Function at 0x422f00
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x497771
mov eax, dword fs:[0]
push eax
sub esp, 0x18c
mov eax, dword [0x4c1280]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push ebp
push esi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
lea ecx, [edi + 0x140]
xor eax, eax
xor ebx, ebx
push ecx
mov dword [esp + 0x14], edi
mov dword [edi + 8], ebx
mov word [edi + 0xc], ax
call fcn.00424540
mov edx, dword [esp + 0x1ac]
mov dword [esp + 0x1a4], ebx
lea ebp, [edi + 0x28]
lea esi, [esp + 0x14]
mov dword [edi + 0x18], ebx
mov dword [edi + 0x24], ebx
mov dword [ebp], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x168], ebx
mov dword [edi + 0x16c], ebx
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 0x1c], 5
mov dword [edi + 0x20], ebx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], 0xe
call fcn.00422d50
mov ax, word [esp + 0x14]
cmp ax, 9
je 0x422fba
cmp ax, 6
jne 0x422fc1
mov dword [edi + 0x24], 1
mov eax, 0x6e
mov word [esp + 0x168], ax
mov edx, 0x64
mov word [esp + 0x16c], dx
mov ecx, 0x74
mov eax, 0x6c
mov word [esp + 0x16a], cx
mov ecx, eax
mov edx, 0x2e
mov word [esp + 0x172], dx
mov edx, ecx
mov word [esp + 0x16e], ax
mov word [esp + 0x170], cx
mov word [esp + 0x176], cx
mov byte [esp + 0x152], cl
mov eax, 0x64
lea ecx, [esp + 0x150]
mov word [esp + 0x178], dx
mov word [esp + 0x174], ax
push ecx
lea edx, [esp + 0x16c]
xor eax, eax
push edx
mov word [esp + 0x182], ax
mov byte [esp + 0x158], 0x52
mov byte [esp + 0x159], 0x74
mov byte [esp + 0x15b], 0x47
mov byte [esp + 0x15c], 0x65
mov byte [esp + 0x15d], 0x74
mov byte [esp + 0x15e], 0x56
mov byte [esp + 0x15f], 0x65
mov byte [esp + 0x160], 0x72
mov byte [esp + 0x161], 0x73
mov byte [esp + 0x162], 0x69
mov byte [esp + 0x163], 0x6f
mov byte [esp + 0x164], 0x6e
mov byte [esp + 0x165], bl
call fcn.00425940
push eax
call fcn.00425990
cmp eax, ebx
je 0x4230c9
lea ecx, [esp + 0x38]
push ecx
call eax
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [edi + 0x20], eax
mov dword [edi + 0x1c], edx
mov edx, 0x65
mov eax, 0x72
mov word [esp + 0x180], ax
mov ecx, 0x6b
mov word [esp + 0x17c], cx
mov word [esp + 0x17e], dx
mov word [esp + 0x184], dx
mov eax, 0x6c
mov word [esp + 0x186], ax
mov ecx, 0x6e
mov word [esp + 0x182], cx
mov edx, 0x32
mov word [esp + 0x18a], dx
mov eax, 0x2e
mov edx, 0x6c
mov ecx, 0x33
mov word [esp + 0x18c], ax
mov eax, edx
mov word [esp + 0x188], cx
mov word [esp + 0x190], dx
mov ecx, 0x64
lea edx, [esp + 0x150]
mov word [esp + 0x192], ax
mov word [esp + 0x18e], cx
push edx
lea eax, [esp + 0x180]
xor ecx, ecx
push eax
mov word [esp + 0x19c], cx
mov byte [esp + 0x158], 0x49
mov byte [esp + 0x159], 0x73
mov byte [esp + 0x15a], 0x57
mov byte [esp + 0x15b], 0x6f
mov byte [esp + 0x15c], 0x77
mov byte [esp + 0x15d], 0x36
mov byte [esp + 0x15e], 0x34
mov byte [esp + 0x15f], 0x50
mov byte [esp + 0x160], 0x72
mov byte [esp + 0x161], 0x6f
mov byte [esp + 0x162], 0x63
mov byte [esp + 0x163], 0x65
mov byte [esp + 0x164], 0x73
mov byte [esp + 0x165], 0x73
mov byte [esp + 0x166], bl
call fcn.00425940
push eax
call fcn.00425990
cmp eax, ebx
je 0x423210
push ebp
push 0xffffffffffffffff
call eax
cmp dword [edi + 0x24], ebx
je 0x423221
cmp dword [ebp], ebx
je 0x423221
mov dword [edi + 0x2c], 1
mov ecx, dword [esp + 0x18]
mov al, 0x61
lea edx, [esp + 0x150]
mov byte [esp + 0x15b], al
mov byte [esp + 0x164], al
push edx
lea eax, [esp + 0x16c]
push eax
mov dword [edi + 0x30], ecx
mov byte [esp + 0x158], 0x4e
mov byte [esp + 0x159], 0x74
mov byte [esp + 0x15a], 0x53
mov byte [esp + 0x15b], 0x65
mov byte [esp + 0x15c], 0x74
mov byte [esp + 0x15d], 0x49
mov byte [esp + 0x15e], 0x6e
mov byte [esp + 0x15f], 0x66
mov byte [esp + 0x160], 0x6f
mov byte [esp + 0x161], 0x72
mov byte [esp + 0x162], 0x6d
mov byte [esp + 0x164], 0x74
mov byte [esp + 0x165], 0x69
mov byte [esp + 0x166], 0x6f
mov byte [esp + 0x167], 0x6e
mov byte [esp + 0x168], 0x54
mov byte [esp + 0x169], 0x68
mov byte [esp + 0x16a], 0x72
mov byte [esp + 0x16b], 0x65
mov byte [esp + 0x16d], 0x64
mov byte [esp + 0x16e], bl
call fcn.00425940
push eax
call fcn.00425990
mov esi, eax
cmp esi, ebx
je 0x423321
push ebx
push ebx
push 0x11
push 0xfffffffffffffffe
call esi
push 4
push 4
push 0x11
push 0xfffffffffffffffe
call esi
test eax, eax
mov eax, edi
jne 0x423323
mov dword [edi + 4], 1
jmp 0x423323
mov eax, edi
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.00472a79
add esp, 0x198
ret 4