Function at 0x401c9a
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x40], 1
jne 0x402fbb
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call 0x4012a3
mov dword [0x40c070], eax
cmp dword [0x40c064], ebx
jne 0x40387e
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x40c588
push esi
call fcn.00401891
push 0x401674
mov dword [0x40c580], 0x401550
mov dword [0x40c584], 0x401560
mov dword [0x40c04c], esi
call fcn.00401e3d
mov eax, dword [0x40c088]
or eax, dword [0x40c08c]
push 0
pop ebx
jne 0x4013bf
cmp byte [0x40c040], bl
jne 0x401399
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401338
cmp dword [ebp - 0x114], 6
setb al
mov byte [0x40c041], al
cmp al, bl
jne 0x401392
push 0x401828
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x402fea
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40181c
push edi
call esi
mov dword [0x40c05c], eax
cmp eax, ebx
je 0x402fea
push 0x40180c
push edi
call esi
mov dword [0x40c048], eax
cmp eax, ebx
je 0x40361c
push 0x4017fc
push edi
call esi
mov dword [0x40c060], eax
cmp eax, ebx
je 0x40361c
mov byte [0x40c040], 1
cmp byte [0x40c041], bl
jne 0x40362b
push 0x40c088
push 0x40c228
push 0x406f19
push 0x4017ec
call dword [0x40c048]
mov eax, dword [0x40c04c]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x40366d
cmp dword [0x40c24c], ebx
jne 0x403684
push 0x40c09c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00402c3a
call fcn.0040200e
call fcn.00401b20
xor esi, esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x11c], esi
call fcn.00401e8b
push ebx
push ebx
push esi
mov edi, eax
push ebx
mov dword [ebp - 0x124], edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
mov dword [0x40c058], eax
call fcn.004018d3
cmp eax, ebx
je 0x40143f
push eax
call fcn.0040217a
call sub.iertutil.dll_Ordinal_46
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 0x25
call esi
test eax, eax
je 0x401461
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x401461
call sub.iertutil.dll_Ordinal_44
push 0x401648
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push edi
call fcn.00401fd5
test eax, eax
jne 0x4036f2
push edi
call fcn.004019d9
test eax, eax
jne 0x4014b0
push edi
call fcn.0040194b
test eax, eax
jne 0x402f40
cmp dword [ebp - 0x128], ebx
jne 0x403702
push dword [ebp + 0x14]
push edi
call sub.IEFRAME.dll_Ordinal_251
mov dword [ebp - 0x11c], eax
call fcn.004016c3
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x40c09c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0x40c040], bl
je 0x401505
mov esi, dword [0x40c088]
mov eax, dword [0x40c08c]
mov ecx, esi
or ecx, eax
je 0x401505
cmp byte [0x40c041], bl
jne 0x403795
push eax
push esi
call dword [0x40c060]
mov dword [0x40c088], ebx
mov dword [0x40c08c], ebx
call fcn.004016d6
lea eax, [ebp - 0x130]
push eax
push 0x401620
push 0x401570
push 0x80000002
mov dword [ebp - 0x130], ebx
call fcn.004017a6
cmp dword [ebp - 0x130], ebx
pop edi
pop esi
pop ebx
jne 0x4037b6
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
xor ecx, ebp
call fcn.004016b1
leave
ret 0x10
call fcn.00401a7b
push 0x5c
push 0x401dc0
call fcn.00402454
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40c098
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x403800
xor esi, esi
inc esi
mov eax, dword [0x40c080]
cmp eax, esi
je 0x40381f
mov eax, dword [0x40c080]
test eax, eax
jne 0x402fc4
mov dword [0x40c080], esi
push 0x401db8
push 0x401dac
call fcn.00401e14
pop ecx
pop ecx
test eax, eax
jne 0x4038a1
mov eax, dword [0x40c080]
cmp eax, esi
jne 0x401d4d
push 0x401da8
push 0x401d9c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40c080], 2
cmp dword [ebp - 0x20], ebx
jne 0x401d5a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40c5dc], ebx
jne 0x40382c
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x4038a1
mov eax, dword [eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x401de8
cmp cx, 0x22
je 0x402cd9
inc eax
inc eax
jmp 0x401d80
cmp cx, bx
je 0x401df2
cmp dword [ebp - 0x1c], ebx
jne 0x401d8c
movzx ecx, word [eax]
cmp cx, bx
je 0x40126c
cmp cx, 0x20
ja 0x40126c
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x401df2
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x401d96
cmp dword [ebp - 0x128], ebx
jne 0x402f54
lea eax, [ebp - 0x124]
push eax
call fcn.00402d3e
mov dword [ebp - 0x120], ebx
call sub.iertutil.dll_Ordinal_325
push 0x25
movzx edi, al
call esi
test eax, eax
je 0x402f7b
mov eax, dword [ebp - 0x124]
cmp eax, ebx
je 0x402fcf
xor ecx, ecx
cmp cx, word [eax]
je 0x402fcf
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x402f8a
call fcn.00402e3f
cmp dword [ebp - 0x120], ebx
jne 0x4014b0
push dword [ebp - 0x128]
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x124]
call sub.IEFRAME.dll_Ordinal_250
jmp 0x4014aa
movzx ecx, word [ebp - 0x3c]
jmp 0x401279
mov dword [0x40c5f4], esi
jmp 0x401d29
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x402f7b
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x402f7b
cmp edi, ebx
jne 0x402f7b
jmp 0x403711
mov byte [0x40c041], 1
jmp 0x401392
mov dword [0x40c048], 0x407340
jmp 0x402fea
mov ecx, 0x40c228
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x40c08c], edx
lea edx, [ebp - 0x12c]
push edx
push 1
mov dword [0x40c088], eax
mov eax, 0x4017ec
push eax
push ecx
push 0x406ea7
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x4013bf
push ebx
push eax
push ecx
push 0x1bcf
push 0x4037d0
call fcn.00406e4a
jmp 0x4013d4
cmp byte [0x40c041], bl
je 0x40369d
test dword [0x40c248], 0x100
jne 0x4036d2
jmp 0x4013e0
mov eax, dword [0x40c238]
mov edx, 0x100
and eax, edx
xor ecx, ecx
or eax, ecx
je 0x4013e0
mov eax, dword [0x40c240]
mov ecx, eax
and ecx, edx
xor edx, edx
cmp ecx, eax
jne 0x4013e0
cmp edx, dword [0x40c244]
jne 0x4013e0
push 0x4037e0
push 0x4037f0
push dword [0x40c08c]
push dword [0x40c088]
call fcn.00406f70
jmp 0x4013e0
call sub.IEFRAME.dll_Ordinal_212
mov dword [ebp - 0x11c], ebx
jmp 0x4014b0
mov dword [ebp - 0x11c], 5
jmp 0x4014b0
call fcn.0040929b
mov esi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x403764
cmp esi, eax
jne 0x40372d
call fcn.00407147
jmp 0x40378a
cmp esi, 0xa
jne 0x40373e
push 2
call fcn.00409120
jmp 0x402f7b
cmp esi, 2
jne 0x402f7b
call fcn.00409217
cmp eax, 1
jne 0x402f7b
push eax
call fcn.00409120
test eax, eax
jge 0x403726
jmp 0x402f7b
cmp esi, 2
je 0x403785
cmp esi, 0xa
je 0x403785
cmp esi, 1
jne 0x402f7b
call fcn.00409217
cmp eax, 2
jne 0x402f7b
call fcn.004077c5
mov dword [ebp - 0x120], eax
jmp 0x402f7b
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
jmp 0x4014f9
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40153a
cmp eax, esi
jne 0x40380f
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401cf0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401cdc
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401d29
push 0x40c5dc
call fcn.00407b81
pop ecx
test eax, eax
je 0x401d66
push ebx
push 2
push ebx
call dword [0x40c5dc]
jmp 0x401d66
cmp dword [0x40c5f4], ebx
jne 0x40388c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c070]
jmp 0x4038ad
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0040238c
ret