Function at 0x41dac0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46b010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push 0x48e488
lea ecx, [esp + 0x10]
call fcn.0045dd36
push ecx
xor ebx, ebx
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x4881a4
mov dword [esp + 0x54], ebx
call fcn.0045dd36
lea eax, [esp + 0x30]
push eax
call fcn.0040e420
add esp, 8
push eax
mov ecx, 0x48e534
mov byte [esp + 0x50], 1
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CFUN
call fcn.0045dd36
lea ecx, [esp + 0x30]
push ecx
call fcn.0040e420
add esp, 8
push eax
mov ecx, 0x48e52c
mov byte [esp + 0x50], 2
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CFUP
call fcn.0045dd36
lea edx, [esp + 0x30]
push edx
call fcn.0040e420
add esp, 8
push eax
mov ecx, 0x48e528
mov byte [esp + 0x50], 3
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CPUR
call fcn.0045dd36
lea eax, [esp + 0x30]
push eax
call fcn.0040e420
add esp, 8
push eax
mov ecx, 0x48e520
mov byte [esp + 0x50], 4
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CPUS
call fcn.0045dd36
lea ecx, [esp + 0x30]
push ecx
call fcn.0040e420
add esp, 8
push eax
mov ecx, 0x48e51c
mov byte [esp + 0x50], 5
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CPCK
call fcn.0045dd36
lea edx, [esp + 0x30]
push edx
call fcn.0040e420
add esp, 8
push eax
mov ecx, 0x48e524
mov byte [esp + 0x50], 6
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
mov eax, dword [0x48e524]
mov eax, dword [eax - 8]
cmp eax, 0x14
jge 0x41ddae
push 0x48e488
lea ecx, [esp + 0x14]
call fcn.0045dd36
mov edx, dword [0x48e4fc]
lea ecx, [esp + 0x10]
push ecx
push 0x48e488
push edx
mov byte [esp + 0x58], 7
call fcn.00464ff9
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp dword [eax - 8], ebx
jle 0x41dd1d
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x4885f0
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 8
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CKID
call fcn.0045dd36
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x5c], 9
call fcn.0045da3d
lea eax, [esp + 0x38]
mov byte [esp + 0x58], 7
push eax
call fcn.0040e280
add esp, 0x10
push eax
mov ecx, 0x48e524
mov byte [esp + 0x50], 0xa
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 7
call fcn.0045dcc8
push 0x48e488
push 0x4878d4
mov ecx, 0x48e524
call fcn.0045bd07
mov eax, dword [0x48e524]
cmp dword [eax - 8], 0x14
jle 0x41dda1
mov ecx, dword [0x4892e4]
mov dword [esp + 0x14], ecx
push eax
lea edx, [esp + 0x18]
push str.CKID_s__expiresThu__01_Jan_2030_00:00:01_GMT
push edx
mov byte [esp + 0x58], 0xb
call fcn.0045c3bf
mov eax, dword [esp + 0x20]
mov ecx, dword [0x48e4fc]
push eax
push 0x48e488
push ecx
call fcn.00464fc5
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x48e524
call fcn.0045da3d
push ecx
mov byte [esp + 0x54], 0xc
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.CPCK
call fcn.0045dd36
mov byte [esp + 0x54], 0xb
call fcn.0040e550
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 7
call fcn.0045dcc8
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
lea edx, [esp + 0x38]
push edx
call fcn.0040f150
add esp, 4
push str._CKID
push eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x54], 0xd
push eax
call fcn.0045df5d
push 0x48e524
lea ecx, [esp + 0x34]
push eax
push ecx
mov byte [esp + 0x58], 0xe
call fcn.0045def7
lea ecx, [esp + 0x34]
mov byte [esp + 0x4c], 0x11
call fcn.0045dcc8
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c], 0x10
call fcn.0045dcc8
lea edx, [esp + 0x2c]
push edx
call fcn.0040f9a0
add esp, 4
mov ecx, dword [0x48e528]
mov edx, dword [0x48e52c]
mov eax, dword [eax]
push ecx
mov ecx, dword [0x48779c]
push edx
mov edx, dword [0x48e518]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [0x48e534]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push str.HDID_sHDINFO_sIP_sPVER_sPID_dUSER_sPW_s
push eax
mov byte [esp + 0x70], 0x12
call fcn.0045c3bf
add esp, 0x24
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0x10
call fcn.0045dcc8
mov ecx, dword [esp + 0xc]
push str.LoginServer
push ecx
mov ecx, dword [0x48e544]
call fcn.0041d2b0
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0045da3d
lea eax, [esp + 0x30]
push eax
call fcn.0040d780
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 0x13
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0x10
call fcn.0045dcc8
lea ecx, [esp + 0xc]
mov dword [0x48e54c], ebx
push ecx
lea edx, [esp + 0x30]
push str.DATA
push edx
call fcn.0045dfd1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 0x14
call fcn.0045de01
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0x10
call fcn.0045dcc8
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x68]
push edx
push eax
lea eax, [esp + 0x10]
push ecx
push eax
call fcn.00411580
add esp, 0x10
push 0xa
lea ecx, [esp + 0x20]
push ebx
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 0x15
call fcn.0045be8d
mov edx, dword [esp + 0x1c]
push str.UA2_100
push edx
mov byte [esp + 0x54], 0x16
call fcn.00445c80
add esp, 8
test eax, eax
jne 0x41e333
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x17
mov ecx, esp
mov dword [esp + 0x44], esp
push str.SERVERTIME
call fcn.0045dd36
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
mov byte [esp + 0x5c], 0x18
call fcn.0045da3d
lea ecx, [esp + 0x38]
mov byte [esp + 0x58], 0x16
push ecx
call fcn.0040e280
add esp, 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x4c], 0x19
cmp dword [eax - 8], ebx
jle 0x41df9d
mov ecx, dword [0x48e540]
push eax
call fcn.00424040
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x1a
mov ecx, esp
mov dword [esp + 0x44], esp
push str.HDID
call fcn.0045dd36
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x5c], 0x1b
call fcn.0045da3d
lea eax, [esp + 0x1c]
mov byte [esp + 0x58], 0x19
push eax
call fcn.0040e280
add esp, 0x10
mov eax, dword [esp + 0x10]
mov byte [esp + 0x4c], 0x1c
cmp dword [eax - 8], ebx
jle 0x41e051
mov ecx, dword [0x48e534]
push ecx
push eax
call fcn.00439ed6
add esp, 8
test eax, eax
je 0x41e051
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x48e534
call fcn.0045de01
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0045da3d
push ecx
mov byte [esp + 0x54], 0x1d
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x4881a4
call fcn.0045dd36
mov byte [esp + 0x54], 0x1c
call fcn.0040e550
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x1e
mov ecx, esp
mov dword [esp + 0x44], esp
push str.USERID
call fcn.0045dd36
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x5c], 0x1f
call fcn.0045da3d
lea ecx, [esp + 0x34]
mov byte [esp + 0x58], 0x1c
push ecx
call fcn.0040e280
add esp, 0x10
mov edx, dword [esp + 0x10]
mov byte [esp + 0x4c], 0x20
cmp dword [edx - 8], ebx
jle 0x41e0bd
lea eax, [esp + 0x28]
mov ecx, 0x48e530
push eax
call fcn.0045de01
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x21
mov ecx, esp
mov dword [esp + 0x44], esp
push str.CKID
call fcn.0045dd36
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x5c], 0x22
call fcn.0045da3d
lea eax, [esp + 0x24]
mov byte [esp + 0x58], 0x20
push eax
call fcn.0040e280
add esp, 0x10
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x4c], 0x23
cmp dword [ecx - 8], 0x14
jle 0x41e1ac
lea edx, [esp + 0x18]
mov ecx, 0x48e524
push edx
call fcn.0045de01
mov eax, dword [0x4892e4]
mov dword [esp + 0x14], eax
mov ecx, dword [0x48e524]
lea edx, [esp + 0x14]
push ecx
push str.CKID_s__expiresThu__01_Jan_2030_00:00:01_GMT
push edx
mov byte [esp + 0x58], 0x24
call fcn.0045c3bf
mov eax, dword [esp + 0x20]
mov ecx, dword [0x48e4fc]
push eax
push 0x48e488
push ecx
call fcn.00464fc5
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x48e524
call fcn.0045da3d
push ecx
mov byte [esp + 0x54], 0x25
mov ecx, esp
mov dword [esp + 0x44], esp
push str.CPCK
call fcn.0045dd36
mov byte [esp + 0x54], 0x24
call fcn.0040e550
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 0x23
call fcn.0045dcc8
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x26
mov ecx, esp
mov dword [esp + 0x44], esp
push str.WINPFLAG
call fcn.0045dd36
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x5c], 0x27
call fcn.0045da3d
lea eax, [esp + 0x30]
mov byte [esp + 0x58], 0x23
push eax
call fcn.0040e280
mov ecx, dword [esp + 0x34]
push 0x488054
push ecx
mov byte [esp + 0x64], 0x28
call fcn.00439ed6
add esp, 0x18
test eax, eax
jne 0x41e23f
cmp dword [esi + 0x70], ebx
jne 0x41e23f
cmp dword [esi + 0x74], ebx
jne 0x41e23f
push ebx
push ebx
push ebx
push ebx
push 0x473b00
call fcn.0045d239
push ebx
push ebx
push ebx
push ebx
push 0x473c00
mov dword [esi + 0x70], eax
call fcn.0045d239
mov dword [esi + 0x74], eax
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x29
mov ecx, esp
mov dword [esp + 0x44], esp
push str.TASK
call fcn.0045dd36
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x5c], 0x2a
call fcn.0045da3d
lea eax, [esp + 0x2c]
mov byte [esp + 0x58], 0x28
push eax
call fcn.0040e280
mov ecx, dword [esp + 0x30]
push 0x488054
push ecx
mov byte [esp + 0x64], 0x2b
call fcn.00439ed6
add esp, 0x18
test eax, eax
jne 0x41e2b6
mov ecx, dword [0x48e55c]
cmp dword [ecx + 0xc], ebx
jne 0x41e2b6
call fcn.00408070
mov edx, dword [0x48e550]
push ebx
push 0x64
push 0x7e9
push edx
mov esi, 1
mov dword [0x48e54c], 2
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], 0x28
call fcn.0045dcc8
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 0x23
call fcn.0045dcc8
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 0x20
call fcn.0045dcc8
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0x1c
call fcn.0045dcc8
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 0x19
call fcn.0045dcc8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0x16
call fcn.0045dcc8
jmp 0x41e58d
mov eax, dword [esp + 0x1c]
push str.UA2_500
push eax
call fcn.00445c80
add esp, 8
test eax, eax
jne 0x41e573
mov esi, 1
push 0x48e488
mov ecx, 0x48e528
mov dword [0x48e54c], esi
call fcn.0045de51
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x48e488
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x2c
mov ecx, esp
mov dword [esp + 0x44], esp
push str.CFUP
call fcn.0045dd36
mov byte [esp + 0x54], 0x16
call fcn.0040e550
add esp, 4
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x2d
mov ecx, esp
mov dword [esp + 0x44], esp
push str.HDID
call fcn.0045dd36
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov byte [esp + 0x5c], 0x2e
call fcn.0045da3d
lea eax, [esp + 0x1c]
mov byte [esp + 0x58], 0x16
push eax
call fcn.0040e280
add esp, 0x10
mov eax, dword [esp + 0x10]
mov byte [esp + 0x4c], 0x2f
cmp dword [eax - 8], ebx
jle 0x41e44e
mov ecx, dword [0x48e534]
push ecx
push eax
call fcn.00439ed6
add esp, 8
test eax, eax
je 0x41e44e
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x48e534
call fcn.0045de01
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0045da3d
push ecx
mov byte [esp + 0x54], 0x30
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x4881a4
call fcn.0045dd36
mov byte [esp + 0x54], 0x2f
call fcn.0040e550
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x487df8
call fcn.0045dd36
push ecx
mov byte [esp + 0x54], 0x31
mov ecx, esp
mov dword [esp + 0x44], esp
push str.CKID
call fcn.0045dd36
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x5c], 0x32
call fcn.0045da3d
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 0x2f
push ecx
call fcn.0040e280
add esp, 0x10
mov edx, dword [esp + 0x14]
mov byte [esp + 0x4c], 0x33
cmp dword [edx - 8], 0x14
jle 0x41e53e
lea eax, [esp + 0x14]
mov ecx, 0x48e524
push eax
call fcn.0045de01
mov ecx, dword [0x4892e4]
mov dword [esp + 0x18], ecx
mov edx, dword [0x48e524]
lea eax, [esp + 0x18]
push edx
push str.CKID_s__expiresThu__01_Jan_2030_00:00:01_GMT
push eax
mov byte [esp + 0x58], 0x34
call fcn.0045c3bf
mov ecx, dword [esp + 0x24]
mov edx, dword [0x48e4fc]
push ecx
push 0x48e488
push edx
call fcn.00464fc5
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x48e524
call fcn.0045da3d
push ecx
mov byte [esp + 0x54], 0x35
mov ecx, esp
mov dword [esp + 0x44], esp
push str.CPCK
call fcn.0045dd36
mov byte [esp + 0x54], 0x34
call fcn.0040e550
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 0x33
call fcn.0045dcc8
mov eax, dword [0x48e550]
push ebx
push 0x1f4
push 0x7e9
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 0x2f
call fcn.0045dcc8
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 0x16
call fcn.0045dcc8
jmp 0x41e58d
mov ecx, dword [0x48e550]
push ebx
push 0x3e8
push 0x7e9
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor esi, esi
mov edx, dword [0x48e550]
push ebx
push ebx
push 0x7eb
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0x15
call fcn.0045dcc8
lea ecx, [esp + 8]
mov byte [esp + 0x4c], 0x10
call fcn.0045dcc8
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], bl
call fcn.0045dcc8
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0045dcc8
mov ecx, dword [esp + 0x44]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x48
ret