Function at 0x41ba90
Capabilities:
Create process on windows
Get number of processors
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44c766
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1f0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x200]
mov dword [esp + 0x1c], eax
xor eax, eax
xor edi, edi
mov dword [esp + 0x1f8], edi
mov dword [esp + 0x20], 0x80004005
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.004179a0
test eax, eax
je 0x41bb0c
call fcn.004197b0
call fcn.00419f60
call fcn.0042f900
push 0x40
lea ecx, [esp + 0x74]
push edi
mov dword [esp + 0x200], edi
push ecx
mov dword [esp + 0x78], edi
call fcn.0043e780
xor edx, edx
add esp, 0xc
mov dword [esp + 0x98], 1
mov word [esp + 0x9c], dx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41bb6b
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00406c60
mov dword [esp + 0x18], edi
call fcn.00437f69
cdq
mov ecx, 0x64
idiv ecx
push edi
mov esi, edx
inc esi
lea ebx, [esi + esi*4 + 0x15]
call fcn.00439283
add esp, 4
push 0x63
lea edx, [esp + 0x189]
push edi
push edx
mov byte [esp + 0x190], 0
call fcn.0043e780
add esp, 0xc
call fcn.00417d90
test eax, eax
je 0x41bbb5
call fcn.004181d0
push esi
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebp, [esp + 0x70]
mov dword [esp + 0x34], esp
cmp eax, 0x10
jb 0x41bbdf
mov ecx, dword [edi]
jmp 0x41bbe1
mov ecx, edi
cmp ecx, 0x4551b8
ja 0x41bc1c
cmp eax, 0x10
jb 0x41bbf2
mov ecx, dword [edi]
jmp 0x41bbf4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4551b8
jbe 0x41bc1c
cmp eax, 0x10
jb 0x41bc08
mov edi, dword [edi]
push 2
mov eax, 0x4551b8
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41bc60
cmp eax, 2
jae 0x41bc2e
mov ecx, dword [esi + 0x14]
push ecx
push 2
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41bc3a
mov eax, dword [edi]
jmp 0x41bc3c
mov eax, edi
push 2
push 0x4551b8
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 2
jb 0x41bc5c
mov edi, dword [edi]
mov byte [edi + 2], 0
lea esi, [esp + 0x130]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x1fc], 3
call fcn.00401640
mov esi, pe_nt_image_headers32
cmp dword [eax + 0x18], esi
jb 0x41bc8c
mov eax, dword [eax + 4]
jmp 0x41bc8f
add eax, 4
push eax
lea edx, [esp + 0x18c]
push 0x64
push edx
call fcn.004399ae
add esp, 0x10
cmp dword [esp + 0x68], esi
jb 0x41bcb5
mov eax, dword [esp + 0x54]
push eax
call fcn.00437f8b
add esp, 4
mov ebp, 0xf
xor edi, edi
lea esi, [esp + 0x110]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], edi
mov byte [esp + 0x54], 0
mov byte [esp + 0x1f8], 0
call fcn.00429620
lea ecx, [esp + 0x50]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebp, pe_nt_image_headers32
mov dword [esp + 0x34], esp
cmp eax, ebp
jb 0x41bd07
mov ecx, dword [edi]
jmp 0x41bd09
mov ecx, edi
cmp ecx, 0x4551bc
ja 0x41bd42
cmp eax, ebp
jb 0x41bd19
mov ecx, dword [edi]
jmp 0x41bd1b
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4551bc
jbe 0x41bd42
cmp eax, ebp
jb 0x41bd2e
mov edi, dword [edi]
push 4
mov eax, 0x4551bc
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41bd84
cmp eax, 4
jae 0x41bd54
mov ecx, dword [esi + 0x14]
push ecx
push 4
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x41bd5f
mov eax, dword [edi]
jmp 0x41bd61
mov eax, edi
push 4
push 0x4551bc
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 4
cmp dword [esi + 0x18], ebp
jb 0x41bd80
mov edi, dword [edi]
mov byte [edi + 4], 0
lea esi, [esp + 0x130]
call fcn.004014c0
mov byte [esp + 0x1fc], 4
call fcn.00401770
mov byte [esp + 0x1f8], 5
cmp dword [eax + 0x18], ebp
jb 0x41bdaf
mov eax, dword [eax + 4]
jmp 0x41bdb2
add eax, 4
lea edx, [esp + 0x204]
push edx
mov edi, eax
lea esi, [esp + 0x16c]
call fcn.00405920
add esp, 4
cmp dword [esp + 0x68], ebp
jb 0x41bdde
mov eax, dword [esp + 0x54]
push eax
call fcn.00437f8b
add esp, 4
xor edi, edi
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], edi
mov byte [esp + 0x54], 0
lea esi, [esp + 0x110]
mov byte [esp + 0x1f8], 8
call fcn.00429620
lea eax, [esp + 0x184]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41be10
sub eax, edx
push eax
lea ecx, [esp + 0x188]
push ecx
lea eax, [esp + 0x170]
call fcn.00405ca0
mov eax, dword [esp + 0x16c]
cmp dword [esp + 0x180], ebp
jae 0x41be45
lea eax, [esp + 0x16c]
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x70]
push ecx
push edi
push edi
push 0x8000000
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, edi
jne 0x41c01b
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
lea edx, [esp + 0x38]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x38], esp
cmp eax, ebp
jb 0x41be9f
mov ecx, dword [edi]
jmp 0x41bea1
mov ecx, edi
cmp ecx, str._WRUH
ja 0x41beda
cmp eax, ebp
jb 0x41beb1
mov ecx, dword [edi]
jmp 0x41beb3
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str._WRUH
jbe 0x41beda
cmp eax, ebp
jb 0x41bec6
mov edi, dword [edi]
push 0x2d
mov eax, str._WRUH
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41bf1c
cmp eax, 0x2d
jae 0x41beec
mov ecx, dword [esi + 0x14]
push ecx
push 0x2d
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x41bef7
mov eax, dword [edi]
jmp 0x41bef9
mov eax, edi
push 0x2d
push str._WRUH
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x2d
cmp dword [esi + 0x18], ebp
jb 0x41bf18
mov edi, dword [edi]
mov byte [edi + 0x2d], 0
lea esi, [esp + 0xdc]
call fcn.004014c0
mov byte [esp + 0x200], 9
call fcn.004018b0
mov byte [esp + 0x1fc], 0xa
cmp dword [eax + 0x18], ebp
jb 0x41bf47
mov eax, dword [eax + 4]
jmp 0x41bf4a
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x10
cmp dword [esp + 0x4c], ebp
jb 0x41bf6d
mov eax, dword [esp + 0x38]
push eax
call fcn.00437f8b
add esp, 4
xor edi, edi
lea esi, [esp + 0xb8]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], edi
mov byte [esp + 0x38], 0
mov byte [esp + 0x1f8], 8
call fcn.00429620
call fcn.00437f69
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00437f69
cdq
idiv esi
cmp edx, esi
jg 0x41bfb9
mov eax, esi
cdq
idiv esi
cmp edx, edi
je 0x41bfbe
call fcn.00435230
call ebx
mov esi, eax
sub esi, 0x7ff90000
cmp dword [esp + 0x180], ebp
jb 0x41bfe1
mov edx, dword [esp + 0x16c]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x180], 0xf
mov dword [esp + 0x17c], edi
mov byte [esp + 0x16c], 0
cmp dword [esp + 0x21c], ebp
jb 0x41c014
mov eax, dword [esp + 0x208]
push eax
call fcn.00437f8b
add esp, 4
mov eax, esi
jmp 0x41c39e
mov ecx, dword [esp + 0x24]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x18], eax
call fcn.00417cd0
test eax, eax
je 0x41c03d
call fcn.00406c60
cmp dword [esp + 0x18], 0x102
jne 0x41c1be
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
lea ebp, [esp + 0x50]
mov dword [esp + 0x30], esp
cmp eax, ebx
jb 0x41c07c
mov ecx, dword [edi]
jmp 0x41c07e
mov ecx, edi
cmp ecx, 0x4551f4
ja 0x41c0b7
cmp eax, ebx
jb 0x41c08e
mov ecx, dword [edi]
jmp 0x41c090
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4551f4
jbe 0x41c0b7
cmp eax, ebx
jb 0x41c0a3
mov edi, dword [edi]
push 0x20
mov eax, 0x4551f4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41c0f9
cmp eax, 0x20
jae 0x41c0c9
mov ecx, dword [esi + 0x14]
push ecx
push 0x20
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x41c0d4
mov eax, dword [edi]
jmp 0x41c0d6
mov eax, edi
push 0x20
push 0x4551f4
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x20
cmp dword [esi + 0x18], ebx
jb 0x41c0f5
mov edi, dword [edi]
mov byte [edi + 0x20], 0
lea esi, [esp + 0xd4]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x1f8], 0xb
call fcn.00401a50
mov byte [esp + 0x1f8], 0xc
cmp dword [eax + 0x18], ebx
jb 0x41c128
mov eax, dword [eax + 4]
jmp 0x41c12b
add eax, 4
mov edx, dword [esp + 0x1c]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0xc
cmp dword [esp + 0x4c], ebx
jb 0x41c14e
mov eax, dword [esp + 0x38]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0xb8]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
mov byte [esp + 0x1f8], 8
call fcn.00429620
mov ecx, dword [esp + 0x24]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.00417d60
mov ecx, eax
mov eax, 0x939a85c5
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x6f
jle 0x41c2f5
push 0x6f
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00418240
call fcn.00401440
jmp 0x41c2f5
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41c2f5
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x41c1e7
mov dword [esp + 0x20], edi
jmp 0x41c2f5
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
lea ebp, [esp + 0x54]
mov dword [esp + 0x34], esp
cmp eax, ebx
jb 0x41c219
mov ecx, dword [edi]
jmp 0x41c21b
mov ecx, edi
cmp ecx, 0x455218
ja 0x41c254
cmp eax, ebx
jb 0x41c22b
mov ecx, dword [edi]
jmp 0x41c22d
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455218
jbe 0x41c254
cmp eax, ebx
jb 0x41c240
mov edi, dword [edi]
push 0x1a
mov eax, 0x455218
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41c296
cmp eax, 0x1a
jae 0x41c266
mov ecx, dword [esi + 0x14]
push ecx
push 0x1a
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x41c271
mov eax, dword [edi]
jmp 0x41c273
mov eax, edi
push 0x1a
push 0x455218
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x1a
cmp dword [esi + 0x18], ebx
jb 0x41c292
mov edi, dword [edi]
mov byte [edi + 0x1a], 0
lea esi, [esp + 0xd8]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x1fc], 0xd
call fcn.00401a50
mov byte [esp + 0x1fc], 0xe
cmp dword [eax + 0x18], ebx
jb 0x41c2c5
mov eax, dword [eax + 4]
jmp 0x41c2c8
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x10
lea ecx, [esp + 0x34]
call fcn.00402ba0
lea esi, [esp + 0xb8]
mov byte [esp + 0x1f8], 8
call fcn.00429620
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41c32d
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, 1
jmp 0x41c32f
xor eax, eax
sub eax, 1
jne 0x41c33e
call fcn.004197b0
call fcn.004182b0
mov ecx, dword [esp + 0x28]
push ecx
call edi
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x180], esi
jb 0x41c363
mov edx, dword [esp + 0x16c]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x180], 0xf
mov dword [esp + 0x17c], 0
mov byte [esp + 0x16c], 0
cmp dword [esp + 0x21c], esi
jb 0x41c39a
mov eax, dword [esp + 0x208]
push eax
call fcn.00437f8b
add esp, 4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.00437983
add esp, 0x1e8
ret 0x20