Function at 0x10030b30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get number of processors
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x1003f00c]
xor eax, esp
mov dword [esp + 0x54], eax
cmp dword [0x10041178], 0
push esi
push edi
je 0x10030d29
cmp dword [0x1004117c], 0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x10030c14
mov edi, dword [0x1003f8dc]
mov eax, dword fs:[0x2c]
mov edi, dword [eax + edi*4]
nop word [eax + eax]
mov eax, dword [0x1011362c]
cmp eax, dword [edi + 4]
jle 0x10030bcb
push 0x1011362c
call fcn.10031abc
add esp, 4
cmp dword [0x1011362c], 0xffffffff
jne 0x10030bcb
movaps xmm0, xmmword [0x1003bd80]
push 0x100357c0
movups xmmword [0x1011367c], xmm0
call fcn.10031ee1
add esp, 4
push 0x1011362c
call fcn.10031a72
add esp, 4
cmp byte [0x1011368b], 0
je 0x10030bf0
movups xmm0, xmmword [0x1011367c]
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x1011367c], xmm1
nop dword [eax]
push 0x1011367c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xfa
mov dword [0x1004117c], eax
call esi
cmp dword [0x1004117c], 0
je 0x10030b80
push 0xe0
call fcn.10031eff
add esp, 4
mov dword [0x1010dc5c], eax
push 0xe0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
nop word [eax + eax]
mov esi, dword [0x10041178]
mov ecx, dword [esi + 1]
mov edx, dword [ecx + 0x21a0f8]
mov dword [esi + 5], edx
test edx, edx
je 0x10030c87
mov eax, dword [ecx + 0x21a0e4]
mov dword [esi + 0x15], eax
test eax, eax
je 0x10030c87
mov edi, dword [ecx + 0x21a0e8]
mov dword [esi + 0x1d], edi
mov eax, dword [ecx + 0x21a0ec]
mov dword [esi + 0x21], eax
test eax, eax
je 0x10030c87
test edi, edi
je 0x10030c87
mov eax, dword [edx + 0x3c9]
test eax, eax
jne 0x10030c91
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10030c40
push 4
mov dword [esi + 0x25], eax
call fcn.10031eff
mov edx, 0x1003a670
mov dword [eax], vtable.HookedRakClientInterface.0
mov ecx, dword [esi + 5]
mov dword [ecx + 0x3c9], eax
mov ecx, dword [esi + 5]
push ecx
push 5
mov eax, dword [ecx + 0x3cd]
mov eax, dword [eax + 0x20]
mov dword [esi + 0x11], eax
mov eax, dword [ecx + 0x3cd]
mov eax, dword [eax + 0x18]
mov dword [esi + 9], eax
mov eax, dword [ecx + 0x3cd]
mov ecx, 0x584cff
mov eax, dword [eax + 0x1c]
mov dword [esi + 0xd], eax
call fcn.10005fc0
add esp, 4
mov edx, 0x1003a670
mov ecx, 0x584bdd
push 5
call fcn.10005fc0
add esp, 4
mov edx, 0x1003a670
mov ecx, 0x584c2a
push 5
call fcn.10005fc0
mov ecx, dword [esi + 1]
add esp, 4
add ecx, 0x99230
mov edx, 0x1003b298
push 1
call fcn.10005fc0
add esp, 0xc
mov byte [esi], 1
mov eax, dword [0x1003f8dc]
mov esi, dword fs:[0x2c]
movaps xmm0, xmmword [0x1003be90]
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0x38252205
mov esi, dword [esi + eax*4]
mov eax, dword [0x10113648]
mov dword [esp + 0x34], 0x25202d25
mov word [esp + 0x38], 0x2936
mov byte [esp + 0x3a], 0x4c
cmp eax, dword [esi + 4]
jle 0x10030db1
push 0x10113648
call fcn.10031abc
add esp, 4
cmp dword [0x10113648], 0xffffffff
jne 0x10030db1
push 0x1b
lea eax, [esp + 0x24]
push eax
push 0x10113660
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x10035790
call fcn.10031ee1
add esp, 4
push 0x10113648
call fcn.10031a72
add esp, 4
cmp byte [0x1011367a], 0
je 0x10030ded
movups xmm0, xmmword [0x10113660]
mov eax, 0x10
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x10113660], xmm1
nop dword [eax + eax]
xor byte [eax + 0x10113660], 0x4c
inc eax
cmp eax, 0x1b
jb 0x10030de0
push 0x10113660
call fcn.1002cfa0
mov eax, dword [0x10113644]
add esp, 4
mov dword [esp + 0x20], 0x6278797d
mov dword [esp + 0x24], 0x7d627a7d
mov dword [esp + 0x28], 0x7d627a79
mov word [esp + 0x2c], 0x7f7f
mov byte [esp + 0x17], 0x4c
cmp eax, dword [esi + 4]
jle 0x10030e86
push 0x10113644
call fcn.10031abc
add esp, 4
cmp dword [0x10113644], 0xffffffff
jne 0x10030e86
mov eax, dword [esp + 0x28]
movq xmm0, qword [esp + 0x20]
mov dword [0x10113654], eax
mov ax, word [esp + 0x2c]
mov word [0x10113658], ax
mov al, byte [esp + 0x17]
push 0x10035760
movq qword [0x1011364c], xmm0
mov byte [0x1011365a], al
call fcn.10031ee1
add esp, 4
push 0x10113644
call fcn.10031a72
add esp, 4
cmp byte [0x1011365a], 0
je 0x10030e9e
xor eax, eax
xor byte [eax + 0x1011364c], 0x4c
inc eax
cmp eax, 0xf
jb 0x10030e91
mov eax, dword [0x10041178]
push 5
push 0
push 0
mov ecx, dword [eax + 0x25]
push 0x1e61
push 0x1011364c
mov eax, dword [ecx]
call dword [eax + 4]
movaps xmm0, xmmword [0x1003b920]
mov eax, dword [0x10113640]
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x40], 0x291f6c23
movaps xmm0, xmmword [0x1003ba40]
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 0x3e293a3e
mov byte [esp + 0x48], 0x4c
cmp eax, dword [esi + 4]
jle 0x10030f39
push 0x10113640
call fcn.10031abc
add esp, 4
cmp dword [0x10113640], 0xffffffff
jne 0x10030f39
push 0x29
lea eax, [esp + 0x24]
push eax
push 0x101135f8
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x10035730
call fcn.10031ee1
add esp, 4
push 0x10113640
call fcn.10031a72
add esp, 4
cmp byte [0x10113620], 0
je 0x10030f7f
movaps xmm2, xmmword [0x1003be00]
xor eax, eax
nop dword [eax + eax]
movups xmm0, xmmword [eax + 0x101135f8]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x101135f8], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x10030f50
cmp eax, 0x29
jae 0x10030f7f
xor byte [eax + 0x101135f8], 0x4c
inc eax
cmp eax, 0x29
jb 0x10030f72
push 0x101135f8
call fcn.10024cf0
mov eax, dword [0x101136bc]
add esp, 4
mov dword [esp + 0x30], 0x1c1e3e29
mov word [esp + 0x34], 0x4c0f
cmp eax, dword [esi + 4]
jle 0x10030ffa
push 0x101136bc
call fcn.10031abc
add esp, 4
cmp dword [0x101136bc], 0xffffffff
jne 0x10030ffa
mov eax, dword [esp + 0x30]
movaps xmm0, xmmword [0x1003ba30]
mov dword [0x101136d0], eax
mov ax, word [esp + 0x34]
push 0x100358f0
movups xmmword [0x101136c0], xmm0
mov word [0x101136d4], ax
call fcn.10031ee1
add esp, 4
push 0x101136bc
call fcn.10031a72
add esp, 4
cmp byte [0x101136d5], 0
je 0x1003102e
movups xmm0, xmmword [0x101136c0]
mov eax, 0x10
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x101136c0], xmm1
xor byte [eax + 0x101136c0], 0x4c
inc eax
cmp eax, 0x16
jb 0x10031021
push 0x101136c0
call fcn.1002cfa0
mov eax, dword [0x10041178]
add esp, 4
mov ecx, dword [eax + 0x25]
push 0x100313f0
push 0x1003f498
mov eax, dword [ecx]
call dword [eax + 0x58]
mov edi, dword [0x1011186c]
mov eax, dword [0x10113690]
add edi, 0xa170
mov dword [esp + 0x18], 0x3f2d6266
mov word [esp + 0x1c], 0x4c25
cmp eax, dword [esi + 4]
jle 0x100310be
push 0x10113690
call fcn.10031abc
add esp, 4
cmp dword [0x10113690], 0xffffffff
jne 0x100310be
mov eax, dword [esp + 0x18]
mov dword [0x10113624], eax
mov ax, word [esp + 0x1c]
push 0x10035720
mov word [0x10113628], ax
call fcn.10031ee1
add esp, 4
push 0x10113690
call fcn.10031a72
add esp, 4
mov al, byte [0x10113629]
test al, al
je 0x100310f1
xor byte [0x10113624], 0x4c
xor byte [0x10113625], 0x4c
xor byte [0x10113626], 0x4c
xor byte [0x10113627], 0x4c
xor byte [0x10113628], 0x4c
xor al, 0x4c
mov byte [0x10113629], al
push 6
push 0x10113624
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x10031174
call fcn.10031190
mov ecx, eax
call fcn.10030820
push eax
call fcn.1002cfa0
add esp, 4
push str.RtlAdjustPrivilege
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtRaiseHardError
push str.ntdll.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
lea eax, [esp + 0x17]
push eax
push 0
push 1
push 0x13
call edi
lea eax, [esp + 0x18]
push eax
push 6
push 0
push 0
push 0
push 0xc00002b4
call esi
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
xor ecx, esp
call fcn.10031912
mov esp, ebp
pop ebp
ret