Function at 0x140012890
Capabilities:
Check for kernel debugger via shared user data structure
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x1e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x158], 0xfffffffffffffffe
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx ecx, byte [rax + 2]
cmp ecx, 1
jne 0x140012968
mov dword [rbp + 0xa4], 0x10f6
lea rax, [rbp + 0x198]
mov qword [rbp + 0x98], rax
mov dword [rbp + 0x94], 0
cmp dword [rbp + 0x94], 0xc
jge 0x140012942
mov rax, qword [rbp + 0x98]
mov qword [rax], 0
mov rax, qword [rbp + 0x98]
add rax, 8
mov qword [rbp + 0x98], rax
mov ecx, dword [rbp + 0x94]
add ecx, 1
mov dword [rbp + 0x94], ecx
jmp 0x1400128ff
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
mov eax, 0x7ffe02d4
mov cl, byte [rax]
mov byte [rbp + 0xab], cl
movzx edx, byte [rbp + 0xab]
and edx, 1
cmp edx, 0
mov cl, 1
mov byte [rbp + 0xb], cl
jne 0x1400129a0
movzx eax, byte [rbp + 0xab]
and eax, 2
cmp eax, 0
setne cl
mov byte [rbp + 0xb], cl
mov al, byte [rbp + 0xb]
test al, 1
jne 0x1400129b0
jmp 0x140012a3b
mov dword [rbp + 0xbc], 0x10f7
lea rax, [rbp + 0x198]
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0xac], 0
cmp dword [rbp + 0xac], 0xc
jge 0x140012a15
mov rax, qword [rbp + 0xb0]
mov qword [rax], 0
mov rax, qword [rbp + 0xb0]
add rax, 8
mov qword [rbp + 0xb0], rax
mov ecx, dword [rbp + 0xac]
add ecx, 1
mov dword [rbp + 0xac], ecx
jmp 0x1400129d2
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
mov byte [rbp + 0x11f], 0xc3
lea rax, [rbp + 0x11f]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x120]
mov qword [rbp + 0x128], rax
mov byte [rbp + 0x102], 0
mov word [rbp + 0x100], 0
mov qword [rbp + 0xf8], 0
mov byte [rbp + 0xf8], 0x94
mov byte [rbp + 0xf9], 0x6a
mov byte [rbp + 0xfa], 0x4f
mov byte [rbp + 0xfb], 0xa3
mov byte [rbp + 0xfc], 0xf6
mov byte [rbp + 0xfd], 0xab
mov byte [rbp + 0xfe], 0x83
mov byte [rbp + 0xff], 0xbf
mov byte [rbp + 0x100], 0x96
sub rsp, 0x20
lea rax, [rbp + 0xf8]
mov ecx, 9
mov qword [rbp], rcx
mov rcx, rax
mov rdx, qword [rbp]
mov qword [rbp - 8], rax
call fcn.1400037a0
add rsp, 0x20
mov byte [rbp + 0xf6], 0
mov word [rbp + 0xf4], 0
mov dword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
mov byte [rbp + 0xe8], 0xbe
mov byte [rbp + 0xe9], 0x7c
mov byte [rbp + 0xea], 0x4c
mov byte [rbp + 0xeb], 0x8d
mov byte [rbp + 0xec], 0xe8
mov byte [rbp + 0xed], 0xe0
mov byte [rbp + 0xee], 0x86
mov byte [rbp + 0xef], 0xb8
mov byte [rbp + 0xf0], 0xaa
mov byte [rbp + 0xf1], WSAStartup
mov byte [rbp + 0xf2], 0x42
mov byte [rbp + 0xf3], 0xa1
mov byte [rbp + 0xf4], 0xee
sub rsp, 0x20
lea rax, [rbp + 0xe8]
mov edx, recv
mov rcx, rax
mov qword [rbp - 0x10], rax
call fcn.1400037a0
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
call fcn.140013240
lea rdx, [rbp + 0x120]
mov rcx, rax
call fcn.1400127d0
add rsp, 0x20
mov byte [rbp + 0x106], 0xcd
mov byte [rbp + 0x107], 0x29
lea rcx, [rbp + 0x106]
mov qword [rbp + 0x108], rcx
lea rcx, [rbp + 0x108]
mov qword [rbp + 0x110], rcx
mov byte [rbp + 0xe2], 0
mov word [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov byte [rbp + 0xd8], 0x94
mov byte [rbp + 0xd9], 0x6a
mov byte [rbp + 0xda], 0x4f
mov byte [rbp + 0xdb], 0xa3
mov byte [rbp + 0xdc], 0xf6
mov byte [rbp + 0xdd], 0xab
mov byte [rbp + 0xde], 0x83
mov byte [rbp + 0xdf], 0xbf
mov byte [rbp + 0xe0], 0x96
sub rsp, 0x20
lea rcx, [rbp + 0xd8]
mov qword [rbp - 0x18], rcx
mov rdx, qword [rbp]
mov byte [rbp - 0x19], al
call fcn.1400037a0
add rsp, 0x20
xorps xmm0, xmm0
movaps xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd0], 0
mov byte [rbp + 0xc0], 0xbe
mov byte [rbp + 0xc1], 0x7c
mov byte [rbp + 0xc2], 0x4c
mov byte [rbp + 0xc3], 0x9a
mov byte [rbp + 0xc4], 0xf3
mov byte [rbp + 0xc5], 0xd7
mov byte [rbp + 0xc6], 0x82
mov byte [rbp + 0xc7], 0xbe
mov byte [rbp + 0xc8], 0x95
mov byte [rbp + 0xc9], 0x6a
mov byte [rbp + 0xca], 0x4e
mov byte [rbp + 0xcb], 0x8d
mov byte [rbp + 0xcc], 0xe8
mov byte [rbp + 0xcd], 0xe0
mov byte [rbp + 0xce], 0x86
mov byte [rbp + 0xcf], 0xb8
mov byte [rbp + 0xd0], 0x93
mov byte [rbp + 0xd1], WSAStartup
sub rsp, 0x20
lea rcx, [rbp + 0xc0]
mov edx, send
mov qword [rbp - 0x28], rcx
call fcn.1400037a0
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x28]
call fcn.140013240
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.1400127d0
add rsp, 0x20
lea rcx, [0x140000000]
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0x78], rcx
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x78]
movsxd rdx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x80]
mov edx, reloc.WS2_32.dll_recv
mov byte [rbp - 0x29], al
mov rax, rdx
mov qword [rbp - 0x38], rcx
call fcn.140042290
sub rsp, rax
mov rax, rsp
mov byte [rax + 6], 0
mov word [rax + 4], 0
mov dword [rax], 0
mov byte [rax], 0xd4
mov byte [rax + 1], 0x6a
mov byte [rax + 2], 0x4e
mov byte [rax + 3], 0xb7
mov byte [rax + 4], 0xee
sub rsp, 0x20
mov rcx, rax
mov edx, 5
mov qword [rbp - 0x40], rax
call fcn.1400037a0
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
lea r8, [rbp + 0x48]
call fcn.140013050
add rsp, 0x20
test al, 1
jne 0x140012e3a
mov dword [rbp + 0x140], 0xe0f6
lea rax, [rbp + 0x198]
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x134], 0
cmp dword [rbp + 0x134], 0xc
jge 0x140012e14
mov rax, qword [rbp + 0x138]
mov qword [rax], 0
mov rax, qword [rbp + 0x138]
add rax, 8
mov qword [rbp + 0x138], rax
mov ecx, dword [rbp + 0x134]
add ecx, 1
mov dword [rbp + 0x134], ecx
jmp 0x140012dd1
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
mov rax, qword [rbp + 0x80]
mov ecx, dword [rbp + 0x54]
mov edx, ecx
add rax, rdx
mov qword [rbp + 0x40], rax
mov ecx, dword [rbp + 0x50]
mov dword [rbp + 0x3c], ecx
mov rax, qword [rbp + 0x40]
mov ecx, dword [rbp + 0x3c]
mov edx, ecx
add rax, rdx
mov qword [rbp + 0x30], rax
sub rsp, 0x20
lea rax, [rbp + 0x10]
mov rcx, rax
mov qword [rbp - 0x48], rax
call fcn.140001090
add rsp, 0x20
mov r8d, dword [rbp + 0x3c]
mov edx, r8d
sub rsp, 0x20
lea rcx, [rbp + 0x18]
mov qword [rbp - 0x50], rcx
mov r8, qword [rbp - 0x48]
mov qword [rbp - 0x58], rax
call fcn.14000ca10
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x60], rax
call fcn.14000c9c0
add rsp, 0x20
mov rdx, qword [rbp + 0x40]
mov r9d, dword [rbp + 0x3c]
mov r8d, r9d
sub rsp, 0x20
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x68], rax
call fcn.14000c9e0
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x70], rax
call fcn.14000c9c0
add rsp, 0x20
sub rsp, 0x20
xor r8d, r8d
mov rcx, rax
mov rdx, qword [rbp - 0x70]
call fcn.140013140
add rsp, 0x20
mov dword [rbp - 0x74], eax
jmp 0x140012f00
mov eax, dword [rbp - 0x74]
mov dword [rbp + 0xc], eax
test byte [0x14004d508], 1
jne 0x140012f46
mov rax, qword [rbp + 0x70]
add rax, 0x58
sub rsp, 0x20
lea rdx, [rbp + 0xc]
mov r8d, 4
mov rcx, rax
call fcn.140012740
add rsp, 0x20
jmp 0x140012f3a
mov byte [0x14004d508], 1
jmp 0x140012fe6
mov eax, dword [rbp + 0xc]
mov rcx, qword [rbp + 0x70]
cmp eax, dword [rcx + 0x58]
je 0x140012fe1
mov dword [rbp + 0x154], 0xd0f6
lea rax, [rbp + 0x198]
mov qword [rbp + 0x148], rax
mov dword [rbp + 0x144], 0
cmp dword [rbp + 0x144], 0xc
jge 0x140012fbb
mov rax, qword [rbp + 0x148]
mov qword [rax], 0
mov rax, qword [rbp + 0x148]
add rax, 8
mov qword [rbp + 0x148], rax
mov ecx, dword [rbp + 0x144]
add ecx, 1
mov dword [rbp + 0x144], ecx
jmp 0x140012f78
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
jmp 0x140012fe6
sub rsp, 0x20
lea rcx, [rbp + 0x18]
call fcn.140001130
nop
lea rsp, [rbp + 0x160]
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret