Function at 0x210041060
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x798
movabs rax, 0xe23acefc81f45106
mov qword [rsp + 0x528], rax
cmp dword [rsp + 0x7a8], 1
je 0x21004103b
mov eax, 1
jmp 0x210042e42
mov dword [rsp + 0x47c], 0xfa99818d
movabs rax, 0x5aef6f5f451093ac
mov qword [rsp + 0x780], rax
movabs rax, 0xc79166dbb3a2938a
xchg ecx, eax
invalid
mov qword [rsp + 0x4d8], rax
mov byte [rsp + 0x1a8], 0x3b
movabs rax, 0xc58b891f081afcf9
mov qword [rsp + 0x4e0], rax
mov dword [rsp + 0x480], 0xa3926a1e
mov byte [rsp + 0x1bb], 0xaf
movabs rax, 0x973a71c099629620
mov qword [rsp + 0x4e8], rax
mov dword [rsp + 0x484], 0xc5afddd1
mov dword [rsp + 0x488], 0xb2d9bf14
mov byte [rsp + 0x150], 0xf6
mov qword [rsp + 0x310], 0
mov byte [rsp + 0x151], 0xe6
mov dword [rsp + 0x48c], 0x296c3394
mov dword [rsp + 0x4d0], 0xfeb63410
mov byte [rsp + 0x152], 0x35
mov byte [rsp + 0x153], 0x99
mov byte [rsp + 0x154], 0x8a
mov rax, qword gs:[0x30]
mov qword [rsp + 0x310], rax
mov byte [rsp + 0x155], 0xf4
mov dword [rsp + 0x4d4], 0x18f4cad2
movabs rax, 0x8611058d05ffb0e0
mov al, 0xff
add eax, 0x8611058d
mov qword [rsp + 0x4f0], rax
mov byte [rsp + 0x156], 0x9c
mov dword [rsp + 0x318], 0x25f4abb0
mov byte [rsp + 0x157], 0x79
mov dword [rsp + 0x31c], 0x2e4ecb16
mov rax, qword [rsp + 0x310]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x490], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x490]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x1c0], rax
movabs rax, 0xa9619e40453ed278
mov qword [rsp + 0x4f8], rax
mov byte [rsp + 0x158], 0x3e
mov byte [rsp + 0x159], 0x94
mov dword [rsp + 0x320], 0x1bd3eace
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x200], 0x4b
movabs rax, 0xa4860b7a8bea30ff
mov qword [rsp + 0x500], rax
mov byte [rsp + 0x15a], 0x82
mov byte [rsp + 0x15b], 0x87
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x200], 0x45
movabs rax, 0x9f014f875cd8483f
mov qword [rsp + 0x508], rax
mov byte [rsp + 0x15c], 0xe
movabs rax, 0x182d127be14787ce
mov qword [rsp + 0x510], rax
movabs rax, 0x4db92c5ba53a178
mov qword [rsp + 0x518], rax
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x200], 0x52
mov byte [rsp + 0x15d], 0x8e
mov dword [rsp + 0x324], 0xa18ff688
movabs rax, 0xe0dc495f1a1600bf
mov qword [rsp + 0x520], rax
movabs rax, 0xd56f1d6f16c23e84
mov qword [rsp + 0x658], rax
mov eax, 1
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rbx], 0xc6
test byte [rax + rax], al
add al, byte [rax]
add byte [rsi - 0x39], cl
test byte [rax + rbp], ah
add eax, dword [rax]
add ch, dh
sbb eax, 0x1b8f596
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rsi + rax*8], 0x84
add al, 0
add al, byte [rax]
add byte [rbp - 0x39], al
test byte [rsp + rbp], ah
add eax, dword [rax]
add ah, bl
sub edi, dword [rdi - 0x62]
mov byte [rsp + 0x15e], 0x91
mov byte [rsp + 0x15f], 0x40
mov dword [rsp + 0x330], 0x32012c53
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x200], 0x4c
movabs rax, 0x4cac419c0e19da76
mov qword [rsp + 0x530], rax
xor byte [0x1c84c1306], al
popfq
mov bl, 0xe1
repne stosd dword [rdi], eax
invalid
sub byte [rdx], cl
mov qword [rsp + 0x538], rax
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x200], 0x33
mov dword [rsp + 0x334], 0x425c1e83
movabs rax, 0xa26df01b958286f2
mov qword [rsp + 0x540], rax
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x200], 0x32
mov dword [rsp + 0x338], 0xe67c437f
mov byte [rsp + 0x160], 0xbb
mov dword [rsp + 0x33c], 0x92010dde
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x200], 0x2e
mov byte [rsp + 0x161], 0x95
mov dword [rsp + 0x340], 0x155f212a
mov byte [rsp + 0x162], 0x39
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x200], 0x44
add rsp, 0x798
ret
jmp 0x210041005