Function at 0x653000
Capabilities:
Get number of processors
Terminate process

Disassembly:
jmp 0x653003
mov eax, dword [0x656048]
and eax, 0x20
test eax, eax
jne 0x6530a3
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x6569f0], eax
mov dword [0x6569f8], eax
mov dword [0x6569fc], edx
mov eax, dword fs:[0x30]
test eax, eax
js 0x653081
push 0x6569f4
push 4
push pe_nt_image_headers32
mov ecx, dword [0x6569f0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x65307f
mov eax, dword [0x6569f8]
add dword [eax + 0x50], 0x2000
jmp 0x6530a2
jmp 0x6530a2
mov edx, dword [0x6569fc]
test edx, edx
jns 0x6530a2
mov edx, dword [edx + 4]
mov dword [0x6569ec], edx
add dword [edx + 0x50], 0x2000
xor dword [edx + 0x11], 0x424f4420
nop
call fcn.00655660
cmp dword [0x656594], 0
jne 0x653157
mov ecx, dword [0x65607c]
mov dword [0x656a20], ecx
push 0x1e
push 0x656168
call fcn.006554a6
add esp, 8
push 0x64
push 0x656188
call fcn.006554a6
add esp, 8
push 0x64
push 0x6561f0
call fcn.006554a6
add esp, 8
push 0x64
push 0x656258
call fcn.006554a6
add esp, 8
push 0x64
push 0x6562c0
call fcn.006554a6
add esp, 8
push 0x64
push 0x656328
call fcn.006554a6
add esp, 8
push 0x64
push 0x656390
call fcn.006554a6
add esp, 8
push 0x64
push 0x6563f8
call fcn.006554a6
add esp, 8
push 0x64
push 0x656460
call fcn.006554a6
add esp, 8
push 0x64
push 0x6564c8
call fcn.006554a6
add esp, 8
call fcn.00655318
mov edx, dword [0x656048]
and edx, 0x20
test edx, edx
je 0x6531a1
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov dword [0x65658c], eax
pop ebp
cmp dword [0x65658c], 1
je 0x653190
cmp dword [0x65658c], 2
je 0x653190
mov dword [ebp - 4], 0
jmp 0x653197
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov dword [0x656590], eax
jmp 0x6531ab
mov dword [0x656590], 1
mov dword [0x656598], 0
mov ecx, entry0
sub ecx, dword [0x656018]
mov dword [0x656534], ecx
mov edx, dword [0x656034]
add edx, dword [0x656534]
mov dword [0x65653c], edx
mov eax, dword [0x656044]
add eax, dword [0x656534]
mov dword [0x656540], eax
cmp dword [0x656590], 0
je 0x6533cc
cmp dword [0x656594], 0
jne 0x6533cc
mov dword [0x656594], 1
mov dword [0x656598], 1
call fcn.006551d2
test eax, eax
je 0x6533cc
call fcn.006548a3
test eax, eax
je 0x6533cc
mov ecx, dword [0x656070]
xor ecx, dword [0x656068]
mov dword [0x656070], ecx
mov edx, dword [0x656074]
xor edx, dword [0x656060]
mov dword [0x656074], edx
call fcn.00654b1b
test eax, eax
je 0x6533ba
call fcn.00653da5
push 0x656a28
call fcn.00653e82
add esp, 4
call fcn.00654b26
mov dword [0x656538], eax
cmp dword [0x656538], 0
je 0x65338d
call fcn.00654c1e
test eax, eax
je 0x65338d
mov eax, dword [0x656048]
and eax, 0x20
test eax, eax
je 0x6532b2
push 0x656a3c
call fcn.00653e82
add esp, 4
jmp 0x6532bf
push 0x656a4c
call fcn.00653e82
add esp, 4
call fcn.006545e5
test eax, eax
je 0x653386
mov ecx, dword [0x656070]
xor ecx, dword [0x656068]
mov dword [0x656070], ecx
mov edx, dword [0x656074]
xor edx, dword [0x656060]
mov dword [0x656074], edx
call fcn.006547b2
mov dword [0x6569e4], eax
cmp dword [0x6569e4], 0
je 0x653372
mov eax, dword [0x656014]
add eax, dword [0x656534]
push eax
call fcn.00653af9
add esp, 4
test eax, eax
je 0x653372
mov ecx, dword [0x656010]
add ecx, dword [0x656534]
push ecx
call fcn.00653578
add esp, 4
test eax, eax
je 0x653372
call fcn.006539ae
test eax, eax
je 0x653372
call fcn.00653bfc
test eax, eax
je 0x653372
mov dword [0x656598], 0
mov edx, dword [0x656070]
xor edx, dword [0x6569e4]
mov dword [0x656070], edx
mov eax, dword [0x656074]
xor eax, dword [0x656060]
mov dword [0x656074], eax
push 0x8000
push 0
mov ecx, dword [0x656584]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.00654218
jmp 0x6533b8
call fcn.00654218
push 0x64
push 0x656368
push 0x656188
call fcn.00654ab4
add esp, 0xc
push 0x656168
push 0x656368
call fcn.006542a4
add esp, 8
jmp 0x6533cc
push 0x656168
push 0x656258
call fcn.006542a4
add esp, 8
cmp dword [0x6569dc], 0
je 0x6533f3
push 0x10
push 0x656168
push 0x656a60
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x656598], 1
cmp dword [0x656598], 0
je 0x653419
mov edx, dword [0x656048]
and edx, 0x20
test edx, edx
je 0x653411
mov eax, 0
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x6569d8], 1
mov eax, dword [0x656538]
and eax, 0x8000
test eax, eax
je 0x653445
mov ecx, dword [0x656050]
imul ecx, ecx, 0xea60
mov dword [0x6569e8], ecx
jmp 0x653457
mov edx, dword [0x656054]
imul edx, edx, 0x3e8
mov dword [0x6569e8], edx
mov eax, dword [0x6569e8]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x6565b0], eax
push 0x6565a0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [0x656008]
add edx, dword [0x656534]
mov dword [0x656530], edx
mov eax, dword [0x656068]
cmp eax, dword [0x6569e4]
je 0x6534a0
mov ecx, dword [0x6569e4]
mov dword [0x656068], ecx
mov edx, dword [0x656048]
and edx, 0x20
test edx, edx
jne 0x6534c8
cld
push edi
push ecx
mov edi, 0x653003
mov ecx, 0x6534a0
sub ecx, edi
shr ecx, 2
mov ax, 0xeb00
rep stosw word es:[edi], ax
pop ecx
pop edi
jmp dword [0x656530]