Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov dword [ebp - 4], ecx
mov dword [ecx], 0x1001c408
mov cl, 0x65
mov bl, 0x6e
mov al, 0x6c
xor dl, dl
push esi
push edi
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x2e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov al, 0x74
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x14], al
mov byte [ebp - 0xe], al
mov byte [ebp - 0x13], cl
mov byte [ebp - 0x10], cl
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x28]
push eax
push ecx
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x12], 0x45
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xd], 0x41
mov byte [ebp - 0xc], dl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push str.WINMM.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10022960], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push 0
push 0
push 0
push 0
call dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push 0
push 0
push 0
push 0
call dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov esi, dword [ebp - 4]
xor eax, eax
mov ebx, 2
mov dword [esi + 0x2c], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], al
mov byte [esi + 0x45], al
lea edi, [esi + 0x30]
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [edi - 0x28], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 0x20
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0xc
add edi, 4
dec ebx
jne 0x10001183
lea eax, [esi + 0x46]
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov word [edx], 0x31
mov word [eax + 0x48], 1
mov dword [eax + 0x4a], 0x1f40
mov dword [eax + 0x4e], 0x659
mov word [eax + 0x52], 0x41
mov word [eax + 0x54], 0
mov word [eax + 0x56], 2
mov word [eax + 0x58], 0x140
pop ebx
mov esp, ebp
pop ebp
ret