Function at 0x408830
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
and esp, 0xfffffff8
sub esp, 0x100
mov eax, dword [esp + 0xec]
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe0], 0x1a61433f
mov dword [esp + 0xd8], 0xdae2ad9
mov byte [esp + 0xd7], 0x88
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe0]
xor esi, esi
mov edi, 0x34925e93
sub edi, edx
sbb esi, ecx
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], edi
movzx esi, word [esp + 0xdc]
mov bx, si
mov word [esp + 0xdc], 0x5da5
mov edi, eax
add edi, 0xc7752f95
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xec], edi
lea edi, [esp + 0x54]
mov byte [esp + 0x34], 0x6b
mov dword [esp + 0x24], eax
mov eax, esi
xor eax, 0xc015
mov word [esp + 0xdc], ax
mov al, byte [esp + 0xd7]
mov ah, 0xed
sub ah, al
mov byte [esp + 0x35], ah
and esi, 0xbc81
mov word [esp + 0xdc], si
mov byte [esp + 0x36], 0x72
mov esi, dword [esp + 0x28]
sub esi, 0x51dd2f4d
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x2c]
sbb ecx, 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov byte [esp + 0x13], al
mov word [esp + 0x10], bx
mov dword [esp + 0xc], esi
jb 0x4089a7
jmp 0x408cbf
mov word [esp + 0xdc], 0xf12
mov eax, dword [esp + 0xc0]
mov eax, dword [eax]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x98], eax
mov dword [esp + 0xd0], 0
cmp eax, ecx
je 0x408b2c
jmp 0x408b3b
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x98], eax
jmp 0x408b3b
mov dword [esp + 0xa8], 0
jmp 0x408a75
mov ax, 0x4938
mov cl, byte [esp + 0xd7]
mov dword [esp + 0xf0], 0x2749447a
mov dword [esp + 0xf4], 0
mov dl, cl
xor dl, 0xbb
mov byte [esp + 0x37], 0x6e
mov dword [esp + 0xec], 0x7e56d692
mov ch, 0xf4
sub ch, cl
mov byte [esp + 0x38], 0x65
add cl, 0xaa
mov dh, byte [esp + 0x13]
mov byte [esp + 0xdf], dh
mov byte [esp + 0x39], ch
mov byte [esp + 0x3a], dl
mov byte [esp + 0x3b], cl
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov esi, dword [esp + 0x20]
not esi
mov edi, dword [esp + 0x14]
not edi
mov dword [esp + 0xf0], edi
mov dword [esp + 0xf4], esi
mov bx, word [esp + 0x10]
sub ax, bx
mov word [esp + 0xdc], ax
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 0x56
mov byte [esp + 0x9f], 0x6b
mov byte [esp + 0xdf], 0x9d
mov dword [esp + 0xc4], 0
and bx, 0x22c2
mov word [esp + 0xdc], bx
jmp 0x408c57
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xa8]
mov dx, word [esp + ecx*2 + 0x54]
mov si, word [eax + ecx*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
cmovb si, bx
cmp dx, si
sete al
and al, 1
mov byte [esp + 0xbf], al
mov dx, word [esp + 0x10]
sub dx, 0x2fb
mov word [esp + 0xdc], dx
cmp si, 0
setne al
mov ah, byte [esp + 0x13]
and ah, 0x3e
mov byte [esp + 0xdf], ah
mov ah, byte [esp + 0x13]
xor ah, 0xff
and al, byte [esp + 0xbf]
mov byte [esp + 0xdf], ah
add ecx, 1
mov esi, dword [esp + 0xa0]
mov byte [esp + 0xdf], 0x3b
cmp ecx, esi
setb ah
and ah, al
mov dx, word [esp + 0x10]
xor dx, 0xffff
mov word [esp + 0xdc], dx
mov dword [esp + 0xa8], ecx
test ah, 1
jne 0x408a75
jmp 0x408c24
mov eax, dword [esp + 0xd0]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x98]
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0x30]
add eax, 0xb8c4d963
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xec], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0xb4], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x94], eax
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf0], 0x2d8ba77c
mov eax, dword [esp + 0x30]
xor eax, 0xffffffff
mov dx, word [ecx + 0x24]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x30]
imul ecx, eax, 0xe93d19
shr dx, 1
mov dword [esp + 0xec], ecx
mov word [esp + 0xa6], dx
movzx ecx, word [esp + 0xa6]
mov byte [esp + 0xdf], 0xfd
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xac], 0x2e55a8f2
mov bl, 0xcf
mov al, byte [esp + 0x13]
mul bl
mov byte [esp + 0xdf], al
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x98], 0
cmp ecx, 0xdc3667e
je 0x408b3b
mov byte [esp + 0xdf], 0x5a
cmp word [esp + 0xa6], 0
je 0x40894b
jmp 0x408997
mov eax, dword [esp + 0x30]
or eax, 0x31a4c56f
mov ecx, dword [esp + 0x94]
mov dl, byte [esp + 0xbf]
mov dword [esp + 0xec], eax
mov dword [esp + 0xd0], ecx
test dl, 1
jne 0x408b2c
jmp 0x40894b
mov eax, dword [esp + 0xc4]
movsx ecx, byte [esp + 0x9f]
mov dx, cx
mov word [esp + eax*2 + 0x54], dx
mov ecx, eax
inc ecx
mov dword [esp + 0xec], 0x4ef726e2
mov bl, byte [esp + eax + 0x35]
mov bh, byte [esp + 0x13]
xor bh, 0x1c
mov byte [esp + 0xdf], bh
mov eax, dword [esp + 0x14]
add eax, 0x5e5e4bc4
mov esi, dword [esp + 0x20]
adc esi, 0
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], esi
mov byte [esp + 0x9f], bl
mov dword [esp + 0xc4], ecx
cmp bl, 0
jne 0x408c57
mov eax, dword [esp + 0xd8]
xor eax, 0xdae2ac1
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov edx, dword fs:[ecx]
mov eax, dword [esp + 0x14]
xor eax, 0x2a21728a
mov esi, dword [esp + 0x20]
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], eax
mov eax, 0x354aeeb7
mov edi, dword [esp + 0x30]
sub eax, edi
xor ebx, ebx
mov ecx, edx
sub ecx, 0x1000
cmovb edx, ebx
mov dword [esp + 0xec], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb0]
mov eax, dword [eax]
mov edx, 0x842d76d
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, ebx
mul edx
imul esi, esi, 0x842d76d
add edx, esi
mov dword [esp + 0xf4], edx
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0xb0]
mov byte [esp + 0xdf], 0xd6
mov dword [esp + 0xd0], 0
mov dword [esp + 0xec], 0xf1b1b5f0
cmp eax, edx
mov dword [esp], ecx
je 0x408b2c
jmp 0x408984