Function at 0x40b6f0
Capabilities:
Create process on windows
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x59d0c2
mov eax, dword fs:[0]
push eax
sub esp, 0x514
mov eax, dword [0x614b80]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x614b80]
xor eax, esp
push eax
lea eax, [esp + 0x528]
mov dword fs:[0], eax
mov eax, dword [0x627190]
inc eax
mov dword [0x627190], eax
imul eax, eax, 0x64
mov edi, ecx
mov ecx, eax
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x6271a0]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
test ecx, ecx
je 0x40b760
push 0
push eax
call fcn.004354e0
push 0x5cbed4
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40b7e3
mov cl, 0x65
mov dl, 0x67
mov byte [esp + 0x27], cl
mov byte [esp + 0x2c], cl
mov byte [esp + 0x30], cl
mov byte [esp + 0x32], cl
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], dl
mov dl, 0x72
push ecx
mov bl, 0x73
push eax
mov byte [esp + 0x2c], 0x49
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x44
mov byte [esp + 0x30], 0x62
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x35], dl
mov byte [esp + 0x36], 0x50
mov byte [esp + 0x37], dl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0
call ebp
test eax, eax
je 0x40b7e3
call eax
test eax, eax
jne 0x40bf94
mov ecx, dword [edi + 0xb4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x1c]
push eax
call edx
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x40b8ee
mov eax, dword [edi + 0x8cc]
mov dword [eax + 0xa60], 1
cmp dword [edi + 0x8bc], 0
jne 0x40b8ee
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0xb4]
add ecx, 4
push eax
push eax
je 0x40b8c1
push str.The_error_code_0x_X___d__occured_during_initialization._nDo_you_want_to_display_the_error_log_file__
lea edx, [esp + 0x130]
push 0x200
push edx
call fcn.00439b90
add esp, 0x14
push 0x34
push str.CPU_Z_Error
lea eax, [esp + 0x12c]
push eax
push 0
call esi
cmp eax, 6
jne 0x40b8ee
mov eax, dword [edi + 0xb4]
push 1
push 0
push 0
add eax, 4
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40b8ee
mov ecx, dword [edi + 0xb4]
add ecx, 4
push ecx
push str.Unable_to_open__s
lea edx, [esp + 0x12c]
push 0x200
push edx
call fcn.00439b90
add esp, 0x10
push 0x34
push str.CPU_Z_Driver_Error
lea eax, [esp + 0x12c]
push eax
jmp 0x40b8ea
push str.The_error_code_0x_X___d__occured_during_initialization.
lea ecx, [esp + 0x130]
push 0x200
push ecx
call fcn.00439b90
add esp, 0x14
push 0x30
push str.CPU_Z_Error
lea edx, [esp + 0x12c]
push edx
push 0
call esi
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x20]
push edx
call eax
test eax, eax
jne 0x40b983
mov eax, dword [esp + 0x1c]
cmp eax, 8
je 0x40b965
cmp eax, 0x10
je 0x40b957
cmp eax, 0x20
je 0x40b949
push eax
push eax
push str.The_error_code_0x_X___d__occured_during_parsing.
lea ecx, [esp + 0x130]
push 0x200
push ecx
call fcn.00439b90
add esp, 0x14
push 0x30
push str.CPU_Z_Driver_Error
lea edx, [esp + 0x12c]
push edx
jmp 0x40b97f
push 0x30
push str.CPU_Z_Error
push str.CPU_Z_beta_version_expired
jmp 0x40b97f
push 0x30
push str.Driver_Error
push str.A_previous_version_of_the_device_driver_is_already_running._This_program_requires_driver_version_1.58.
jmp 0x40b97f
cmp dword [esp + 0x20], 6
push 0x30
push str.CPU_Z_Error
je 0x40b97a
push str.Mutex_locked
jmp 0x40b97f
push str.Mutex_not_created
push 0
call esi
cmp dword [edi + 0x8bc], 0
je case.default.0x40b9ab
push 0xfa0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [edi + 0x8c0]
dec eax
cmp eax, 7
ja case.default.0x40b9ab
jmp dword [eax*4 + 0x40bfbc]
push 0x5cabdc
add edi, 0x4b8
push edi
push 0x627188
call fcn.00579b2a
add esp, 0xc
cmp dword [0x627188], 0
je case.default.0x40b9ab
mov edi, dword [0x62727c]
push 0xc
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 0
test eax, eax
je 0x40ba0d
mov ecx, dword [0x627188]
push ecx
mov ecx, eax
call fcn.0043b9f0
mov esi, eax
jmp 0x40ba0f
xor esi, esi
mov dword [esp + 0x530], 0xffffffff
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.CPU_Z_TXT_Report
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Binaries
mov ecx, esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push 0x627abc
push 0x5cb058
push 0x5cac2c
push str.CPU_Z_version
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
add esp, 0x14
mov ecx, esi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x360]
push esi
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov eax, dword [0x627188]
push eax
jmp 0x40bf59
push 0x5cabdc
add edi, 0x4b8
push edi
push 0x627188
call fcn.00579b2a
add esp, 0xc
cmp dword [0x627188], 0
je case.default.0x40b9ab
mov edi, dword [0x62727c]
push 0xc
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 1
test eax, eax
je 0x40baed
mov ecx, dword [0x627188]
push ecx
mov ecx, eax
call fcn.0043bc40
mov esi, eax
jmp 0x40baef
xor esi, esi
mov dword [esp + 0x530], 0xffffffff
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 0x5cac9c
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
jmp 0x40ba31
push str.AttachConsole
push 0x5cbed4
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call ebp
test eax, eax
je case.default.0x40b9ab
or ebp, 0xffffffff
push ebp
call eax
cmp eax, 1
jne case.default.0x40b9ab
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [0x62718c], eax
test eax, eax
je case.default.0x40b9ab
mov edi, dword [0x62727c]
push 0x10
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 2
test eax, eax
je 0x40bb93
mov ecx, dword [0x62718c]
push ecx
mov ecx, eax
call fcn.0043bf10
mov esi, eax
jmp 0x40bb95
xor esi, esi
mov dword [esp + 0x530], ebp
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.CPU_Z_Console_Report
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Binaries
mov ecx, esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push 0x627abc
push 0x5cb058
push 0x5cac2c
push str.CPU_Z_version
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
add esp, 0x14
mov ecx, esi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x364]
push esi
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
jmp case.default.0x40b9ab
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0x8c8]
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
push edx
push 0
call eax
test eax, eax
je case.default.0x40b9ab
push 0x30
push 0x5cac9c
push str.Core_mask_set__please_restart_Windows_to_validate.
push 0
call esi
jmp case.default.0x40b9ab
mov edi, dword [edi + 0xb4]
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
jmp case.default.0x40b9ab
push 0x54
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 3
test eax, eax
je 0x40bc7c
call fcn.00402a60
jmp 0x40bc7e
xor eax, eax
mov dword [esp + 0x530], 0xffffffff
mov ebx, 0x17013200
mov esi, eax
mov dword [edi + 0xd88], eax
call fcn.00402b80
mov ecx, dword [edi + 0xd88]
mov dword [ecx + 0xc], 0
mov ecx, dword [edi + 0xd88]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [edi + 0xd88]
mov dword [ecx + 8], 1
mov ecx, dword [edi + 0xd88]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [edi + 0xd88]
cmp dword [ecx + 8], 0
jne 0x40bcc8
mov edx, ecx
call fcn.00402a20
mov esi, eax
test esi, esi
je case.default.0x40b9ab
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x128]
push edx
mov dword [esp + 0x20], 0x200
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
push str..txt
lea eax, [esp + 0x128]
push 0x200
push eax
call fcn.0057951b
push 0x5cabdc
lea ecx, [esp + 0x134]
push ecx
push 0x627188
call fcn.00579b2a
mov eax, dword [0x627188]
add esp, 0x18
test eax, eax
je case.default.0x40b9ab
fld dword [esi + 0x210]
sub esp, 0x10
fstp qword [esp + 8]
fld dword [esi + 0x214]
fstp qword [esp]
push str.__.2f____.2f__n
push eax
call fcn.0057a1fa
mov edx, dword [0x627188]
push edx
call fcn.00579bf4
add esp, 0x1c
jmp case.default.0x40b9ab
push 0x5cabdc
add edi, 0x4b8
push edi
push 0x627188
call fcn.00579b2a
add esp, 0xc
cmp dword [0x627188], 0
je case.default.0x40b9ab
mov edi, dword [0x62727c]
push 0x18
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 4
test eax, eax
je 0x40bde3
mov ecx, dword [0x627188]
push ecx
mov ecx, eax
call fcn.0043cad0
mov esi, eax
mov dword [esp + 0x530], 0xffffffff
jmp 0x40bf37
xor esi, esi
mov dword [esp + 0x530], 0xffffffff
jmp 0x40bf37
mov edx, dword [edi + 0x8b8]
push 0x5cabdc
push edx
push 0x627188
call fcn.00579b2a
add esp, 0xc
or ebp, 0xffffffff
cmp dword [0x627188], 0
je 0x40bed7
mov ebx, dword [0x62727c]
push 0xc
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 5
test eax, eax
je 0x40be53
mov ecx, dword [0x627188]
push ecx
mov ecx, eax
call fcn.0043b9f0
mov esi, eax
jmp 0x40be55
xor esi, esi
mov dword [esp + 0x530], ebp
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.CPU_Z_TXT_Report
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Binaries
mov ecx, esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push 0x627abc
push 0x5cb058
push 0x5cac2c
push str.CPU_Z_version
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
add esp, 0x14
mov ecx, esi
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x360]
push esi
mov ecx, ebx
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov eax, dword [0x627188]
push eax
call fcn.00579bf4
add esp, 4
push 0x5cabdc
add edi, 0x4b8
push edi
push 0x627188
call fcn.00579b2a
add esp, 0xc
cmp dword [0x627188], 0
je case.default.0x40b9ab
mov edi, dword [0x62727c]
push 0x18
call fcn.00568473
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 6
test eax, eax
je 0x40bf2e
mov ecx, dword [0x627188]
push ecx
mov ecx, eax
call fcn.0043cad0
mov esi, eax
jmp 0x40bf30
xor esi, esi
mov dword [esp + 0x530], ebp
mov edx, dword [edi]
mov eax, dword [edx + 0x374]
push esi
mov ecx, edi
call eax
test esi, esi
je 0x40bf52
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov ecx, dword [0x627188]
push ecx
call fcn.00579bf4
add esp, 4
mov eax, dword [0x627190]
mov ecx, dword [0x6271a0]
inc eax
mov dword [0x627190], eax
test ecx, ecx
je 0x40bf94
imul eax, eax, 0x64
mov edx, eax
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
push 0
add eax, edx
push eax
call fcn.004354e0
mov ecx, dword [esp + 0x528]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0057943e
add esp, 0x520
ret