Function at 0x10075880
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009f8e0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100c7210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xa4
call fcn.1001bd40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xa8
call fcn.1001bd40
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xb4
call fcn.10003cb0
mov byte [ebp - 4], 2
push 0x100abb28
lea ecx, [ebp - 0x10]
call fcn.10010730
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xb8
call fcn.10075660
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.1000b440
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xd8], 0
mov dword [ecx + 0xdc], 0
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xa
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x64
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 8], 0x400
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xc], 9
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 8
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0x32
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x48], 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4c], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x20], 0x300000
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], connect
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0x6400000
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0x1f400000
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x30], 0x6400000
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x34], 0x6400000
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x38], 0x6400000
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0x6400000
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x40], 0x1e00000
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x44], 0x5460
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x50], 0x13c680
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x54], 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x58], 1
push str.Win32.trojan.Suspicious
mov ecx, dword [ebp - 0x14]
add ecx, 0xa4
call fcn.10010450
push 0x100abd40
mov ecx, dword [ebp - 0x14]
add ecx, 0xa8
call fcn.10010450
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x5c], 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x60], 0xa0b09000
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x64], 0x70000000
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x68], 0x60000000
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x6c], 0x40000000
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x70], 0xc00000
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x74], 9
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x78], 7
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x7c], 6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x80], 8
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x84], 5
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x94], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x9c], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x88], 1
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x8c], connect
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x90], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xac], 0x2710
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xb0], 0x2710
mov ecx, dword [ebp - 0x14]
add ecx, 0xb8
call fcn.100754d0
mov edx, dword [ebp - 0x14]
add edx, 0xb8
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0xb4
call fcn.10030800
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret