Function at 0x4095cb
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Get system information on windows
Hash data using sha256
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x10d0
call fcn.00403377
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
call fcn.004381bf
xor eax, eax
jmp 0x4095f1
dec eax
jmp 0x4095f9
cmp dword [esi + eax*4 + 4], 0
lea eax, [eax + 1]
jne 0x4095f2
jmp 0x409607
mov dword [0x440130], ebx
lea ebx, [esp + 0xac]
mov dword [0x440138], esi
mov dword [0x440134], edi
mov dword [0x44013c], eax
jmp 0x40962f
jmp 0x409632
jmp 0x409635
jmp 0x40963f
jmp 0x409644
jmp 0x40964a
jmp 0x40964d
jmp 0x409655
jmp 0x409659
jmp 0x409661
jmp 0x40966b
jmp 0x409673
jmp 0x40967a
jmp 0x409684
jmp 0x409686
jmp 0x40968a
jmp 0x40968f
jmp 0x409697
jmp 0x40969c
jmp 0x40969f
jmp 0x4096a5
lea esi, [esp + 0xcc]
lea edx, [esp + 0x48]
mov dword [ebx], 0x405660
mov dword [ebx + 4], 0x400
and dword [ebx + 8], 0
mov ecx, esi
mov dword [edx], ebx
jmp 0x4096cd
call fcn.0040b8c8
cmp word [esi], 0
jne 0x4099a3
jmp 0x4096df
mov ecx, dword [0x40565c]
mov edi, dword [0x405658]
movzx eax, byte [esp + 0xce]
lea edx, [esp + 0xa0]
lea esi, [esp + 0x118]
mov dword [edx + 4], ecx
mov dword [edx], edi
jmp 0x409708
mov ecx, esi
push eax
call fcn.0040b93f
pop eax
cmp word [esi + 8], 0
jne 0x4099a3
jmp 0x409721
mov eax, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
jmp 0x409731
lea ecx, [esp + 0x48]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
push eax
call fcn.0040b9cd
pop ecx
test ax, ax
jne 0x4099a3
lea esi, [esp + 0xd4]
lea edx, [esp + 0x48]
jmp 0x40975b
mov ecx, esi
call fcn.0040b8c8
cmp word [esi], 0
jne 0x4099a3
jmp 0x409770
movzx eax, byte [esp + 0xd6]
mov ecx, dword [0x40565c]
lea edx, [esp + 0x94]
lea esi, [esp + 0x1a8]
mov dword [edx], edi
mov dword [edx + 4], ecx
jmp 0x409795
mov ecx, esi
push eax
call fcn.0040b93f
pop eax
cmp word [esi + 8], 0
jne 0x4099a3
jmp 0x4097ac
mov eax, dword [esp + 0x1ac]
mov edx, dword [esp + 0x1a8]
jmp 0x4097bd
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], eax
push eax
call fcn.0040b9cd
pop ecx
test ax, ax
jne 0x4099a3
lea esi, [esp + 0x54]
lea edx, [esp + 0x48]
jmp 0x4097e8
mov ecx, esi
call fcn.0040ba4a
cmp word [esi + 2], 0
jne 0x4099a3
jmp 0x4097fe
movzx eax, word [esp + 0x54]
lea esi, [esp + 0x7c]
lea edx, [esp + 0x48]
mov ecx, esi
mov word [esp + 0x20], ax
jmp 0x40981b
call fcn.0040b8c8
cmp word [esi], 0
jne 0x4099a3
jmp 0x409834
movzx esi, byte [esp + 0x7e]
mov eax, dword [0x40565c]
lea edx, [esp + 0x70]
lea ecx, [esp + 0x2a8]
mov dword [edx], edi
mov dword [edx + 4], eax
jmp 0x409855
mov dword [esp + 0x38], esi
push esi
call fcn.0040b93f
pop eax
lea eax, [esp + 0x2a8]
cmp word [eax + 8], 0
jne 0x4099a3
jmp 0x409877
mov eax, dword [esp + 0x2ac]
mov edx, dword [esp + 0x2a8]
jmp 0x40988c
lea ecx, [esp + 0x48]
mov dword [esp + 0x28], edx
push eax
call fcn.0040b9cd
pop ecx
test ax, ax
jne 0x4099a3
lea esi, [esp + 0x84]
lea edx, [esp + 0x48]
jmp 0x4098b7
mov ecx, esi
call fcn.0040ba4a
cmp word [esi + 2], 0
jne 0x4099a3
jmp 0x4098cf
movzx esi, word [esp + 0x84]
mov eax, dword [0x40565c]
lea edx, [esp + 0xdc]
lea ecx, [esp + 0x3b0]
mov dword [edx], edi
mov dword [edx + 4], eax
jmp 0x4098f5
mov dword [esp + 0x34], esi
push esi
call fcn.0040b93f
pop eax
lea eax, [esp + 0x3b0]
cmp word [eax + 8], 0
jne 0x4099a3
jmp 0x409916
mov eax, dword [esp + 0x3b4]
mov edx, dword [esp + 0x3b0]
jmp 0x409927
lea ecx, [esp + 0x48]
mov dword [esp + 0x50], edx
push eax
call fcn.0040b9cd
pop ecx
test ax, ax
jne 0x4099a3
lea esi, [esp + 0x5c]
lea edx, [esp + 0x48]
jmp 0x409946
mov ecx, esi
call fcn.0040bac8
cmp word [esi + 4], 0
jne 0x4099a3
lea esi, [esp + 0x8c]
lea edx, [esp + 0x48]
jmp 0x409967
mov ecx, esi
call fcn.0040b8c8
cmp word [esi], 0
jne 0x4099a3
jmp 0x40997b
mov al, byte [esp + 0x8e]
lea esi, [esp + 0xe8]
lea edx, [esp + 0x48]
mov ecx, esi
mov byte [esp + 0x13], al
jmp 0x409997
call fcn.0040bac8
cmp word [esi + 4], 0
je 0x409a1e
jmp 0x4099aa
jmp 0x4099ad
jmp 0x4099b1
jmp 0x4099bb
jmp 0x4099c2
jmp 0x4099cc
jmp 0x4099ce
jmp 0x4099d4
jmp 0x4099da
jmp 0x4099e1
jmp 0x4099e4
jmp 0x4099e8
jmp 0x4099ef
jmp 0x4099f2
jmp 0x4099f8
jmp 0x4099fa
jmp 0x409a04
jmp 0x409a07
xor eax, eax
jmp 0x409a13
jmp 0x409a15
inc eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [esp + 0x13]
lea esi, [esp + 0xe8]
mov dword [esp + 0x10c], eax
jmp 0x409a35
mov eax, dword [esi]
mov dword [esp + 0x108], eax
mov eax, dword [0x40565c]
jmp 0x409a4a
jmp 0x409a52
jmp 0x409a5b
jmp 0x409a5f
jmp 0x409a63
jmp 0x409a68
jmp 0x409a6b
jmp 0x409a75
jmp 0x409a7b
jmp 0x409a84
jmp 0x409a89
jmp 0x409a90
jmp 0x409a96
jmp 0x409a9c
jmp 0x409aa5
jmp 0x409aad
jmp 0x409ab4
jmp 0x409ab9
jmp 0x409ac0
jmp 0x409aca
jmp 0x409ad2
jmp 0x409ad5
jmp 0x409ade
jmp 0x409ae8
jmp 0x409af0
jmp 0x409afa
jmp 0x409afe
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], eax
and dword [esp + 0x68], 0
and dword [esp + 0x64], 0
jmp 0x409b15
call 0x43b97c
mov dword [esp + 0xa8], eax
jmp 0x409b26
mov edx, esi
push 0x10
call fcn.0040bb56
pop eax
lea ecx, [esp + 0x2a8]
jmp 0x409b3a
call fcn.0040bb91
mov dword [esp + 0xac], eax
mov esi, eax
mov eax, edx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], 0x4053fa
mov dword [esp + 0x30], edx
xor eax, eax
inc eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4053fc
mov dword [esp + 0xc0], 7
mov dword [esp + 0xc4], 0x405404
mov dword [esp + 0xc8], eax
xor eax, eax
jmp 0x409b9a
jmp 0x409b9d
push 0xffffffffffffffe0
pop ecx
test ecx, ecx
jmp 0x409ba7
je 0x409bbf
jmp 0x409bb3
add eax, dword [esp + ecx + 0xd0]
add ecx, 8
jmp 0x409ba0
lea edx, [esp + 0x1a8]
lea ecx, [esp + 0x5c]
lea edi, [esp + 0x3b0]
jmp 0x409bd9
mov dword [edx], ecx
mov dword [edx + 4], 0x405a64
jmp 0x409be8
mov ecx, edi
push eax
call fcn.0040b93f
pop eax
cmp word [edi + 8], 0
je 0x409c0c
jmp 0x409bfd
jmp 0x409c07
jmp 0x40a54d
mov eax, dword [esp + 0xa8]
shr eax, 0x10
mov dword [esp + 0x100], eax
jmp 0x409c23
mov eax, dword [esp + 0x3b0]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x3b4]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x104], eax
xor eax, eax
jmp 0x409c47
cmp dword [esp + 0x30], eax
je 0x409c5b
jmp 0x409c52
mov cl, byte [esi + eax]
mov byte [edx + eax], cl
inc eax
jmp 0x409c42
mov dword [esp + 0x2c], 0
jmp 0x409c6c
cmp dword [esp + 0x2c], 3
je 0x409cbe
jmp 0x409c75
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
xor edi, edi
mov edx, dword [esp + eax*8 + 0xb4]
mov ecx, dword [esp + eax*8 + 0xb8]
mov eax, dword [esp + 0x6c]
add esi, eax
cmp ecx, edi
jmp 0x409c9f
je 0x409cae
jmp 0x409ca5
mov al, byte [edx + edi]
mov byte [esi + edi], al
inc edi
jmp 0x409c93
jmp 0x409cb4
add dword [esp + 0x30], ecx
inc dword [esp + 0x2c]
jmp 0x409c63
lea esi, [esp + 0x3a8]
mov eax, 0x405a64
jmp 0x409cd3
jmp 0x409cd9
lea ecx, [esp + 0x2a8]
mov dword [esi + 4], eax
lea eax, [esp + 0x5c]
mov dword [esi], eax
jmp 0x409cf3
call fcn.0040bc48
mov edi, edx
jmp 0x409d03
lea ecx, [esp + 0x94]
mov edx, esi
push edi
push eax
call fcn.0040bceb
pop eax
pop ecx
lea eax, [esp + 0x94]
cmp word [eax + 8], 0
jne 0x40a54d
jmp 0x409d2b
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x40]
lea edi, [esp + 0x3b0]
lea edx, [esp + 0x2a8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x5c]
mov dword [ecx], eax
mov eax, 0x405a64
mov dword [ecx + 4], eax
jmp 0x409d69
jmp 0x409d72
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, edi
mov eax, dword [eax + 0x10]
movzx esi, word [eax + 0x38]
mov eax, dword [eax + 0x3c]
jmp 0x409d8c
shr esi, 1
push esi
push eax
push 0x100
call fcn.0040bd60
add esp, 0xc
jmp 0x409da7
mov edx, dword [edi]
lea ecx, [esp + 0x2a8]
jmp 0x409db8
jmp 0x409dc2
call fcn.0040be27
mov edi, edx
lea esi, [esp + 0x70]
jmp 0x409dd6
lea edx, [esp + 0x40]
mov ecx, esi
push edi
push eax
call fcn.0040bceb
pop eax
pop ecx
cmp word [esi + 8], 0
jne 0x40a54d
jmp 0x409df3
mov eax, dword [esp + 0x70]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xfc], eax
jmp 0x409e13
mov eax, dword [0x44012c]
movsd xmm0, qword [esp + 0xe8]
movsd xmm1, qword [esp + 0xf0]
test eax, eax
movsd qword [esp + 0x16c], xmm1
movsd qword [esp + 0x164], xmm0
jne 0x409e74
lea esi, [esp + 0x3b0]
jmp 0x409e50
jmp 0x409e53
jmp 0x409e7a
mov dword [esp + 0x118], eax
jmp 0x409e88
jmp 0x40a552
jmp 0x40a556
jmp 0x40a55b
jmp 0x40a561
jmp 0x40a56a
jmp 0x40a572
jmp 0x40a576
jmp 0x40a57d
jmp 0x40a57f
jmp 0x409a07