Function at 0x409501
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get hostname

Disassembly:
push 0x514
mov eax, 0x58ba23
call fcn.0056516b
mov ebx, ecx
push 0xffffffffffffffff
mov dword [ebp - 0x51c], ebx
call fcn.00409d01
mov dword [esp], 0x5b9b5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4095ce
lea ecx, [ebp - 0x110]
push ecx
push eax
mov byte [ebp - 0x110], 0x49
mov byte [ebp - 0x10f], 0x73
mov byte [ebp - 0x10e], 0x44
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x62
mov byte [ebp - 0x10b], 0x75
mov byte [ebp - 0x10a], 0x67
mov byte [ebp - 0x109], 0x67
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x72
mov byte [ebp - 0x106], 0x50
mov byte [ebp - 0x105], 0x72
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x73
mov byte [ebp - 0x102], 0x65
mov byte [ebp - 0x101], 0x6e
mov byte [ebp - 0x100], 0x74
mov byte [ebp - 0xff], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4095ce
call eax
test eax, eax
jne 0x409b0b
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
lea edx, [ebp - 0x518]
push edx
call dword [eax]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, str.CPU_Z_Error
test eax, eax
jne 0x4096c0
mov eax, dword [ebx + 0x8c8]
mov dword [eax + 0xa60], 1
cmp dword [ebx + 0x8b8], 0
jne 0x4096c0
mov eax, dword [ebx + 0xb0]
push dword [ebp - 0x518]
add eax, 4
push dword [ebp - 0x518]
lea eax, [ebp - 0x510]
je 0x40969f
push str.The_error_code_0x_X___d__occured_during_initialization._nDo_you_want_to_display_the_error_log_file__
push 0x200
push eax
call fcn.00460100
add esp, 0x14
push 0x34
push edi
lea eax, [ebp - 0x510]
push eax
push 0
call esi
cmp eax, 6
jne 0x4096c0
mov eax, dword [ebx + 0xb0]
push 1
xor ecx, ecx
push ecx
push ecx
add eax, 4
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4096c0
mov eax, dword [ebx + 0xb0]
add eax, 4
push eax
push str.Unable_to_open__s
lea eax, [ebp - 0x510]
push 0x200
push eax
call fcn.00460100
add esp, 0x10
push 0x34
push str.CPU_Z_Driver_Error
jmp 0x4096b5
push str.The_error_code_0x_X___d__occured_during_initialization.
push 0x200
push eax
call fcn.00460100
add esp, 0x14
push 0x30
push edi
lea eax, [ebp - 0x510]
push eax
push 0
call esi
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
lea edx, [ebp - 0x520]
push edx
lea edx, [ebp - 0x518]
push edx
call dword [eax + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x409754
mov eax, dword [ebp - 0x518]
cmp eax, 8
je 0x409739
cmp eax, 0x10
je 0x40972b
cmp eax, 0x20
je 0x409721
push eax
push eax
push str.The_error_code_0x_X___d__occured_during_parsing.
lea eax, [ebp - 0x510]
push 0x200
push eax
call fcn.00460100
add esp, 0x14
push 0x30
push str.CPU_Z_Driver_Error
lea eax, [ebp - 0x510]
push eax
push 0
jmp 0x409752
push 0x30
push edi
push str.CPU_Z_beta_version_expired
jmp 0x409751
push 0x30
push str.Driver_Error
push str.A_previous_version_of_the_device_driver_is_already_running._This_program_requires_driver_version_1.57.
jmp 0x409751
cmp dword [ebp - 0x520], 6
push 0x30
push edi
je 0x40974c
push str.Mutex_locked
jmp 0x409751
push str.Mutex_not_created
push ecx
call esi
cmp dword [ebx + 0x8b8], 0
je case.default.0x40977c
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 0x8bc]
dec eax
cmp eax, 7
ja case.default.0x40977c
jmp dword [eax*4 + 0x409c99]
push 0x5b8848
lea eax, [ebx + 0x4b4]
push eax
push 0x6138c8
call fcn.00563457
add esp, 0xc
cmp dword [0x6138c8], 0
je case.default.0x40977c
mov edi, dword [0x6139b8]
push 0xc
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x4097d5
push dword [0x6138c8]
mov ecx, eax
call fcn.00461e10
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push str.CPU_Z_TXT_Report
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push str.Binaries
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x6141f8
push 0x5b8cd8
push 0x5b8898
push str.CPU_Z_version
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x360]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
jmp 0x409b7c
push 0x5b8848
lea eax, [ebx + 0x4b4]
push eax
push 0x6138c8
call fcn.00563457
add esp, 0xc
cmp dword [0x6138c8], 0
je case.default.0x40977c
mov edi, dword [0x6139b8]
push 0xc
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x40988d
push dword [0x6138c8]
mov ecx, eax
call fcn.00461fe0
mov esi, eax
jmp 0x40988f
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push 0x5b891c
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
jmp 0x4097ec
push str.AttachConsole
push 0x5b9b5c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.default.0x40977c
push 0xffffffffffffffff
call eax
cmp eax, 1
jne case.default.0x40977c
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x6138cc], eax
test eax, eax
je case.default.0x40977c
mov edi, dword [0x6139b8]
push 0x10
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x409923
push dword [0x6138cc]
mov ecx, eax
call fcn.00462310
mov esi, eax
jmp 0x409925
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push str.CPU_Z_Console_Report
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push str.Binaries
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x6141f8
push 0x5b8cd8
push 0x5b8898
push str.CPU_Z_version
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x364]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp case.default.0x40977c
push dword [ebx + 0x8c4]
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
push 0
call dword [eax + 0xdc]
test eax, eax
je case.default.0x40977c
push 0x30
push 0x5b891c
push str.Core_mask_set__please_restart_Windows_to_validate.
push 0
call esi
jmp case.default.0x40977c
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp case.default.0x40977c
push 0x54
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x4099f0
mov edi, eax
call fcn.0040237b
jmp 0x4099f2
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx + 0xd80], eax
mov ebx, 0x17013200
mov esi, eax
call fcn.00402477
mov esi, dword [ebp - 0x51c]
mov eax, dword [esi + 0xd80]
and dword [eax + 0xc], 0
mov ecx, dword [esi + 0xd80]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0xd80]
mov dword [eax + 8], 1
mov ecx, dword [esi + 0xd80]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0xd80]
cmp dword [ecx + 8], 0
jne 0x409a36
call fcn.00402341
mov esi, eax
test esi, esi
je 0x409ad8
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x510]
mov edi, 0x200
push eax
mov dword [ebp - 0x514], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str..txt
lea eax, [ebp - 0x510]
push edi
push eax
call fcn.00562e2e
push 0x5b8848
lea eax, [ebp - 0x510]
push eax
push 0x6138c8
call fcn.00563457
mov eax, dword [0x6138c8]
add esp, 0x18
test eax, eax
je 0x409ad8
fld dword [esi + 0x210]
sub esp, 0x10
fstp qword [esp + 8]
fld dword [esi + 0x214]
fstp qword [esp]
push str.__.2f____.2f__n
push eax
call fcn.00563c5e
push dword [0x6138c8]
call fcn.00563521
add esp, 0x1c
mov ebx, dword [ebp - 0x51c]
cmp dword [ebx + 0xd74], 0
je 0x409b03
cmp dword [ebx + 0x8b8], 0
jne 0x409b03
push str.Updates
call fcn.00409d30
pop ecx
push 0
push ebx
call fcn.00408f50
push 0xffffffffffffffff
call fcn.00409d01
pop ecx
call fcn.005651ee
ret
push 0x5b8848
lea eax, [ebx + 0x4b4]
push eax
push 0x6138c8
call fcn.00563457
add esp, 0xc
cmp dword [0x6138c8], 0
je case.default.0x40977c
mov esi, dword [0x6139b8]
push 0x18
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x409b63
push dword [0x6138c8]
mov ecx, eax
call fcn.00462ef0
mov edi, eax
jmp 0x409b65
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x374]
test edi, edi
je 0x409b80
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
push dword [0x6138c8]
call fcn.00563521
pop ecx
jmp case.default.0x40977c
push 0x5b8848
push dword [ebx + 0x8b4]
push 0x6138c8
call fcn.00563457
xor esi, esi
add esp, 0xc
cmp dword [0x6138c8], esi
je 0x409c52
mov edi, dword [0x6139b8]
push 0xc
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 5
cmp eax, esi
je 0x409be5
push dword [0x6138c8]
mov ecx, eax
call fcn.00461e10
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push str.CPU_Z_TXT_Report
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push str.Binaries
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x6141f8
push 0x5b8cd8
push 0x5b8898
push str.CPU_Z_version
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x360]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [0x6138c8]
call fcn.00563521
pop ecx
push 0x5b8848
lea eax, [ebx + 0x4b4]
push eax
push 0x6138c8
call fcn.00563457
add esp, 0xc
cmp dword [0x6138c8], 0
je case.default.0x40977c
mov esi, dword [0x6139b8]
push 0x18
call fcn.00551d80
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 6
jmp 0x409b4e