Function at 0x3c1a9f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [0x3c1eaf8], 0x3c1eaf8
mov dword [0x3c1eb08], 0x3c1a4d0
mov dword [0x3c1eb0c], 0x3c1b950
mov dword [0x3c1eb10], 0x3c1a360
mov dword [0x3c1f278], 0
mov dword [0x3c1f27c], 0
mov dword [0x3c1f26c], 0
mov dword [0x3c1f270], 0
mov dword [0x3c1f274], 0
mov dword [0x3c1f280], 0x3c1c100
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
push 0
push 0xbbe11f17
mov esi, dword [eax + 0x18]
call fcn.03c19f60
push 0
push 0x60cf99af
mov dword [0x3c1f1f0], eax
call fcn.03c19f60
mov ebx, dword [ebp + 8]
mov edi, eax
push 0
push 0x4dd0a472
test ebx, ebx
mov dword [0x3c1f1f8], edi
push edi
cmove ebx, esi
mov esi, dword [0x3c1f1f0]
push 0x3c1f1e4
call fcn.03c1a030
push 0
push 0xdae698d3
push edi
push 0x3c1f1e8
call fcn.03c1a030
push 1
push 0xdd71a6cc
push edi
push 0x3c1f1a0
call fcn.03c1a030
push 1
push 0x934f10fa
push edi
push 0x3c1f1a4
call fcn.03c1a030
push 1
push 0xe497b485
push edi
push 0x3c1f1a8
call fcn.03c1a030
push 1
push 0x21a37b6c
push edi
push 0x3c1f240
call fcn.03c1a030
call dword [0x3c1f240]
push 0x3c1c100
push 1
mov dword [0x3c1eb14], eax
mov dword [0x3c1eb18], 1
mov dword [0x3c1eb04], 0
call dword [0x3c1f1a4]
push 1
push 0x9b30cc3f
push esi
push 0x3c1f14c
mov dword [0x3c1f200], eax
call fcn.03c1a030
push 1
push 0xd2e93957
push esi
push 0x3c1f150
call fcn.03c1a030
push 1
push 0x3c1f3d90
push esi
push 0x3c1f154
call fcn.03c1a030
push 1
push 0xf75ce257
push esi
push 0x3c1f158
call fcn.03c1a030
push 1
push 0xeb426147
push esi
push 0x3c1f15c
call fcn.03c1a030
push 1
push 0x72f8b38e
push esi
push 0x3c1f160
call fcn.03c1a030
push 1
push 0xb78bdb16
push esi
push 0x3c1f164
call fcn.03c1a030
push 1
push 0xd32e9d61
push esi
push 0x3c1f168
call fcn.03c1a030
push 1
push 0x4748527b
push esi
push 0x3c1f16c
call fcn.03c1a030
push 1
push 0x5b8dd581
push esi
push 0x3c1f170
call fcn.03c1a030
push 1
push 0x5dc29570
push esi
push 0x3c1f174
call fcn.03c1a030
push 1
push 0x4e62601b
push esi
push 0x3c1f144
call fcn.03c1a030
push 1
push 0x27154a05
push esi
push 0x3c1f148
call fcn.03c1a030
push 1
push 0x5e4bf6f0
push edi
push 0x3c1f194
call fcn.03c1a030
push 1
push 0x5e4bf706
push edi
push 0x3c1f198
call fcn.03c1a030
push 1
push 0x1552ae9b
push edi
push 0x3c1f19c
call fcn.03c1a030
push 1
push 0x376af5b2
push edi
push fcn.03c1f178
call fcn.03c1a030
push 1
push 0x1552aeb1
push edi
push 0x3c1f17c
call fcn.03c1a030
push 1
push 0xd447896e
push edi
push 0x3c1f180
call fcn.03c1a030
push 1
push 0xbed1215b
push edi
push fcn.03c1f184
call fcn.03c1a030
push 1
push 0xd8f81d2f
push edi
push 0x3c1f188
call fcn.03c1a030
push 1
push 0x4db82756
push edi
push 0x3c1f18c
call fcn.03c1a030
push 1
push 0x942467dc
push edi
push 0x3c1f190
call fcn.03c1a030
push 1
push 0xe4b23a39
push edi
push 0x3c1f1ac
call fcn.03c1a030
push 1
push 0x4df7d46e
push edi
push fcn.03c1f1b0
call fcn.03c1a030
push 1
push 0x15ec9667
push edi
push fcn.03c1f1b4
call fcn.03c1a030
push 1
push 0x8b05fb05
push edi
push 0x3c1f1bc
call fcn.03c1a030
push 1
push 0xdf09dc26
push edi
push 0x3c1f1b8
call fcn.03c1a030
push 1
push 0x228333bc
push edi
push 0x3c1f1cc
call fcn.03c1a030
push 1
push 0x4abb6b25
push edi
push 0x3c1f1d0
call fcn.03c1a030
push 1
push 0xac3a78a9
push edi
push 0x3c1f1d4
call fcn.03c1a030
push 1
push 0x2066074a
push edi
push 0x3c1f1d8
call fcn.03c1a030
push 1
push 0x2b19b2ad
push edi
push 0x3c1f1dc
call fcn.03c1a030
push 1
push 0x6bfaf860
push edi
push 0x3c1f1e0
call fcn.03c1a030
push 1
push 0x1291cb13
push edi
push 0x3c1f220
call fcn.03c1a030
push 1
push 0xab10ad07
push edi
push 0x3c1f1ec
call fcn.03c1a030
push 1
push 0xab10ad07
push edi
push 0x3c1f238
call fcn.03c1a030
push 1
push 0x4b07dd7e
push edi
push 0x3c1f228
call fcn.03c1a030
push 1
push 0x96b79b23
push edi
push 0x3c1f234
call fcn.03c1a030
push 1
push 0x4f75ef12
push edi
push 0x3c1f22c
call fcn.03c1a030
push 1
push 0xf44a4406
push edi
push 0x3c1f230
call fcn.03c1a030
push 1
push 0xb25b6481
push edi
push 0x3c1f244
call fcn.03c1a030
push 1
push 0xae980712
push edi
push fcn.03c1f250
call fcn.03c1a030
push 1
push 0xf4a11ee3
push edi
push 0x3c1f254
call fcn.03c1a030
push 1
push 0x830c3f86
push edi
push 0x3c1f25c
call fcn.03c1a030
push 1
push 0x885e90c
push edi
push 0x3c1f258
call fcn.03c1a030
push 1
push 0xb3ea952b
push edi
push 0x3c1f260
call fcn.03c1a030
mov eax, dword [0x3c1f238]
mov dword [0x3c1eaf4], eax
mov dword [ebp - 0x10], 0x29
mov eax, dword [ebp - 0x10]
xor eax, 0x75
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x10]
inc al
xor eax, 0x73
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x10]
add al, 2
xor eax, 0x65
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x10]
add al, 3
xor eax, 0x72
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
add al, 4
xor eax, 0x33
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x10]
add al, 5
xor eax, 0x32
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x10]
add al, 6
xor eax, 0x2e
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x10]
add al, 7
xor eax, 0x64
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
add al, 8
xor eax, 0x6c
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x10]
add al, 9
mov byte [ebp - 2], 0
xor eax, 0x6c
xor edx, edx
mov byte [ebp - 3], al
mov al, byte [ebp - 0xc]
mov al, byte [ebp + edx - 0xc]
mov ecx, dword [ebp - 0x10]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0xc], cl
inc edx
cmp edx, 0xa
jb 0x3c1af10
lea eax, [ebp - 0xc]
mov byte [ebp - 2], 0
push eax
call dword [0x3c1f194]
push 1
mov esi, eax
push 0xbc022598
push esi
push 0x3c1f1c0
mov dword [0x3c1f1fc], esi
call fcn.03c1a030
push 1
push 0xcd6a1508
push esi
push 0x3c1f1c8
call fcn.03c1a030
push 1
push 0x81225c79
push esi
push 0x3c1f1c4
call fcn.03c1a030
push 1
push 0xcd6a151e
push esi
push 0x3c1f268
call fcn.03c1a030
push 1
push 0x81225c8f
push esi
push 0x3c1f264
call fcn.03c1a030
push 1
push 0x1f2ae094
push esi
push fcn.03c1f248
call fcn.03c1a030
push 1
push 0xff9a9fe
push esi
push fcn.03c1f24c
call fcn.03c1a030
push ebx
mov dword [fcn.03c1f284], 0x3c1b330
mov dword [0x3c1f288], 0x3c1b420
mov dword [0x3c1f28c], 0x3c1b4c0
call fcn.03c1b650
mov ecx, dword [0x3c23290]
add esp, 4
cmp ecx, 0xffffffff
je 0x3c1b23d
movzx eax, word [0x3c1f39a]
mov ecx, 0xc0de
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b02d
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0xc0de
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
mov ecx, dword [0x3c23290]
add esp, 8
cmp ecx, 0xffffffff
je 0x3c1b23d
movzx eax, word [0x3c1f39a]
mov ecx, 0xcafe
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b091
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0xcafe
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
mov ecx, dword [0x3c23290]
add esp, 8
cmp ecx, 0xffffffff
je 0x3c1b23d
movzx eax, word [0x3c1f39a]
mov ecx, 0xbaad
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b0f5
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0xbaad
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
mov ecx, dword [0x3c23290]
add esp, 8
cmp ecx, 0xffffffff
je 0x3c1b23d
movzx eax, word [0x3c1f39a]
mov ecx, 0xface
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b159
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0xface
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
mov ecx, dword [0x3c23290]
add esp, 8
cmp ecx, 0xffffffff
je 0x3c1b23d
movzx eax, word [0x3c1f39a]
mov ecx, 0xdead
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b1bd
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0xdead
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
mov ecx, dword [0x3c23290]
add esp, 8
cmp ecx, 0xffffffff
je 0x3c1b23d
movzx eax, word [0x3c1f39a]
mov ecx, 0xbeef
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b21d
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0xbeef
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
mov ecx, dword [0x3c23290]
add esp, 8
mov esi, dword [0x3c1eaf0]
add esi, ebx
cmp dword [esi + 8], 0x1dfb0
je 0x3c1b2b7
cmp ecx, 0xffffffff
je 0x3c1b2a8
movzx eax, word [0x3c1f39a]
mov ecx, 0x427
mov word [eax*2 + 0x3c1f39c], cx
mov ax, word [0x3c1f39a]
inc ax
and ax, 0x7f
movzx ecx, ax
cmp cx, word [0x3c1f398]
jne 0x3c1b28e
mov eax, dword [0x3c1f398]
inc eax
and eax, 0x7f
mov word [0x3c1f398], ax
push 0x427
push 0x3c1eaf8
mov word [0x3c1f39a], cx
call dword [fcn.03c1f284]
add esp, 8
push 0xe0410009
push 0x3c1eaf8
call fcn.03c1c3e0
xor ecx, ecx
mov eax, 0x3c4124c
cmp eax, 0x3c2329c
sbb edx, edx
and edx, 0xfffe2050
add edx, 0x1dfb0
je 0x3c1b2e1
mov al, byte [ecx + esi]
mov byte [ecx + 0x3c2329c], al
inc ecx
cmp ecx, edx
jb 0x3c1b2d3
mov dword [0x3c23298], esi
mov dword [0x3c1f204], ebx
mov dword [0x3c1f20c], 0x3c1a7c0
mov eax, dword [ebx + 0x3c]
pop edi
pop esi
mov eax, dword [eax + ebx + 0x50]
add eax, ebx
mov dword [0x3c1f208], eax
mov eax, dword [0x3c232f8]
and eax, 0x8000
neg eax
pop ebx
sbb eax, eax
and eax, 0x3c1c7a0
mov dword [0x3c1f23c], eax
mov esp, ebp
pop ebp
ret 4