Function at 0xda1c9a
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x40], 1
jne 0xda2fbb
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0xda0000
call 0xda12a3
mov dword [0xdac070], eax
cmp dword [0xdac064], ebx
jne 0xda387e
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0xdac050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0xdac588
push esi
call fcn.00da1891
push 0xda1674
mov dword [0xdac580], 0xda1550
mov dword [0xdac584], 0xda1560
mov dword [0xdac04c], esi
call fcn.00da1e3d
mov eax, dword [0xdac088]
or eax, dword [0xdac08c]
push 0
pop ebx
jne 0xda13bf
cmp byte [0xdac040], bl
jne 0xda1399
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0xda1338
cmp dword [ebp - 0x114], 6
setb al
mov byte [0xdac041], al
cmp al, bl
jne 0xda1392
push 0xda1828
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0xda2fea
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xda181c
push edi
call esi
mov dword [0xdac05c], eax
cmp eax, ebx
je 0xda2fea
push 0xda180c
push edi
call esi
mov dword [0xdac048], eax
cmp eax, ebx
je 0xda361c
push 0xda17fc
push edi
call esi
mov dword [0xdac060], eax
cmp eax, ebx
je 0xda361c
mov byte [0xdac040], 1
cmp byte [0xdac041], bl
jne 0xda362b
push 0xdac088
push 0xdac228
push 0xda6f19
push 0xda17ec
call dword [0xdac048]
mov eax, dword [0xdac04c]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0xda366d
cmp dword [0xdac24c], ebx
jne 0xda3684
push 0xdac09c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00da2c3a
call fcn.00da200e
call fcn.00da1b20
xor esi, esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x11c], esi
call fcn.00da1e8b
push ebx
push ebx
push esi
mov edi, eax
push ebx
mov dword [ebp - 0x124], edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
mov dword [0xdac058], eax
call fcn.00da18d3
cmp eax, ebx
je 0xda143f
push eax
call fcn.00da217a
call sub.iertutil.dll_Ordinal_46
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 0x25
call esi
test eax, eax
je 0xda1461
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0xda1461
call sub.iertutil.dll_Ordinal_44
push 0xda1648
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push edi
call fcn.00da1fd5
test eax, eax
jne 0xda36f2
push edi
call fcn.00da19d9
test eax, eax
jne 0xda14b0
push edi
call fcn.00da194b
test eax, eax
jne 0xda2f40
cmp dword [ebp - 0x128], ebx
jne 0xda3702
push dword [ebp + 0x14]
push edi
call sub.IEFRAME.dll_Ordinal_251
mov dword [ebp - 0x11c], eax
call fcn.00da16c3
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xdac09c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0xdac040], bl
je 0xda1505
mov esi, dword [0xdac088]
mov eax, dword [0xdac08c]
mov ecx, esi
or ecx, eax
je 0xda1505
cmp byte [0xdac041], bl
jne 0xda3795
push eax
push esi
call dword [0xdac060]
mov dword [0xdac088], ebx
mov dword [0xdac08c], ebx
call fcn.00da16d6
lea eax, [ebp - 0x130]
push eax
push 0xda1620
push 0xda1570
push 0x80000002
mov dword [ebp - 0x130], ebx
call fcn.00da17a6
cmp dword [ebp - 0x130], ebx
pop edi
pop esi
pop ebx
jne 0xda37b6
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
xor ecx, ebp
call fcn.00da16b1
leave
ret 0x10
call fcn.00da1a7b
push 0x5c
push 0xda1dc0
call fcn.00da2454
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0xdac098
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0xda3800
xor esi, esi
inc esi
mov eax, dword [0xdac080]
cmp eax, esi
je 0xda381f
mov eax, dword [0xdac080]
test eax, eax
jne 0xda2fc4
mov dword [0xdac080], esi
push 0xda1db8
push 0xda1dac
call fcn.00da1e14
pop ecx
pop ecx
test eax, eax
jne 0xda38a1
mov eax, dword [0xdac080]
cmp eax, esi
jne 0xda1d4d
push 0xda1da8
push 0xda1d9c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0xdac080], 2
cmp dword [ebp - 0x20], ebx
jne 0xda1d5a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0xdac5dc], ebx
jne 0xda382c
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0xda38a1
mov eax, dword [eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0xda1de8
cmp cx, 0x22
je 0xda2cd9
inc eax
inc eax
jmp 0xda1d80
cmp cx, bx
je 0xda1df2
cmp dword [ebp - 0x1c], ebx
jne 0xda1d8c
movzx ecx, word [eax]
cmp cx, bx
je 0xda126c
cmp cx, 0x20
ja 0xda126c
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0xda1df2
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0xda1d96
cmp dword [ebp - 0x128], ebx
jne 0xda2f54
lea eax, [ebp - 0x124]
push eax
call fcn.00da2d3e
mov dword [ebp - 0x120], ebx
call sub.iertutil.dll_Ordinal_325
push 0x25
movzx edi, al
call esi
test eax, eax
je 0xda2f7b
mov eax, dword [ebp - 0x124]
cmp eax, ebx
je 0xda2fcf
xor ecx, ecx
cmp cx, word [eax]
je 0xda2fcf
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0xda2f8a
call fcn.00da2e3f
cmp dword [ebp - 0x120], ebx
jne 0xda14b0
push dword [ebp - 0x128]
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x124]
call sub.IEFRAME.dll_Ordinal_250
jmp 0xda14aa
movzx ecx, word [ebp - 0x3c]
jmp 0xda1279
mov dword [0xdac5f4], esi
jmp 0xda1d29
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0xda2f7b
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0xda2f7b
cmp edi, ebx
jne 0xda2f7b
jmp 0xda3711
mov byte [0xdac041], 1
jmp 0xda1392
mov dword [0xdac048], 0xda7340
jmp 0xda2fea
mov ecx, 0xdac228
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0xdac08c], edx
lea edx, [ebp - 0x12c]
push edx
push 1
mov dword [0xdac088], eax
mov eax, 0xda17ec
push eax
push ecx
push 0xda6ea7
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0xda13bf
push ebx
push eax
push ecx
push 0x1bcf
push 0xda37d0
call fcn.00da6e4a
jmp 0xda13d4
cmp byte [0xdac041], bl
je 0xda369d
test dword [0xdac248], 0x100
jne 0xda36d2
jmp 0xda13e0
mov eax, dword [0xdac238]
mov edx, 0x100
and eax, edx
xor ecx, ecx
or eax, ecx
je 0xda13e0
mov eax, dword [0xdac240]
mov ecx, eax
and ecx, edx
xor edx, edx
cmp ecx, eax
jne 0xda13e0
cmp edx, dword [0xdac244]
jne 0xda13e0
push 0xda37e0
push 0xda37f0
push dword [0xdac08c]
push dword [0xdac088]
call fcn.00da6f70
jmp 0xda13e0
call sub.IEFRAME.dll_Ordinal_212
mov dword [ebp - 0x11c], ebx
jmp 0xda14b0
mov dword [ebp - 0x11c], 5
jmp 0xda14b0
call fcn.00da929b
mov esi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0xda3764
cmp esi, eax
jne 0xda372d
call fcn.00da7147
jmp 0xda378a
cmp esi, 0xa
jne 0xda373e
push 2
call fcn.00da9120
jmp 0xda2f7b
cmp esi, 2
jne 0xda2f7b
call fcn.00da9217
cmp eax, 1
jne 0xda2f7b
push eax
call fcn.00da9120
test eax, eax
jge 0xda3726
jmp 0xda2f7b
cmp esi, 2
je 0xda3785
cmp esi, 0xa
je 0xda3785
cmp esi, 1
jne 0xda2f7b
call fcn.00da9217
cmp eax, 2
jne 0xda2f7b
call fcn.00da77c5
mov dword [ebp - 0x120], eax
jmp 0xda2f7b
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
jmp 0xda14f9
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0xda153a
cmp eax, esi
jne 0xda380f
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0xda1cf0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xda1cdc
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0xda1d29
push 0xdac5dc
call fcn.00da7b81
pop ecx
test eax, eax
je 0xda1d66
push ebx
push 2
push ebx
call dword [0xdac5dc]
jmp 0xda1d66
cmp dword [0xdac5f4], ebx
jne 0xda388c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0xdac070]
jmp 0xda38ad
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00da238c
ret