Function at 0x4091ba
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get hostname

Disassembly:
push 0x514
mov eax, 0x583542
call fcn.0055cd3b
mov ebx, ecx
push 0xffffffffffffffff
mov dword [ebp - 0x51c], ebx
call fcn.004099ba
mov dword [esp], 0x5aff5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x409287
lea ecx, [ebp - 0x110]
push ecx
push eax
mov byte [ebp - 0x110], 0x49
mov byte [ebp - 0x10f], 0x73
mov byte [ebp - 0x10e], 0x44
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x62
mov byte [ebp - 0x10b], 0x75
mov byte [ebp - 0x10a], 0x67
mov byte [ebp - 0x109], 0x67
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x72
mov byte [ebp - 0x106], 0x50
mov byte [ebp - 0x105], 0x72
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x73
mov byte [ebp - 0x102], 0x65
mov byte [ebp - 0x101], 0x6e
mov byte [ebp - 0x100], 0x74
mov byte [ebp - 0xff], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409287
call eax
test eax, eax
jne 0x4097c4
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
lea edx, [ebp - 0x518]
push edx
call dword [eax]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, str.CPU_Z_Error
test eax, eax
jne 0x409379
mov eax, dword [ebx + 0x8c8]
mov dword [eax + 0xa60], 1
cmp dword [ebx + 0x8b8], 0
jne 0x409379
mov eax, dword [ebx + 0xb0]
push dword [ebp - 0x518]
add eax, 4
push dword [ebp - 0x518]
lea eax, [ebp - 0x510]
je 0x409358
push str.The_error_code_0x_X___d__occured_during_initialization._nDo_you_want_to_display_the_error_log_file__
push 0x200
push eax
call fcn.0045eae0
add esp, 0x14
push 0x34
push edi
lea eax, [ebp - 0x510]
push eax
push 0
call esi
cmp eax, 6
jne 0x409379
mov eax, dword [ebx + 0xb0]
push 1
xor ecx, ecx
push ecx
push ecx
add eax, 4
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x409379
mov eax, dword [ebx + 0xb0]
add eax, 4
push eax
push str.Unable_to_open__s
lea eax, [ebp - 0x510]
push 0x200
push eax
call fcn.0045eae0
add esp, 0x10
push 0x34
push str.CPU_Z_Driver_Error
jmp 0x40936e
push str.The_error_code_0x_X___d__occured_during_initialization.
push 0x200
push eax
call fcn.0045eae0
add esp, 0x14
push 0x30
push edi
lea eax, [ebp - 0x510]
push eax
push 0
call esi
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
lea edx, [ebp - 0x520]
push edx
lea edx, [ebp - 0x518]
push edx
call dword [eax + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x40940d
mov eax, dword [ebp - 0x518]
cmp eax, 8
je 0x4093f2
cmp eax, 0x10
je 0x4093e4
cmp eax, 0x20
je 0x4093da
push eax
push eax
push str.The_error_code_0x_X___d__occured_during_parsing.
lea eax, [ebp - 0x510]
push 0x200
push eax
call fcn.0045eae0
add esp, 0x14
push 0x30
push str.CPU_Z_Driver_Error
lea eax, [ebp - 0x510]
push eax
push 0
jmp 0x40940b
push 0x30
push edi
push str.CPU_Z_beta_version_expired
jmp 0x40940a
push 0x30
push str.Driver_Error
push str.A_previous_version_of_the_device_driver_is_already_running._This_program_requires_driver_version_1.55.
jmp 0x40940a
cmp dword [ebp - 0x520], 6
push 0x30
push edi
je 0x409405
push str.Mutex_locked
jmp 0x40940a
push str.Mutex_not_created
push ecx
call esi
cmp dword [ebx + 0x8b8], 0
je case.default.0x409435
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 0x8bc]
dec eax
cmp eax, 7
ja case.default.0x409435
jmp dword [eax*4 + 0x409952]
push 0x5aec48
lea eax, [ebx + 0x4b4]
push eax
push 0x609488
call fcn.0055b013
add esp, 0xc
cmp dword [0x609488], 0
je case.default.0x409435
mov edi, dword [0x609578]
push 0xc
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x40948e
push dword [0x609488]
mov ecx, eax
call fcn.00460830
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push str.CPU_Z_TXT_Report
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push str.Binaries
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x609db8
push 0x5af0d8
push 0x5aec98
push str.CPU_Z_version
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x340]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
jmp 0x409835
push 0x5aec48
lea eax, [ebx + 0x4b4]
push eax
push 0x609488
call fcn.0055b013
add esp, 0xc
cmp dword [0x609488], 0
je case.default.0x409435
mov edi, dword [0x609578]
push 0xc
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x409546
push dword [0x609488]
mov ecx, eax
call fcn.004609f0
mov esi, eax
jmp 0x409548
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push 0x5aed1c
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
jmp 0x4094a5
push str.AttachConsole
push 0x5aff5c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.default.0x409435
push 0xffffffffffffffff
call eax
cmp eax, 1
jne case.default.0x409435
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x60948c], eax
test eax, eax
je case.default.0x409435
mov edi, dword [0x609578]
push 0x10
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4095dc
push dword [0x60948c]
mov ecx, eax
call fcn.00460d20
mov esi, eax
jmp 0x4095de
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push str.CPU_Z_Console_Report
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push str.Binaries
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x609db8
push 0x5af0d8
push 0x5aec98
push str.CPU_Z_version
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x344]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp case.default.0x409435
push dword [ebx + 0x8c4]
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
push 0
call dword [eax + 0xdc]
test eax, eax
je case.default.0x409435
push 0x30
push 0x5aed1c
push str.Core_mask_set__please_restart_Windows_to_validate.
push 0
call esi
jmp case.default.0x409435
mov ecx, dword [ebx + 0xb0]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp case.default.0x409435
push 0x54
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x4096a9
mov edi, eax
call fcn.004022f4
jmp 0x4096ab
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx + 0xd7c], eax
mov ebx, 0x17013200
mov esi, eax
call fcn.004023f0
mov esi, dword [ebp - 0x51c]
mov eax, dword [esi + 0xd7c]
and dword [eax + 0xc], 0
mov ecx, dword [esi + 0xd7c]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0xd7c]
mov dword [eax + 8], 1
mov ecx, dword [esi + 0xd7c]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0xd7c]
cmp dword [ecx + 8], 0
jne 0x4096ef
call fcn.004022ba
mov esi, eax
test esi, esi
je 0x409791
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x510]
mov edi, 0x200
push eax
mov dword [ebp - 0x514], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str..txt
lea eax, [ebp - 0x510]
push edi
push eax
call fcn.0055a9ea
push 0x5aec48
lea eax, [ebp - 0x510]
push eax
push 0x609488
call fcn.0055b013
mov eax, dword [0x609488]
add esp, 0x18
test eax, eax
je 0x409791
fld dword [esi + 0x210]
sub esp, 0x10
fstp qword [esp + 8]
fld dword [esi + 0x214]
fstp qword [esp]
push str.__.2f____.2f__n
push eax
call fcn.0055b81e
push dword [0x609488]
call fcn.0055b0dd
add esp, 0x1c
mov ebx, dword [ebp - 0x51c]
cmp dword [ebx + 0xd70], 0
je 0x4097bc
cmp dword [ebx + 0x8b8], 0
jne 0x4097bc
push str.Updates
call fcn.004099e9
pop ecx
push 0
push ebx
call fcn.00408d18
push 0xffffffffffffffff
call fcn.004099ba
pop ecx
call fcn.0055cdbe
ret
push 0x5aec48
lea eax, [ebx + 0x4b4]
push eax
push 0x609488
call fcn.0055b013
add esp, 0xc
cmp dword [0x609488], 0
je case.default.0x409435
mov esi, dword [0x609578]
push 0x18
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x40981c
push dword [0x609488]
mov ecx, eax
call fcn.00461900
mov edi, eax
jmp 0x40981e
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x354]
test edi, edi
je 0x409839
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
push dword [0x609488]
call fcn.0055b0dd
pop ecx
jmp case.default.0x409435
push 0x5aec48
push dword [ebx + 0x8b4]
push 0x609488
call fcn.0055b013
xor esi, esi
add esp, 0xc
cmp dword [0x609488], esi
je 0x40990b
mov edi, dword [0x609578]
push 0xc
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 5
cmp eax, esi
je 0x40989e
push dword [0x609488]
mov ecx, eax
call fcn.00460830
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
push str.CPU_Z_TXT_Report
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push str.Binaries
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
push 0x609db8
push 0x5af0d8
push 0x5aec98
push str.CPU_Z_version
push esi
call dword [eax + 0x20]
mov eax, dword [esi]
add esp, 0x14
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x340]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [0x609488]
call fcn.0055b0dd
pop ecx
push 0x5aec48
lea eax, [ebx + 0x4b4]
push eax
push 0x609488
call fcn.0055b013
add esp, 0xc
cmp dword [0x609488], 0
je case.default.0x409435
mov esi, dword [0x609578]
push 0x18
call fcn.0054993e
pop ecx
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 6
jmp 0x409807