Function at 0x40b9e0
Capabilities:
Create process on windows
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x5a1812
mov eax, dword fs:[0]
push eax
sub esp, 0x514
mov eax, dword [0x619e70]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x619e70]
xor eax, esp
push eax
lea eax, [esp + 0x528]
mov dword fs:[0], eax
mov eax, dword [0x62c550]
inc eax
mov dword [0x62c550], eax
imul eax, eax, 0x64
mov edi, ecx
mov ecx, eax
mov eax, 0x66666667
imul ecx
mov ecx, dword [0x62c560]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
test ecx, ecx
je 0x40ba50
push 0
push eax
call fcn.00435190
push 0x5d1724
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40bad3
mov cl, 0x65
mov dl, 0x67
mov byte [esp + 0x27], cl
mov byte [esp + 0x2c], cl
mov byte [esp + 0x30], cl
mov byte [esp + 0x32], cl
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], dl
mov dl, 0x72
push ecx
mov bl, 0x73
push eax
mov byte [esp + 0x2c], 0x49
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x44
mov byte [esp + 0x30], 0x62
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x35], dl
mov byte [esp + 0x36], 0x50
mov byte [esp + 0x37], dl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0
call ebp
test eax, eax
je 0x40bad3
call eax
test eax, eax
jne 0x40c284
mov ecx, dword [edi + 0xb4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x1c]
push eax
call edx
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x40bbde
mov eax, dword [edi + 0x8cc]
mov dword [eax + 0xa60], 1
cmp dword [edi + 0x8bc], 0
jne 0x40bbde
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0xb4]
add ecx, 4
push eax
push eax
je 0x40bbb1
push str.The_error_code_0x_X___d__occured_during_initialization._nDo_you_want_to_display_the_error_log_file__
lea edx, [esp + 0x130]
push 0x200
push edx
call fcn.0043a300
add esp, 0x14
push 0x34
push str.CPU_Z_Error
lea eax, [esp + 0x12c]
push eax
push 0
call esi
cmp eax, 6
jne 0x40bbde
mov eax, dword [edi + 0xb4]
push 1
push 0
push 0
add eax, 4
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40bbde
mov ecx, dword [edi + 0xb4]
add ecx, 4
push ecx
push str.Unable_to_open__s
lea edx, [esp + 0x12c]
push 0x200
push edx
call fcn.0043a300
add esp, 0x10
push 0x34
push str.CPU_Z_Driver_Error
lea eax, [esp + 0x12c]
push eax
jmp 0x40bbda
push str.The_error_code_0x_X___d__occured_during_initialization.
lea ecx, [esp + 0x130]
push 0x200
push ecx
call fcn.0043a300
add esp, 0x14
push 0x30
push str.CPU_Z_Error
lea edx, [esp + 0x12c]
push edx
push 0
call esi
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x20]
push edx
call eax
test eax, eax
jne 0x40bc73
mov eax, dword [esp + 0x1c]
cmp eax, 8
je 0x40bc55
cmp eax, 0x10
je 0x40bc47
cmp eax, 0x20
je 0x40bc39
push eax
push eax
push str.The_error_code_0x_X___d__occured_during_parsing.
lea ecx, [esp + 0x130]
push 0x200
push ecx
call fcn.0043a300
add esp, 0x14
push 0x30
push str.CPU_Z_Driver_Error
lea edx, [esp + 0x12c]
push edx
jmp 0x40bc6f
push 0x30
push str.CPU_Z_Error
push str.CPU_Z_beta_version_expired
jmp 0x40bc6f
push 0x30
push str.Driver_Error
push str.A_previous_version_of_the_device_driver_is_already_running._This_program_requires_driver_version_1.58.
jmp 0x40bc6f
cmp dword [esp + 0x20], 6
push 0x30
push str.CPU_Z_Error
je 0x40bc6a
push str.Mutex_locked
jmp 0x40bc6f
push str.Mutex_not_created
push 0
call esi
cmp dword [edi + 0x8bc], 0
je case.default.0x40bc9b
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x8c0]
dec eax
cmp eax, 7
ja case.default.0x40bc9b
jmp dword [eax*4 + 0x40c2ac]
push 0x5d03cc
add edi, 0x4b8
push edi
push 0x62c548
call fcn.0057e238
add esp, 0xc
cmp dword [0x62c548], 0
je case.default.0x40bc9b
mov edi, dword [0x62c63c]
push 0xc
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 0
test eax, eax
je 0x40bcfd
mov ecx, dword [0x62c548]
push ecx
mov ecx, eax
call fcn.0043c200
mov esi, eax
jmp 0x40bcff
xor esi, esi
mov dword [esp + 0x530], 0xffffffff
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.CPU_Z_TXT_Report
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Binaries
mov ecx, esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push 0x62ce7c
push 0x5d0848
push 0x5d041c
push str.CPU_Z_version
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
add esp, 0x14
mov ecx, esi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x368]
push esi
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov eax, dword [0x62c548]
push eax
jmp 0x40c249
push 0x5d03cc
add edi, 0x4b8
push edi
push 0x62c548
call fcn.0057e238
add esp, 0xc
cmp dword [0x62c548], 0
je case.default.0x40bc9b
mov edi, dword [0x62c63c]
push 0xc
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 1
test eax, eax
je 0x40bddd
mov ecx, dword [0x62c548]
push ecx
mov ecx, eax
call fcn.0043c3d0
mov esi, eax
jmp 0x40bddf
xor esi, esi
mov dword [esp + 0x530], 0xffffffff
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push 0x5d048c
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
jmp 0x40bd21
push str.AttachConsole
push 0x5d1724
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebp
test eax, eax
je case.default.0x40bc9b
or ebp, 0xffffffff
push ebp
call eax
cmp eax, 1
jne case.default.0x40bc9b
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x62c54c], eax
test eax, eax
je case.default.0x40bc9b
mov edi, dword [0x62c63c]
push 0x10
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 2
test eax, eax
je 0x40be83
mov ecx, dword [0x62c54c]
push ecx
mov ecx, eax
call fcn.0043c6a0
mov esi, eax
jmp 0x40be85
xor esi, esi
mov dword [esp + 0x530], ebp
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.CPU_Z_Console_Report
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Binaries
mov ecx, esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push 0x62ce7c
push 0x5d0848
push 0x5d041c
push str.CPU_Z_version
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
add esp, 0x14
mov ecx, esi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x36c]
push esi
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
jmp case.default.0x40bc9b
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0x8c8]
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
push edx
push 0
call eax
test eax, eax
je case.default.0x40bc9b
push 0x30
push 0x5d048c
push str.Core_mask_set__please_restart_Windows_to_validate.
push 0
call esi
jmp case.default.0x40bc9b
mov edi, dword [edi + 0xb4]
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
jmp case.default.0x40bc9b
push 0x54
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 3
test eax, eax
je 0x40bf6c
call fcn.00402be0
jmp 0x40bf6e
xor eax, eax
mov dword [esp + 0x530], 0xffffffff
mov ebx, 0x17013200
mov esi, eax
mov dword [edi + 0xd9c], eax
call fcn.00402d00
mov ecx, dword [edi + 0xd9c]
mov dword [ecx + 0xc], 0
mov ecx, dword [edi + 0xd9c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [edi + 0xd9c]
mov dword [ecx + 8], 1
mov ecx, dword [edi + 0xd9c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [edi + 0xd9c]
cmp dword [ecx + 8], 0
jne 0x40bfb8
mov edx, ecx
call fcn.00402ba0
mov esi, eax
test esi, esi
je case.default.0x40bc9b
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x128]
push edx
mov dword [esp + 0x20], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str..txt
lea eax, [esp + 0x128]
push 0x200
push eax
call fcn.0057dc29
push 0x5d03cc
lea ecx, [esp + 0x134]
push ecx
push 0x62c548
call fcn.0057e238
mov eax, dword [0x62c548]
add esp, 0x18
test eax, eax
je case.default.0x40bc9b
fld dword [esi + 0x214]
sub esp, 0x10
fstp qword [esp + 8]
fld dword [esi + 0x218]
fstp qword [esp]
push str.__.2f____.2f__n
push eax
call fcn.0057e908
mov edx, dword [0x62c548]
push edx
call fcn.0057e302
add esp, 0x1c
jmp case.default.0x40bc9b
push 0x5d03cc
add edi, 0x4b8
push edi
push 0x62c548
call fcn.0057e238
add esp, 0xc
cmp dword [0x62c548], 0
je case.default.0x40bc9b
mov edi, dword [0x62c63c]
push 0x18
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 4
test eax, eax
je 0x40c0d3
mov ecx, dword [0x62c548]
push ecx
mov ecx, eax
call fcn.0043d270
mov esi, eax
mov dword [esp + 0x530], 0xffffffff
jmp 0x40c227
xor esi, esi
mov dword [esp + 0x530], 0xffffffff
jmp 0x40c227
mov edx, dword [edi + 0x8b8]
push 0x5d03cc
push edx
push 0x62c548
call fcn.0057e238
add esp, 0xc
or ebp, 0xffffffff
cmp dword [0x62c548], 0
je 0x40c1c7
mov ebx, dword [0x62c63c]
push 0xc
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 5
test eax, eax
je 0x40c143
mov ecx, dword [0x62c548]
push ecx
mov ecx, eax
call fcn.0043c200
mov esi, eax
jmp 0x40c145
xor esi, esi
mov dword [esp + 0x530], ebp
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.CPU_Z_TXT_Report
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push str.Binaries
mov ecx, esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push 0x62ce7c
push 0x5d0848
push 0x5d041c
push str.CPU_Z_version
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
add esp, 0x14
mov ecx, esi
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x368]
push esi
mov ecx, ebx
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov eax, dword [0x62c548]
push eax
call fcn.0057e302
add esp, 4
push 0x5d03cc
add edi, 0x4b8
push edi
push 0x62c548
call fcn.0057e238
add esp, 0xc
cmp dword [0x62c548], 0
je case.default.0x40bc9b
mov edi, dword [0x62c63c]
push 0x18
call fcn.0056cb85
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x530], 6
test eax, eax
je 0x40c21e
mov ecx, dword [0x62c548]
push ecx
mov ecx, eax
call fcn.0043d270
mov esi, eax
jmp 0x40c220
xor esi, esi
mov dword [esp + 0x530], ebp
mov edx, dword [edi]
mov eax, dword [edx + 0x37c]
push esi
mov ecx, edi
call eax
test esi, esi
je 0x40c242
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov ecx, dword [0x62c548]
push ecx
call fcn.0057e302
add esp, 4
mov eax, dword [0x62c550]
mov ecx, dword [0x62c560]
inc eax
mov dword [0x62c550], eax
test ecx, ecx
je 0x40c284
imul eax, eax, 0x64
mov edx, eax
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
push 0
add eax, edx
push eax
call fcn.00435190
mov ecx, dword [esp + 0x528]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0057db4c
add esp, 0x520
ret