Function at 0x4012ab
Capabilities:
Check os version
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x40b050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x40b580
push esi
call fcn.00401711
push 0x401620
mov dword [0x40b578], 0x401528
mov dword [0x40b57c], 0x401538
mov dword [0x40b04c], esi
call fcn.00401bbd
mov eax, dword [0x40b088]
or eax, dword [0x40b08c]
push 0
pop ebx
jne 0x4013c7
cmp byte [0x40b040], bl
jne 0x4013a1
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401340
cmp dword [ebp - 0x114], 6
setb al
cmp al, bl
mov byte [0x40b041], al
jne 0x40139a
push 0x4016a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x402e82
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40169c
push edi
call esi
cmp eax, ebx
mov dword [0x40b05c], eax
je 0x402e82
push 0x40168c
push edi
call esi
cmp eax, ebx
mov dword [0x40b048], eax
je 0x4037b4
push 0x40167c
push edi
call esi
cmp eax, ebx
mov dword [0x40b060], eax
je 0x4037b4
mov byte [0x40b040], 1
cmp byte [0x40b041], bl
jne 0x4037c3
push 0x40b088
push 0x40b220
push 0x406d1f
push 0x40166c
call dword [0x40b048]
mov eax, dword [0x40b04c]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
jne 0x403805
cmp dword [0x40b244], ebx
jne 0x40381c
push 0x40b094
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00402983
call fcn.00401e1e
call fcn.00401844
xor edi, edi
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x120], edi
call fcn.00401ca1
push ebx
push ebx
push edi
push ebx
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
mov dword [0x40b058], eax
call sub.iertutil.dll_Ordinal_46
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
push 0x25
call esi
test eax, eax
je 0x401457
call sub.iertutil.dll_Ordinal_32
cmp eax, edi
jne 0x401457
call sub.iertutil.dll_Ordinal_44
push dword [ebp - 0x11c]
call fcn.00401c0b
test eax, eax
jne 0x402da8
cmp dword [ebp - 0x128], ebx
jne 0x403885
push dword [ebp + 0x14]
push dword [ebp - 0x11c]
call sub.IEFRAME.dll_Ordinal_251
mov dword [ebp - 0x120], eax
call fcn.00402a5e
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x40b094
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0x40b040], bl
je 0x4014df
mov esi, dword [0x40b088]
mov eax, dword [0x40b08c]
mov ecx, esi
or ecx, eax
je 0x4014df
cmp byte [0x40b041], bl
jne 0x403918
push eax
push esi
call dword [0x40b060]
mov dword [0x40b088], ebx
mov dword [0x40b08c], ebx
call fcn.00402a71
lea eax, [ebp - 0x130]
push eax
push 0x4015f8
push 0x401548
push 0x80000002
mov dword [ebp - 0x130], ebx
call fcn.00402b3d
cmp dword [ebp - 0x130], ebx
pop edi
pop esi
pop ebx
jne 0x403939
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x120]
xor ecx, ebp
call fcn.0040165d
leave
ret 0x10
cmp dword [ebp - 0x128], ebx
jne 0x402dbc
lea eax, [ebp - 0x11c]
push eax
call fcn.00402ba7
mov dword [ebp - 0x124], ebx
call sub.iertutil.dll_Ordinal_325
push 0x25
movzx edi, al
call esi
test eax, eax
je 0x402de1
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
je 0x402e5b
cmp word [eax], bx
je 0x402e5b
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x402df0
call fcn.00402caa
cmp dword [ebp - 0x124], ebx
jne 0x40148a
push dword [ebp - 0x128]
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x11c]
call sub.IEFRAME.dll_Ordinal_250
jmp 0x401484
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x402de1
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x402de1
cmp edi, ebx
je 0x403894
jmp 0x402de1
mov byte [0x40b041], 1
jmp 0x40139a
mov dword [0x40b048], 0x407198
jmp 0x402e82
mov ecx, 0x40b220
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x40b08c], edx
lea edx, [ebp - 0x12c]
push edx
push 1
mov dword [0x40b088], eax
mov eax, 0x40166c
push eax
push ecx
push 0x406cad
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
jmp 0x4013c7
push ebx
push eax
push ecx
push 0x1bcf
push 0x403954
call fcn.00406c51
jmp 0x4013dc
cmp byte [0x40b041], bl
je 0x403834
test word [0x40b240], 0x100
jne 0x403865
jmp 0x4013e8
mov eax, dword [0x40b230]
mov edx, 0x100
and eax, edx
or eax, ebx
je 0x4013e8
mov eax, dword [0x40b238]
mov ecx, eax
and ecx, edx
cmp ecx, eax
jne 0x4013e8
cmp ebx, dword [0x40b23c]
jne 0x4013e8
push 0x403964
push 0x403978
push dword [0x40b08c]
push dword [0x40b088]
call fcn.00406d76
jmp 0x4013e8
mov dword [ebp - 0x120], 5
jmp 0x40148a
call fcn.00408ceb
mov esi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x4038e7
cmp esi, eax
jne 0x4038b0
call fcn.00407013
jmp 0x40390d
cmp esi, 0xa
jne 0x4038c1
push 2
call fcn.00408b71
jmp 0x402de1
cmp esi, 2
jne 0x402de1
call fcn.00408c67
cmp eax, 1
jne 0x402de1
push eax
call fcn.00408b71
test eax, eax
jge 0x4038a9
jmp 0x402de1
cmp esi, 2
je 0x403908
cmp esi, 0xa
je 0x403908
cmp esi, 1
jne 0x402de1
call fcn.00408c67
cmp eax, 2
jne 0x402de1
call fcn.00406e8f
mov dword [ebp - 0x124], eax
jmp 0x402de1
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
jmp 0x4014d3
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x401514