcn.011c194b
test eax, eax
jne 0x11c2f40
cmp dword [ebp - 0x128], ebx
jne 0x11c3702
push dword [ebp + 0x14]
push edi
call sub.IEFRAME.dll_Ordinal_251
mov dword [ebp - 0x11c], eax
call fcn.011c16c3
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x11cc09c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0x11cc040], bl
je 0x11c1505
mov esi, dword [0x11cc088]
mov eax, dword [0x11cc08c]
mov ecx, esi
or ecx, eax
je 0x11c1505
cmp byte [0x11cc041], bl
jne 0x11c3795
push eax
push esi
call dword [0x11cc060]
mov dword [0x11cc088], ebx
mov dword [0x11cc08c], ebx
call fcn.011c16d6
lea eax, [ebp - 0x130]
push eax
push 0x11c1620
push 0x11c1570
push 0x80000002
mov dword [ebp - 0x130], ebx
call fcn.011c17a6
cmp dword [ebp - 0x130], ebx
pop edi
pop esi
pop ebx
jne 0x11c37b6
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
xor ecx, ebp
call fcn.011c16b1
leave
ret 0x10
call fcn.011c1a7b
push 0x5c
push 0x11c1dc0
call fcn.011c2454
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x11cc098
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x11c3800
xor esi, esi
inc esi
mov eax, dword [0x11cc080]
cmp eax, esi
je 0x11c381f
mov eax, dword [0x11cc080]
test eax, eax
jne 0x11c2fc4
mov dword [0x11cc080], esi
push 0x11c1db8
push 0x11c1dac
call fcn.011c1e14
pop ecx
pop ecx
test eax, eax
jne 0x11c38a1
mov eax, dword [0x11cc080]
cmp eax, esi
jne 0x11c1d4d
push 0x11c1da8
push 0x11c1d9c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x11cc080], 2
cmp dword [ebp - 0x20], ebx
jne 0x11c1d5a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x11cc5dc], ebx
jne 0x11c382c
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x11c38a1
mov eax, dword [eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x11c1de8
cmp cx, 0x22
je 0x11c2cd9
inc eax
inc eax
jmp 0x11c1d80
cmp cx, bx
je 0x11c1df2
cmp dword [ebp - 0x1c], ebx
jne 0x11c1d8c
movzx ecx, word [eax]
cmp cx, bx
je 0x11c126c
cmp cx, 0x20
ja 0x11c126c
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x11c1df2
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x11c1d96
cmp dword [ebp - 0x128], ebx
jne 0x11c2f54
lea eax, [ebp - 0x124]
push eax
call fcn.011c2d3e
mov dword [ebp - 0x120], ebx
call sub.iertutil.dll_Ordinal_325
push 0x25
movzx edi, al
call esi
test eax, eax
je 0x11c2f7b
mov eax, dword [ebp - 0x124]
cmp eax, ebx
je 0x11c2fcf
xor ecx, ecx
cmp cx, word [eax]
je 0x11c2fcf
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x11c2f8a
call fcn.011c2e3f
cmp dword [ebp - 0x120], ebx
jne 0x11c14b0
push dword [ebp - 0x128]
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x124]
call sub.IEFRAME.dll_Ordinal_250
jmp 0x11c14aa
movzx ecx, word [ebp - 0x3c]
jmp 0x11c1279
mov dword [0x11cc5f4], esi
jmp 0x11c1d29
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x11c2f7b
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x11c2f7b
cmp edi, ebx
jne 0x11c2f7b
jmp 0x11c3711
mov byte [0x11cc041], 1
jmp 0x11c1392
mov dword [0x11cc048], 0x11c7340
jmp 0x11c2fea
mov ecx, 0x11cc228
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x11cc08c], edx
lea edx, [ebp - 0x12c]
push edx
push 1
mov dword [0x11cc088], eax
mov eax, 0x11c17ec
push eax
push ecx
push 0x11c6ea7
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x11c13bf
push ebx
push eax
push ecx
push 0x1bcf
push 0x11c37d0
call fcn.011c6e4a
jmp 0x11c13d4
cmp byte [0x11cc041], bl
je 0x11c369d
test dword [0x11cc248], 0x100
jne 0x11c36d2
jmp 0x11c13e0
mov eax, dword [0x11cc238]
mov edx, 0x100
and eax, edx
xor ecx, ecx
or eax, ecx
je 0x11c13e0
mov eax, dword [0x11cc240]
mov ecx, eax
and ecx, edx
xor edx, edx
cmp ecx, eax
jne 0x11c13e0
cmp edx, dword [0x11cc244]
jne 0x11c13e0
push 0x11c37e0
push 0x11c37f0
push dword [0x11cc08c]
push dword [0x11cc088]
call fcn.011c6f70
jmp 0x11c13e0
call sub.IEFRAME.dll_Ordinal_212
mov dword [ebp - 0x11c], ebx
jmp 0x11c14b0
mov dword [ebp - 0x11c], 5
jmp 0x11c14b0
call fcn.011c929b
mov esi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x11c3764
cmp esi, eax
jne 0x11c372d
call fcn.011c7147
jmp 0x11c378a
cmp esi, 0xa
jne 0x11c373e
push 2
call fcn.011c9120
jmp 0x11c2f7b
cmp esi, 2
jne 0x11c2f7b
call fcn.011c9217
cmp eax, 1
jne 0x11c2f7b
push eax
call fcn.011c9120
test eax, eax
jge 0x11c3726
jmp 0x11c2f7b
cmp esi, 2
je 0x11c3785
cmp esi, 0xa
je 0x11c3785
cmp esi, 1
jne 0x11c2f7b
call fcn.011c9217
cmp eax, 2
jne 0x11c2f7b
call fcn.011c77c5
mov dword [ebp - 0x120], eax
jmp 0x11c2f7b
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
jmp 0x11c14f9
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x11c153a
cmp eax, esi
jne 0x11c380f
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x11c1cf0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x11c1cdc
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x11c1d29
push 0x11cc5dc
call fcn.011c7b81
pop ecx
test eax, eax
je 0x11c1d66
push ebx
push 2
push ebx
call dword [0x11cc5dc]
jmp 0x11c1d66
cmp dword [0x11cc5f4], ebx
jne 0x11c388c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x11cc070]
jmp 0x11c38ad
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.011c238c
ret