Function at 0x403e50
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46a020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.GDI32.dll_UnrealizeObject]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x46afd8], eax
push 0xda4c2ca8
push dword [0x46afd8]
call fcn.00403480
add esp, 8
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
call edx
push 8
call fcn.00407afc
mov esi, eax
add esp, 4
test esi, esi
je 0x403eeb
push 4
call fcn.00407afc
add esp, 4
test eax, eax
je 0x403ec5
mov dword [eax], 0x402310
jmp 0x403ec7
xor eax, eax
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x401870
push 0
push 0
call fcn.0040e86e
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4040ad
jmp 0x403eed
xor esi, esi
cmp dword [esi + 4], 0
je 0x4040ba
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 4], eax
je 0x4040c1
push 0
push dword [esi + 4]
push dword [esi]
call fcn.00404481
add esp, 0xc
test eax, eax
jne 0x4040c8
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00403980
mov ecx, dword [ebp - 0x20]
add esp, 4
mov eax, dword [ebp - 0x24]
cmp ecx, 0x7fffffff
jg 0x403f48
jl 0x403f44
cmp eax, 0xc46535ff
jae 0x403f48
mov dl, 1
jmp 0x403f4a
xor dl, dl
test dl, dl
je 0x403f5e
add eax, 0x3b9aca00
mov dword [ebp - 0x18], eax
adc ecx, 0
mov dword [ebp - 0x1c], ecx
jmp 0x403f70
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0x7fffffff
nop dword [eax]
call fcn.00404382
mov esi, eax
mov ebx, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], ebx
call fcn.0040436b
mov ecx, eax
cmp esi, 0x989680
jne 0x403fa7
test ebx, ebx
jne 0x403fa7
mov eax, edx
mov esi, 0x64
mul esi
mov ebx, eax
mov eax, ecx
mul esi
add ebx, edx
mov edx, eax
jmp 0x403ff1
push ebx
push esi
push edx
push ecx
call fcn.00407c00
push 0
push 0x3b9aca00
push ebx
push ecx
mov edi, eax
mov esi, edx
call fcn.00407ce0
push dword [ebp - 0x28]
push dword [ebp - 0x20]
push edx
push eax
call fcn.00407b50
mov dword [ebp - 0x20], eax
mov ebx, edx
mov ecx, 0x3b9aca00
mov eax, esi
mul ecx
mov edx, 0x3b9aca00
mov ecx, eax
mov eax, edi
mul edx
add ecx, edx
mov edx, dword [ebp - 0x20]
add edx, eax
adc ebx, ecx
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ebx, esi
jg 0x404005
jl 0x404001
cmp edx, ecx
jae 0x404005
mov al, 1
jmp 0x404007
xor al, al
test al, al
je 0x404080
mov edi, ecx
sub edi, edx
sbb esi, ebx
mov dword [ebp - 0x20], esi
call fcn.004043ff
push 0
push 0x64
push edx
push eax
call fcn.00407ce0
mov ebx, dword [ebp - 0x20]
mov ecx, edi
mov dword [ebp - 0x28], edx
mov esi, eax
mov edx, ebx
call fcn.00407d20
comisd xmm0, xmmword [0x425480]
jbe 0x404049
mov edi, 0xad160000
mov ebx, 0x311cd
mov eax, dword [ebp - 0x28]
add esi, edi
push 0
push 0x3b9aca00
adc eax, ebx
push eax
push esi
call fcn.00407b50
mov dword [ebp - 0x14], eax
imul eax, eax, 0x3b9aca00
mov dword [ebp - 0x10], edx
sub esi, eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], esi
call fcn.004044d0
add esp, 4
jmp 0x403f70
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407b3a
mov esp, ebp
pop ebp
ret 0x10
push 6
mov dword [edi], 0
call fcn.00404632
push 1
call fcn.00404632
push 5
call fcn.00404632
push 2
call fcn.00404632
int3