Function at 0x12a83a4
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Encode data using xor
Get number of processors
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword fs:[0x30]
mov dword [0x12ac2a4], 0x12ac2a4
mov dword [0x12ac2b0], 0x12a7b64
mov dword [0x12ac2b4], 0x12a9864
mov dword [0x12ac2b8], 0x12a9744
mov dword [0x12ac2bc], 0x12a79f4
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
push 0
push 0xbbe11f17
mov esi, dword [eax + 0x18]
call fcn.012a75f4
push 0
push 0x60cf99af
mov dword [0x12ac990], eax
call fcn.012a75f4
mov edi, dword [ebp + 8]
mov ebx, eax
push 0
push 0x4dd0a472
test edi, edi
mov dword [0x12ac998], ebx
push ebx
cmove edi, esi
mov esi, dword [0x12ac990]
push 0x12ac988
call fcn.012a76c4
push 0
push 0xdae698d3
push ebx
push 0x12ac98c
call fcn.012a76c4
push 1
push 0xdd71a6cc
push ebx
push 0x12ac944
call fcn.012a76c4
push 1
push 0x934f10fa
push ebx
push 0x12ac948
call fcn.012a76c4
push 1
push 0xe497b485
push ebx
push 0x12ac94c
call fcn.012a76c4
push 0x12a9774
push 1
mov dword [0x12ac2c0], 1
call dword [0x12ac948]
push 1
push 0x9b30cc3f
push esi
push 0x12ac8f0
mov dword [0x12ac9a0], eax
call fcn.012a76c4
push 1
push 0xd2e93957
push esi
push 0x12ac8f4
call fcn.012a76c4
push 1
push 0x3c1f3d90
push esi
push 0x12ac8f8
call fcn.012a76c4
push 1
push 0xf75ce257
push esi
push 0x12ac8fc
call fcn.012a76c4
push 1
push 0xeb426147
push esi
push 0x12ac900
call fcn.012a76c4
push 1
push 0x72f8b38e
push esi
push 0x12ac904
call fcn.012a76c4
push 1
push 0xb78bdb16
push esi
push 0x12ac908
call fcn.012a76c4
push 1
push 0xd32e9d61
push esi
push 0x12ac90c
call fcn.012a76c4
push 1
push 0x4748527b
push esi
push 0x12ac910
call fcn.012a76c4
push 1
push 0x5b8dd581
push esi
push 0x12ac914
call fcn.012a76c4
push 1
push 0x5dc29570
push esi
push 0x12ac918
call fcn.012a76c4
push 1
push 0x4e62601b
push esi
push 0x12ac8e8
call fcn.012a76c4
push 1
push 0x27154a05
push esi
push 0x12ac8ec
call fcn.012a76c4
push 1
push 0x5e4bf6f0
push ebx
push 0x12ac938
call fcn.012a76c4
push 1
push 0x5e4bf706
push ebx
push 0x12ac93c
call fcn.012a76c4
push 1
push 0x1552ae9b
push ebx
push 0x12ac940
call fcn.012a76c4
push 1
push 0x376af5b2
push ebx
push fcn.012ac91c
call fcn.012a76c4
push 1
push 0x1552aeb1
push ebx
push 0x12ac920
call fcn.012a76c4
push 1
push 0xd447896e
push ebx
push fcn.012ac924
call fcn.012a76c4
push 1
push 0xbed1215b
push ebx
push fcn.012ac928
call fcn.012a76c4
push 1
push 0xd8f81d2f
push ebx
push 0x12ac92c
call fcn.012a76c4
push 1
push 0x4db82756
push ebx
push 0x12ac930
call fcn.012a76c4
push 1
push 0x942467dc
push ebx
push 0x12ac934
call fcn.012a76c4
push 1
push 0xe4b23a39
push ebx
push 0x12ac950
call fcn.012a76c4
push 1
push 0x4df7d46e
push ebx
push fcn.012ac954
call fcn.012a76c4
push 1
push 0x15ec9667
push ebx
push fcn.012ac958
call fcn.012a76c4
push 1
push 0x8b05fb05
push ebx
push 0x12ac960
call fcn.012a76c4
push 1
push 0xdf09dc26
push ebx
push 0x12ac95c
call fcn.012a76c4
push 1
push 0x228333bc
push ebx
push 0x12ac970
call fcn.012a76c4
push 1
push 0x4abb6b25
push ebx
push 0x12ac974
call fcn.012a76c4
push 1
push 0xac3a78a9
push ebx
push 0x12ac978
call fcn.012a76c4
push 1
push 0x2066074a
push ebx
push 0x12ac97c
call fcn.012a76c4
push 1
push 0x2b19b2ad
push ebx
push 0x12ac980
call fcn.012a76c4
push 1
push 0x6bfaf860
push ebx
push fcn.012ac984
call fcn.012a76c4
push 1
push 0x1291cb13
push ebx
push 0x12ac9c4
call fcn.012a76c4
push 1
push 0xab10ad07
push ebx
push 0x12ac9d8
call fcn.012a76c4
push 1
push 0x6010250c
push ebx
push 0x12ac9cc
call fcn.012a76c4
push 1
push 0xb31ab204
push ebx
push 0x12ac9d0
call fcn.012a76c4
push 1
push 0x57ef06f8
push ebx
push 0x12ac9d4
call fcn.012a76c4
push 1
push 0x21a37b6c
push ebx
push 0x12ac9e0
call fcn.012a76c4
push 1
push 0xb25b6481
push ebx
push 0x12ac9e4
call fcn.012a76c4
push 1
push 0xae980712
push ebx
push fcn.012ac9f0
call fcn.012a76c4
mov eax, dword [0x12ac9d8]
mov dword [0x12ac29c], eax
mov dword [ebp - 0x24], 0x33
mov eax, dword [ebp - 0x24]
xor eax, 0x75
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x24]
inc al
xor eax, 0x73
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x24]
add al, 2
xor eax, 0x65
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x24]
add al, 3
xor eax, 0x72
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
add al, 4
xor eax, 0x33
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x24]
add al, 5
xor eax, 0x32
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x24]
add al, 6
xor eax, 0x2e
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x24]
add al, 7
xor eax, 0x64
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x24]
add al, 8
xor eax, 0x6c
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x24]
add al, 9
mov byte [ebp - 0x16], 0
xor eax, 0x6c
xor edx, edx
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x20]
mov al, byte [ebp + edx - 0x20]
mov ecx, dword [ebp - 0x24]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x20], cl
inc edx
cmp edx, 0xa
jb 0x12a8814
lea eax, [ebp - 0x20]
mov byte [ebp - 0x16], 0
push eax
call dword [0x12ac938]
push 1
mov esi, eax
push 0xbc022598
push esi
push 0x12ac964
mov dword [0x12ac99c], esi
call fcn.012a76c4
push 1
push 0xcd6a1508
push esi
push 0x12ac96c
call fcn.012a76c4
push 1
push 0x81225c79
push esi
push 0x12ac968
call fcn.012a76c4
push 1
push 0xcd6a151e
push esi
push 0x12ac9f8
call fcn.012a76c4
push 1
push 0x81225c8f
push esi
push 0x12ac9f4
call fcn.012a76c4
push 1
push 0x1f2ae094
push esi
push fcn.012ac9e8
call fcn.012a76c4
push 1
push 0xff9a9fe
push esi
push fcn.012ac9ec
call fcn.012a76c4
push edi
call fcn.012a9204
mov byte [ebp - 0x12], 0x4a
add esp, 4
mov byte [ebp - 0x11], 0x73
xor ecx, ecx
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x7a
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x4f
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0
mov al, byte [ebp - 0x12]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x12]
movsx eax, al
sub eax, 7
mov byte [ebp + ecx - 0x12], al
inc ecx
cmp ecx, 0xb
jb 0x12a8904
mov byte [ebp - 6], 0x71
xor ecx, ecx
mov byte [ebp - 5], 0x6e
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], 0x75
mov byte [ebp - 2], 0x78
mov byte [ebp - 1], 0
mov al, byte [ebp - 6]
mov al, byte [ebp + ecx - 6]
movsx eax, al
sub eax, 9
mov byte [ebp + ecx - 6], al
inc ecx
cmp ecx, 5
jb 0x12a8935
mov dword [ebp - 0x5c], 0x1d
mov eax, dword [ebp - 0x5c]
xor eax, 0x62
mov byte [ebp - 0x58], al
mov eax, dword [ebp - 0x5c]
inc al
xor eax, 0x69
mov byte [ebp - 0x57], al
mov eax, dword [ebp - 0x5c]
add al, 2
xor eax, 0x6e
mov byte [ebp - 0x56], al
mov eax, dword [ebp - 0x5c]
add al, 3
xor eax, 0x64
mov byte [ebp - 0x55], al
mov eax, dword [ebp - 0x5c]
add al, 4
xor eax, 0x20
mov byte [ebp - 0x54], al
mov eax, dword [ebp - 0x5c]
add al, 5
xor eax, 0x63
mov byte [ebp - 0x53], al
mov eax, dword [ebp - 0x5c]
add al, 6
xor eax, 0x6f
mov byte [ebp - 0x52], al
mov eax, dword [ebp - 0x5c]
add al, 7
xor eax, 0x6d
mov byte [ebp - 0x51], al
mov eax, dword [ebp - 0x5c]
add al, 8
xor eax, 0x70
mov byte [ebp - 0x50], al
mov eax, dword [ebp - 0x5c]
add al, 9
xor eax, 0x6c
mov byte [ebp - 0x4f], al
mov eax, dword [ebp - 0x5c]
add al, 0xa
xor eax, 0x65
mov byte [ebp - 0x4e], al
mov eax, dword [ebp - 0x5c]
add al, 0xb
xor eax, 0x74
mov byte [ebp - 0x4d], al
mov eax, dword [ebp - 0x5c]
add al, 0xc
xor eax, 0x65
mov byte [ebp - 0x4c], al
mov eax, dword [ebp - 0x5c]
add al, 0xd
xor eax, 0x20
mov byte [ebp - 0x4b], al
mov eax, dword [ebp - 0x5c]
add al, 0xe
xor eax, 0x25
mov byte [ebp - 0x4a], al
mov eax, dword [ebp - 0x5c]
add al, 0xf
xor eax, 0x70
mov byte [ebp - 0x49], al
mov eax, dword [ebp - 0x5c]
add al, 0x10
xor eax, 0x2c
mov byte [ebp - 0x48], al
mov eax, dword [ebp - 0x5c]
add al, 0x11
xor eax, 0x20
mov byte [ebp - 0x47], al
mov eax, dword [ebp - 0x5c]
add al, 0x12
xor eax, 0x25
mov byte [ebp - 0x46], al
mov eax, dword [ebp - 0x5c]
add al, 0x13
xor eax, 0x73
mov byte [ebp - 0x45], al
mov eax, dword [ebp - 0x5c]
add al, 0x14
xor eax, 0x20
mov byte [ebp - 0x44], al
mov eax, dword [ebp - 0x5c]
add al, 0x15
xor eax, 0x25
mov byte [ebp - 0x43], al
mov eax, dword [ebp - 0x5c]
add al, 0x16
xor eax, 0x70
mov byte [ebp - 0x42], al
mov eax, dword [ebp - 0x5c]
add al, 0x17
mov byte [ebp - 0x40], 0
xor eax, 0xa
xor edx, edx
mov byte [ebp - 0x41], al
mov al, byte [ebp - 0x58]
nop dword [eax + eax]
mov al, byte [ebp + edx - 0x58]
mov ecx, dword [ebp - 0x5c]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x58], cl
inc edx
cmp edx, 0x18
jb 0x12a8a64
lea eax, [ebp - 0x12]
mov byte [ebp - 0x40], 0
push eax
push ebx
call dword [0x12ac944]
push eax
lea eax, [ebp - 6]
push eax
push 0x12ac2a4
lea eax, [ebp - 0x58]
push eax
push 0x12ac2a4
call fcn.012a8d24
mov ecx, dword [0x12ac2c4]
add esp, 0x14
xor ebx, ebx
cmp ecx, 0x1ff
jae 0x12a8aca
inc ecx
mov dword [0x12ac2c4], ecx
mov byte [ecx + 0x12ac2c8], 0x13
mov ecx, dword [0x12ac2c4]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x12a8b3b
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x12a8b3b
mov eax, 0x10b
cmp word [esi + 0x18], ax
jne 0x12a8b3b
movzx eax, word [esi + 0x14]
xor edx, edx
movzx ebx, word [esi + 6]
add eax, 0x18
add eax, esi
test ebx, ebx
je 0x12a8b22
nop dword [eax + eax]
cmp dword [eax + 8], 0x1e004
jbe 0x12a8b1a
mov esi, dword [eax + 0xc]
add esi, edi
cmp dword [esi], 0x20170408
je 0x12a8b37
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x12a8b04
xor esi, esi
xor ebx, ebx
dec ecx
mov dword [0x12ac2c4], ecx
test esi, esi
jne 0x12a8bdb
jmp 0x12a8b44
mov ebx, eax
jmp 0x12a8b26
xor esi, esi
dec ecx
mov dword [0x12ac2c4], ecx
mov byte [ebp - 0x3c], 0x64
xor ecx, ecx
mov byte [ebp - 0x3b], 0x62
mov byte [ebp - 0x3a], 0x6f
mov byte [ebp - 0x39], 0x28
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x21
mov byte [ebp - 0x36], 0x67
mov byte [ebp - 0x35], 0x6a
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x21
mov byte [ebp - 0x31], 0x73
mov byte [ebp - 0x30], 0x68
mov byte [ebp - 0x2f], 0x71
mov byte [ebp - 0x2e], 0x21
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x66
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x75
mov byte [ebp - 0x29], 0x6a
mov byte [ebp - 0x28], 0x70
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0xb
mov byte [ebp - 0x25], 0
mov al, byte [ebp - 0x3c]
mov al, byte [ebp + ecx - 0x3c]
movsx eax, al
dec eax
mov byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x17
jb 0x12a8ba9
lea eax, [ebp - 0x3c]
push eax
push 0x12ac2a4
call fcn.012a8d24
add esp, 8
push 0xe0410008
push 0x12ac2a4
call fcn.012a9864
cmp dword [esi + 8], 0x1e004
je 0x12a8ca3
mov dword [ebp - 0x80], 0x46
xor edx, edx
mov byte [ebp - 0x7c], 0x34
mov byte [ebp - 0x7b], 0x21
mov byte [ebp - 0x7a], 0x36
mov byte [ebp - 0x79], 0x66
mov byte [ebp - 0x78], 0x35
mov byte [ebp - 0x77], 0x23
mov byte [ebp - 0x76], 0x25
mov byte [ebp - 0x75], 0x32
mov byte [ebp - 0x74], 0x2f
mov byte [ebp - 0x73], 0x29
mov byte [ebp - 0x72], 0x28
mov byte [ebp - 0x71], 0x66
mov byte [ebp - 0x70], 0x35
mov byte [ebp - 0x6f], 0x2f
mov byte [ebp - 0x6e], 0x3c
mov byte [ebp - 0x6d], 0x23
mov byte [ebp - 0x6c], 0x66
mov byte [ebp - 0x6b], 0x2f
mov byte [ebp - 0x6a], 0x35
mov byte [ebp - 0x69], 0x66
mov byte [ebp - 0x68], 0x2f
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x30
mov byte [ebp - 0x65], 0x27
mov byte [ebp - 0x64], 0x2a
mov byte [ebp - 0x63], 0x2f
mov byte [ebp - 0x62], 0x22
mov byte [ebp - 0x61], 0x4c
mov al, byte [ebp - 0x7c]
mov byte [ebp - 0x60], 0
mov al, byte [ebp + edx - 0x7c]
movsx ecx, byte [ebp - 0x80]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x7c], al
inc edx
cmp edx, 0x1c
jb 0x12a8c68
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x60], 0
push eax
push 0x12ac2a4
call fcn.012a8d24
add esp, 8
push 0xe0410009
push 0x12ac2a4
call fcn.012a9864
xor ecx, ecx
mov eax, 0x12caa10
cmp eax, 0x12aca0c
sbb edx, edx
and edx, 0xfffe1ffc
add edx, 0x1e004
je 0x12a8cd2
nop dword [eax + eax]
mov al, byte [esi + ecx]
mov byte [ecx + 0x12aca0c], al
inc ecx
cmp ecx, edx
jb 0x12a8cc4
mov dword [0x12aca08], esi
mov dword [0x12ac9a4], edi
mov dword [0x12ac9ac], 0x12a80b4
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x50]
add eax, edi
mov dword [0x12ac9b0], ebx
mov dword [0x12ac9a8], eax
mov eax, dword [0x12aca68]
and eax, 0x8000
neg eax
pop edi
sbb eax, eax
and eax, 0x12a9f54
pop esi
mov dword [0x12ac9dc], eax
pop ebx
mov esp, ebp
pop ebp
ret 4