Function at 0x1400129b0
Capabilities:
Check for kernel debugger via shared user data structure
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x1e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x158], 0xfffffffffffffffe
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx ecx, byte [rax + 2]
cmp ecx, 1
jne 0x140012a88
mov dword [rbp + 0xa4], 0x10f6
lea rax, [rbp + 0x198]
mov qword [rbp + 0x98], rax
mov dword [rbp + 0x94], 0
cmp dword [rbp + 0x94], 0xc
jge 0x140012a62
mov rax, qword [rbp + 0x98]
mov qword [rax], 0
mov rax, qword [rbp + 0x98]
add rax, 8
mov qword [rbp + 0x98], rax
mov ecx, dword [rbp + 0x94]
add ecx, 1
mov dword [rbp + 0x94], ecx
jmp 0x140012a1f
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
mov eax, 0x7ffe02d4
mov cl, byte [rax]
mov byte [rbp + 0xab], cl
movzx edx, byte [rbp + 0xab]
and edx, 1
cmp edx, 0
mov cl, 1
mov byte [rbp + 0xb], cl
jne 0x140012ac0
movzx eax, byte [rbp + 0xab]
and eax, 2
cmp eax, 0
setne cl
mov byte [rbp + 0xb], cl
mov al, byte [rbp + 0xb]
test al, 1
jne 0x140012ad0
jmp 0x140012b5b
mov dword [rbp + 0xbc], 0x10f7
lea rax, [rbp + 0x198]
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0xac], 0
cmp dword [rbp + 0xac], 0xc
jge 0x140012b35
mov rax, qword [rbp + 0xb0]
mov qword [rax], 0
mov rax, qword [rbp + 0xb0]
add rax, 8
mov qword [rbp + 0xb0], rax
mov ecx, dword [rbp + 0xac]
add ecx, 1
mov dword [rbp + 0xac], ecx
jmp 0x140012af2
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
mov byte [rbp + 0x11f], 0xc3
lea rax, [rbp + 0x11f]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x120]
mov qword [rbp + 0x128], rax
mov byte [rbp + 0x102], 0
mov word [rbp + 0x100], 0
mov qword [rbp + 0xf8], 0
mov byte [rbp + 0xf8], 0x94
mov byte [rbp + 0xf9], 0x6a
mov byte [rbp + 0xfa], 0x4f
mov byte [rbp + 0xfb], 0xa3
mov byte [rbp + 0xfc], 0xf6
mov byte [rbp + 0xfd], 0xab
mov byte [rbp + 0xfe], 0x83
mov byte [rbp + 0xff], 0xbf
mov byte [rbp + 0x100], 0x96
sub rsp, 0x20
lea rax, [rbp + 0xf8]
mov ecx, 9
mov qword [rbp], rcx
mov rcx, rax
mov rdx, qword [rbp]
mov qword [rbp - 8], rax
call fcn.1400038c0
add rsp, 0x20
mov byte [rbp + 0xf6], 0
mov word [rbp + 0xf4], 0
mov dword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
mov byte [rbp + 0xe8], 0xbe
mov byte [rbp + 0xe9], 0x7c
mov byte [rbp + 0xea], 0x4c
mov byte [rbp + 0xeb], 0x8d
mov byte [rbp + 0xec], 0xe8
mov byte [rbp + 0xed], 0xe0
mov byte [rbp + 0xee], 0x86
mov byte [rbp + 0xef], 0xb8
mov byte [rbp + 0xf0], 0xaa
mov byte [rbp + 0xf1], WSACleanup
mov byte [rbp + 0xf2], 0x42
mov byte [rbp + 0xf3], 0xa1
mov byte [rbp + 0xf4], 0xee
sub rsp, 0x20
lea rax, [rbp + 0xe8]
mov edx, recv
mov rcx, rax
mov qword [rbp - 0x10], rax
call fcn.1400038c0
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
call fcn.140013360
lea rdx, [rbp + 0x120]
mov rcx, rax
call fcn.1400128f0
add rsp, 0x20
mov byte [rbp + 0x106], 0xcd
mov byte [rbp + 0x107], 0x29
lea rcx, [rbp + 0x106]
mov qword [rbp + 0x108], rcx
lea rcx, [rbp + 0x108]
mov qword [rbp + 0x110], rcx
mov byte [rbp + 0xe2], 0
mov word [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov byte [rbp + 0xd8], 0x94
mov byte [rbp + 0xd9], 0x6a
mov byte [rbp + 0xda], 0x4f
mov byte [rbp + 0xdb], 0xa3
mov byte [rbp + 0xdc], 0xf6
mov byte [rbp + 0xdd], 0xab
mov byte [rbp + 0xde], 0x83
mov byte [rbp + 0xdf], 0xbf
mov byte [rbp + 0xe0], 0x96
sub rsp, 0x20
lea rcx, [rbp + 0xd8]
mov qword [rbp - 0x18], rcx
mov rdx, qword [rbp]
mov byte [rbp - 0x19], al
call fcn.1400038c0
add rsp, 0x20
xorps xmm0, xmm0
movaps xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd0], 0
mov byte [rbp + 0xc0], 0xbe
mov byte [rbp + 0xc1], 0x7c
mov byte [rbp + 0xc2], 0x4c
mov byte [rbp + 0xc3], 0x9a
mov byte [rbp + 0xc4], 0xf3
mov byte [rbp + 0xc5], 0xd7
mov byte [rbp + 0xc6], 0x82
mov byte [rbp + 0xc7], 0xbe
mov byte [rbp + 0xc8], 0x95
mov byte [rbp + 0xc9], 0x6a
mov byte [rbp + 0xca], 0x4e
mov byte [rbp + 0xcb], 0x8d
mov byte [rbp + 0xcc], 0xe8
mov byte [rbp + 0xcd], 0xe0
mov byte [rbp + 0xce], 0x86
mov byte [rbp + 0xcf], 0xb8
mov byte [rbp + 0xd0], 0x93
mov byte [rbp + 0xd1], WSACleanup
sub rsp, 0x20
lea rcx, [rbp + 0xc0]
mov edx, send
mov qword [rbp - 0x28], rcx
call fcn.1400038c0
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x28]
call fcn.140013360
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.1400128f0
add rsp, 0x20
lea rcx, [0x140000000]
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0x78], rcx
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x78]
movsxd rdx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x80]
mov edx, reloc.WS2_32.dll_recv
mov byte [rbp - 0x29], al
mov rax, rdx
mov qword [rbp - 0x38], rcx
call fcn.140042470
sub rsp, rax
mov rax, rsp
mov byte [rax + 6], 0
mov word [rax + 4], 0
mov dword [rax], 0
mov byte [rax], 0xd4
mov byte [rax + 1], 0x6a
mov byte [rax + 2], 0x4e
mov byte [rax + 3], 0xb7
mov byte [rax + 4], 0xee
sub rsp, 0x20
mov rcx, rax
mov edx, 5
mov qword [rbp - 0x40], rax
call fcn.1400038c0
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
lea r8, [rbp + 0x48]
call fcn.140013170
add rsp, 0x20
test al, 1
jne 0x140012f5a
mov dword [rbp + 0x140], 0xe0f6
lea rax, [rbp + 0x198]
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x134], 0
cmp dword [rbp + 0x134], 0xc
jge 0x140012f34
mov rax, qword [rbp + 0x138]
mov qword [rax], 0
mov rax, qword [rbp + 0x138]
add rax, 8
mov qword [rbp + 0x138], rax
mov ecx, dword [rbp + 0x134]
add ecx, 1
mov dword [rbp + 0x134], ecx
jmp 0x140012ef1
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
mov rax, qword [rbp + 0x80]
mov ecx, dword [rbp + 0x54]
mov edx, ecx
add rax, rdx
mov qword [rbp + 0x40], rax
mov ecx, dword [rbp + 0x50]
mov dword [rbp + 0x3c], ecx
mov rax, qword [rbp + 0x40]
mov ecx, dword [rbp + 0x3c]
mov edx, ecx
add rax, rdx
mov qword [rbp + 0x30], rax
sub rsp, 0x20
lea rax, [rbp + 0x10]
mov rcx, rax
mov qword [rbp - 0x48], rax
call fcn.1400011b0
add rsp, 0x20
mov r8d, dword [rbp + 0x3c]
mov edx, r8d
sub rsp, 0x20
lea rcx, [rbp + 0x18]
mov qword [rbp - 0x50], rcx
mov r8, qword [rbp - 0x48]
mov qword [rbp - 0x58], rax
call fcn.14000cb30
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x60], rax
call fcn.14000cae0
add rsp, 0x20
mov rdx, qword [rbp + 0x40]
mov r9d, dword [rbp + 0x3c]
mov r8d, r9d
sub rsp, 0x20
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x68], rax
call fcn.14000cb00
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x70], rax
call fcn.14000cae0
add rsp, 0x20
sub rsp, 0x20
xor r8d, r8d
mov rcx, rax
mov rdx, qword [rbp - 0x70]
call fcn.140013260
add rsp, 0x20
mov dword [rbp - 0x74], eax
jmp 0x140013020
mov eax, dword [rbp - 0x74]
mov dword [rbp + 0xc], eax
test byte [0x14004e508], 1
jne 0x140013066
mov rax, qword [rbp + 0x70]
add rax, 0x58
sub rsp, 0x20
lea rdx, [rbp + 0xc]
mov r8d, 4
mov rcx, rax
call fcn.140012860
add rsp, 0x20
jmp 0x14001305a
mov byte [0x14004e508], 1
jmp 0x140013106
mov eax, dword [rbp + 0xc]
mov rcx, qword [rbp + 0x70]
cmp eax, dword [rcx + 0x58]
je 0x140013101
mov dword [rbp + 0x154], 0xd0f6
lea rax, [rbp + 0x198]
mov qword [rbp + 0x148], rax
mov dword [rbp + 0x144], 0
cmp dword [rbp + 0x144], 0xc
jge 0x1400130db
mov rax, qword [rbp + 0x148]
mov qword [rax], 0
mov rax, qword [rbp + 0x148]
add rax, 8
mov qword [rbp + 0x148], rax
mov ecx, dword [rbp + 0x144]
add ecx, 1
mov dword [rbp + 0x144], ecx
jmp 0x140013098
xor rax, rax
mov ebx, eax
mov edi, eax
mov ebp, eax
mov rdx, rax
mov r8, rax
mov r9, rax
mov r10, rax
mov r11, rax
mov r12, rax
mov r13, rax
mov r14, rax
mov r15, rax
jmp rax
jmp 0x140013106
sub rsp, 0x20
lea rcx, [rbp + 0x18]
call fcn.140001250
nop
lea rsp, [rbp + 0x160]
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret