Function at 0x2b0020fb
Capabilities:
Check for peb ntglobalflag flag
Get number of processors
Parse pe header

Disassembly:
xor al, 0x62
push ebx
jo 0x2b002145
pop eax
dec edi
das
je 0x2b002139
jb 0x2b00216e
arpl word [ecx], di
dec ebx
imul esi, dword [ebx + 0x65], 0x5a
insd dword es:[edi], dx
xor eax, 0x546c4a72
arpl word [edi + 0x47], ax
das
je 0x2b002162
xor cl, byte [0x724a520a]
insd dword es:[edi], dx
jo 0x2b00215b
imul eax, dword [eax + ebp*2 + 0x39], 0x5233647a
inc edx
js 0x2b002176
inc edx
inc ecx
inc esi
inc edi
js 0x2b002185
push esi
outsd dx, dword [esi]
das
push eax
jns 0x2b002186
dec ebp
insb byte es:[edi], dx
push edi
aaa
pop edx
jae 0x2b0021a0
pop edx
push 0x68
insb byte es:[edi], dx
dec ebp
dec esp
push esi
jo 0x2b0021b9
cmp byte [ecx + 0x4f], bl
inc esp
jo 0x2b0021ab
outsb dx, byte [esi]
push esp
dec edx
xor ebp, dword [eax + 0x32]
jb 0x2b00218d
xor dword [edx + 0x36], esi
jb 0x2b002194
dec ebx
insb byte es:[edi], dx
xor byte [eax + esi*2 + 0x69], cl
dec esp
jo 0x2b0021ce
push 0x5a704763
inc edx
jns 0x2b00217b
or dh, byte [edx]
dec esi
xor eax, dword [ebx + 0x30]
jno 0x2b0021c1
dec eax
popal
xor dword [esp + esi*2 + 0x76], esp
dec edi
jbe 0x2b0021cc
jno 0x2b0021ef
ja 0x2b0021ea
pop edx
push 0x71624347
inc ebp
bound esi, qword [ecx + 0x45]
jno 0x2b0021cd
jns 0x2b0021ee
dec edi
ja 0x2b0021f1
xor dword [edi + 0x50], ebp
inc ecx
outsb dx, byte [esi]
bound ebp, qword [edi + 0x44]
inc esp
outsd dx, dword [esi]
dec edi
dec eax
push 0x79
push ebp
imul ebx, dword [edx + 0x46], 0x70
inc esi
inc esi
dec ebx
push ebx
xor al, 0x42
inc edx
arpl word [ebx + 0x55], ax
outsb dx, byte gs:[esi]
jo 0x2b002223
xor eax, 0x33313747
popal
je 0x2b002221
inc esi
push 0x73303258
or eax, 0x7277680a
dec edx
xor byte [ebx + 0xd], dh
or ch, byte [eax + 0x77]
jb 0x2b00220b
push ecx
xor dword [edi + 0x78], edx
jae 0x2b00221d
push bp
pop edx
dec edx
push ebx
inc esp
xor byte [eax], dh
imul esi, dword [eax + 0x36], 0x52
push ebp
jb 0x2b002208
pop ecx
push esi
dec edx
inc ebx
inc ebx
push edi
inc ebx
inc esp
inc esp
inc ebp
inc ecx
jae 0x2b002216
dec esi
jp 0x2b002236
dec esp
push ebx
dec esp
ja 0x2b002231
push edx
cmp byte [esi + 0x68], dh
jbe 0x2b002259
arpl word [ebp + 0x6e], dx
xor ecx, dword [eax + 0x32]
push 0x54
inc esi
inc esi
push edx
pop edx
sub ecx, dword [eax + esi + 0x75]
jns 0x2b002266
das
inc edi
xor al, byte [edi + 0x53]
push ebx
or eax, 0x772b6c0a
cmp byte [esi + 0x37], dl
insb byte es:[edi], dx
sub esi, dword [edi + 0x38]
push esi
aaa
inc ebx
dec edx
inc ecx
xor al, 0x41
xor dword [edx + 0x2b], esi
xor cl, byte [edx + 0x47]
insd dword es:[edi], dx
js 0x2b00228a
xor eax, 0x6845474a
inc esp
jae 0x2b00225d
inc edi
inc ebp
push 0x67367344
das
das
push ecx
ja 0x2b00226e
dec ecx
insd dword es:[edi], dx
inc edx
push ecx
jns 0x2b002269
push eax
push esp
dec edx
push ebx
jbe 0x2b00226e
xor al, 0x61
xor al, byte [edi + 0x78]
jae 0x2b002293
imul ebp, dword [ecx + 0x4d], 0x6a
push ecx
jns 0x2b002290
jo 0x2b0022b1
inc edx
inc edx
ja 0x2b0022ae
bound esi, qword [edi]
jns 0x2b002284
das
ja 0x2b0022a0
popal
dec esi
or eax, 0x5678560a
push esi
js 0x2b0022b2
dec ecx
dec ecx
dec edi
popal
pop edx
cmp byte [ecx], bh
je 0x2b0022de
push ebx
inc esp
inc esp
inc ebp
inc ecx
inc esi
inc esp
jp 0x2b0022d2
arpl word [edx + 0x4e], di
jp 0x2b0022bf
push edi
push esp
inc esp
jo 0x2b002300
jae 0x2b0022d9
inc ebx
aaa
push ebp
popal
dec ebp
push 0x45623257