Function at 0x478be0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x644148
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x74f8a0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
mov eax, dword [0x74f8a0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov bl, 0x67
mov al, 0x7c
mov cl, 0x7d
mov dl, 0x64
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x30], al
mov byte [esp + 0x34], al
mov byte [esp + 0x40], al
mov byte [esp + 0x44], al
mov byte [esp + 0x48], al
mov byte [esp + 0x4e], bl
xor ebx, ebx
lea eax, [esp + 0x1c]
mov byte [esp + 0x28], cl
mov byte [esp + 0x2c], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x39], cl
mov byte [esp + 0x46], cl
mov byte [esp + 0x1c], 0x7b
mov byte [esp + 0x1f], 0x63
mov byte [esp + 0x20], 0x29
mov byte [esp + 0x21], 0x3c
mov byte [esp + 0x22], 0x3c
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x3d
mov byte [esp + 0x27], 0x7a
mov byte [esp + 0x2a], 0x76
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2f], 0x77
mov byte [esp + 0x31], dl
mov byte [esp + 0x33], 0x7f
mov byte [esp + 0x35], 0x72
mov byte [esp + 0x36], 0x77
mov byte [esp + 0x37], 0x7e
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x3a], 0x72
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3c], 0x76
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x3d
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x41], 0x7e
mov byte [esp + 0x42], 0x3c
mov byte [esp + 0x43], 0x77
mov byte [esp + 0x45], dl
mov byte [esp + 0x47], 0x7f
mov byte [esp + 0x49], 0x72
mov byte [esp + 0x4a], 0x77
mov byte [esp + 0x4b], 0x21
mov byte [esp + 0x4c], 0x3d
mov byte [esp + 0x4d], 0x7b
mov byte [esp + 0x4f], 0x7e
mov byte [esp + 0x50], 0x7f
mov byte [esp + 0x51], bl
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x478d20
sub eax, ecx
xor ecx, ecx
cmp eax, ebx
jle 0x478d3a
nop
xor byte [esp + ecx + 0x1c], 0x13
inc ecx
cmp ecx, eax
jl 0x478d30
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
call fcn.00402fd0
mov dword [esp + 0x60], ebx
mov ecx, 9
cmp cx, word [0x754d24]
je 0x478e0d
xor edx, edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x14], dx
mov byte [esp + 0x60], 1
mov eax, dword [0x754d00]
push ebx
push eax
push 0x66fea8
lea ecx, [esp + 0x1c]
call fcn.004021b0
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x478d93
lea eax, [esp + 0x14]
push 0x2e
push eax
call fcn.00617b92
add esp, 8
cmp eax, ebx
je 0x478da7
xor ecx, ecx
mov word [eax], cx
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x478db3
lea eax, [esp + 0x14]
push 0x5f
push eax
call fcn.00617b92
add esp, 8
cmp eax, ebx
je 0x478e00
add eax, 2
push ebx
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00402a70
mov byte [esp + 0x6c], 2
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push str._s_rfc2lng_s
push edx
call fcn.00402f70
add esp, 0x1c
mov byte [esp + 0x60], 1
lea ecx, [esp + 0xc]
call fcn.00402570
mov byte [esp + 0x60], bl
lea ecx, [esp + 0x10]
call fcn.00401210
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.004af020
add esp, 8
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 8]
call fcn.00402570
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0061807e
add esp, 0x5c
ret