Function at 0x12e8cb4
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get number of processors
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword fs:[0x30]
mov dword [0x12ecf44], 0x12ecf44
mov dword [0x12ecf50], 0x12e8544
mov dword [0x12ecf54], 0x12e9d54
mov dword [0x12ecf58], 0x12e83d4
mov dword [0x12ed6bc], 0
mov dword [0x12ed6b0], 0
mov dword [0x12ed6b4], 0
mov dword [0x12ed6b8], 0
mov dword [0x12ed6c0], 0x12ea584
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
push 0
push 0xbbe11f17
mov esi, dword [eax + 0x18]
call fcn.012e7fd4
push 0
push 0x60cf99af
mov dword [0x12ed630], eax
call fcn.012e7fd4
mov ebx, dword [ebp + 8]
mov edi, eax
push 0
push 0x4dd0a472
test ebx, ebx
mov dword [0x12ed638], edi
push edi
cmove ebx, esi
mov esi, dword [0x12ed630]
push 0x12ed628
call fcn.012e80a4
push 0
push 0xdae698d3
push edi
push 0x12ed62c
call fcn.012e80a4
push 1
push 0xdd71a6cc
push edi
push 0x12ed5e4
call fcn.012e80a4
push 1
push 0x934f10fa
push edi
push 0x12ed5e8
call fcn.012e80a4
push 1
push 0xe497b485
push edi
push 0x12ed5ec
call fcn.012e80a4
push 1
push 0x21a37b6c
push edi
push 0x12ed684
call fcn.012e80a4
call dword [0x12ed684]
push 0x12ea584
push 1
mov dword [0x12ecf5c], eax
mov dword [0x12ecf60], 1
call dword [0x12ed5e8]
push 1
push 0x9b30cc3f
push esi
push 0x12ed590
mov dword [0x12ed640], eax
call fcn.012e80a4
push 1
push 0xd2e93957
push esi
push 0x12ed594
call fcn.012e80a4
push 1
push 0x3c1f3d90
push esi
push 0x12ed598
call fcn.012e80a4
push 1
push 0xf75ce257
push esi
push 0x12ed59c
call fcn.012e80a4
push 1
push 0xeb426147
push esi
push 0x12ed5a0
call fcn.012e80a4
push 1
push 0x72f8b38e
push esi
push 0x12ed5a4
call fcn.012e80a4
push 1
push 0xb78bdb16
push esi
push 0x12ed5a8
call fcn.012e80a4
push 1
push 0xd32e9d61
push esi
push 0x12ed5ac
call fcn.012e80a4
push 1
push 0x4748527b
push esi
push 0x12ed5b0
call fcn.012e80a4
push 1
push 0x5b8dd581
push esi
push 0x12ed5b4
call fcn.012e80a4
push 1
push 0x5dc29570
push esi
push 0x12ed5b8
call fcn.012e80a4
push 1
push 0x4e62601b
push esi
push 0x12ed588
call fcn.012e80a4
push 1
push 0x27154a05
push esi
push 0x12ed58c
call fcn.012e80a4
push 1
push 0x5e4bf6f0
push edi
push 0x12ed5d8
call fcn.012e80a4
push 1
push 0x5e4bf706
push edi
push 0x12ed5dc
call fcn.012e80a4
push 1
push 0x1552ae9b
push edi
push 0x12ed5e0
call fcn.012e80a4
push 1
push 0x376af5b2
push edi
push fcn.012ed5bc
call fcn.012e80a4
push 1
push 0x1552aeb1
push edi
push 0x12ed5c0
call fcn.012e80a4
push 1
push 0xd447896e
push edi
push 0x12ed5c4
call fcn.012e80a4
push 1
push 0xbed1215b
push edi
push fcn.012ed5c8
call fcn.012e80a4
push 1
push 0xd8f81d2f
push edi
push 0x12ed5cc
call fcn.012e80a4
push 1
push 0x4db82756
push edi
push 0x12ed5d0
call fcn.012e80a4
push 1
push 0x942467dc
push edi
push 0x12ed5d4
call fcn.012e80a4
push 1
push 0xe4b23a39
push edi
push 0x12ed5f0
call fcn.012e80a4
push 1
push 0x4df7d46e
push edi
push fcn.012ed5f4
call fcn.012e80a4
push 1
push 0x15ec9667
push edi
push fcn.012ed5f8
call fcn.012e80a4
push 1
push 0x8b05fb05
push edi
push 0x12ed600
call fcn.012e80a4
push 1
push 0xdf09dc26
push edi
push 0x12ed5fc
call fcn.012e80a4
push 1
push 0x228333bc
push edi
push 0x12ed610
call fcn.012e80a4
push 1
push 0x4abb6b25
push edi
push 0x12ed614
call fcn.012e80a4
push 1
push 0xac3a78a9
push edi
push 0x12ed618
call fcn.012e80a4
push 1
push 0x2066074a
push edi
push 0x12ed61c
call fcn.012e80a4
push 1
push 0x2b19b2ad
push edi
push 0x12ed620
call fcn.012e80a4
push 1
push 0x6bfaf860
push edi
push 0x12ed624
call fcn.012e80a4
push 1
push 0x1291cb13
push edi
push 0x12ed664
call fcn.012e80a4
push 1
push 0xab10ad07
push edi
push 0x12ed67c
call fcn.012e80a4
push 1
push 0x4b07dd7e
push edi
push 0x12ed66c
call fcn.012e80a4
push 1
push 0x96b79b23
push edi
push 0x12ed678
call fcn.012e80a4
push 1
push 0x4f75ef12
push edi
push 0x12ed670
call fcn.012e80a4
push 1
push 0xf44a4406
push edi
push 0x12ed674
call fcn.012e80a4
push 1
push 0xb25b6481
push edi
push 0x12ed688
call fcn.012e80a4
push 1
push 0xae980712
push edi
push fcn.012ed694
call fcn.012e80a4
push 1
push 0xf4a11ee3
push edi
push 0x12ed698
call fcn.012e80a4
push 1
push 0x830c3f86
push edi
push 0x12ed6a0
call fcn.012e80a4
push 1
push 0x885e90c
push edi
push 0x12ed69c
call fcn.012e80a4
push 1
push 0xb3ea952b
push edi
push 0x12ed6a4
call fcn.012e80a4
mov eax, dword [0x12ed67c]
xor ecx, ecx
mov dword [0x12ecf3c], eax
mov byte [ebp - 0xb], 0x7c
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x79
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x39
mov byte [ebp - 5], 0x35
mov byte [ebp - 4], 0x6b
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0x73
mov byte [ebp - 1], 0
mov al, byte [ebp - 0xb]
mov al, byte [ebp + ecx - 0xb]
movsx eax, al
sub eax, 7
mov byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 0xa
jb 0x12e9166
lea eax, [ebp - 0xb]
push eax
call dword [0x12ed5d8]
push 1
mov esi, eax
push 0xbc022598
push esi
push 0x12ed604
mov dword [0x12ed63c], esi
call fcn.012e80a4
push 1
push 0xcd6a1508
push esi
push 0x12ed60c
call fcn.012e80a4
push 1
push 0x81225c79
push esi
push 0x12ed608
call fcn.012e80a4
push 1
push 0xcd6a151e
push esi
push 0x12ed6ac
call fcn.012e80a4
push 1
push 0x81225c8f
push esi
push 0x12ed6a8
call fcn.012e80a4
push 1
push 0x1f2ae094
push esi
push fcn.012ed68c
call fcn.012e80a4
push 1
push 0xff9a9fe
push esi
push fcn.012ed690
call fcn.012e80a4
push ebx
call fcn.012e9a34
add esp, 4
cmp dword [0x12ed6c4], 0xffffffff
je 0x12e940c
mov dword [ebp - 0x28], 0x2a
xor edx, edx
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x46
mov byte [ebp - 0x22], 0x45
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4f
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x4b
mov byte [ebp - 0x1d], 0x44
mov byte [ebp - 0x1c], 0x4e
mov byte [ebp - 0x1b], 0x46
mov byte [ebp - 0x1a], 0x4f
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x19], 0
nop dword [eax + eax]
mov al, byte [ebp + edx - 0x24]
movsx ecx, byte [ebp - 0x28]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x24], al
inc edx
cmp edx, 0xb
jb 0x12e9264
mov byte [ebp - 0x19], 0
xor edx, edx
mov dword [ebp - 0x18], 7
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 0x12], 0x6b
mov byte [ebp - 0x11], 0x6b
mov byte [ebp - 0x10], 0x68
mov al, byte [ebp - 0x14]
mov byte [ebp - 0xf], 0
nop
mov al, byte [ebp + edx - 0x14]
movsx ecx, byte [ebp - 0x18]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x14], al
inc edx
cmp edx, 5
jb 0x12e92a4
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x44], 0x70
mov eax, dword [ebp - 0x44]
xor eax, 0x62
mov byte [ebp - 0x40], al
mov eax, dword [ebp - 0x44]
inc al
xor eax, 0x69
mov byte [ebp - 0x3f], al
mov eax, dword [ebp - 0x44]
add al, 2
xor eax, 0x6e
mov byte [ebp - 0x3e], al
mov eax, dword [ebp - 0x44]
add al, 3
xor eax, 0x64
mov byte [ebp - 0x3d], al
mov eax, dword [ebp - 0x44]
add al, 4
xor eax, 0x20
mov byte [ebp - 0x3c], al
mov eax, dword [ebp - 0x44]
add al, 5
xor eax, 0x63
mov byte [ebp - 0x3b], al
mov eax, dword [ebp - 0x44]
add al, 6
xor eax, 0x6f
mov byte [ebp - 0x3a], al
mov eax, dword [ebp - 0x44]
add al, 7
xor eax, 0x6d
mov byte [ebp - 0x39], al
mov eax, dword [ebp - 0x44]
add al, 8
xor eax, 0x70
mov byte [ebp - 0x38], al
mov eax, dword [ebp - 0x44]
add al, 9
xor eax, 0x6c
mov byte [ebp - 0x37], al
mov eax, dword [ebp - 0x44]
add al, 0xa
xor eax, 0x65
mov byte [ebp - 0x36], al
mov eax, dword [ebp - 0x44]
add al, 0xb
xor eax, 0x74
mov byte [ebp - 0x35], al
mov eax, dword [ebp - 0x44]
add al, 0xc
xor eax, 0x65
mov byte [ebp - 0x34], al
mov eax, dword [ebp - 0x44]
add al, 0xd
xor eax, 0x20
mov byte [ebp - 0x33], al
mov eax, dword [ebp - 0x44]
add al, 0xe
xor eax, 0x25
mov byte [ebp - 0x32], al
mov eax, dword [ebp - 0x44]
add al, 0xf
xor eax, 0x70
mov byte [ebp - 0x31], al
mov eax, dword [ebp - 0x44]
add al, 0x10
xor eax, 0x2c
mov byte [ebp - 0x30], al
mov eax, dword [ebp - 0x44]
add al, 0x11
xor eax, 0x20
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0x44]
add al, 0x12
xor eax, 0x25
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0x44]
add al, 0x13
xor eax, 0x73
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x44]
add al, 0x14
xor eax, 0x20
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x44]
add al, 0x15
xor eax, 0x25
mov byte [ebp - 0x2b], al
mov eax, dword [ebp - 0x44]
add al, 0x16
mov byte [ebp - 0x29], 0
xor eax, 0x70
xor edx, edx
mov byte [ebp - 0x2a], al
mov al, byte [ebp - 0x40]
mov al, byte [ebp + edx - 0x40]
mov ecx, dword [ebp - 0x44]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x40], cl
inc edx
cmp edx, 0x17
jb 0x12e93ca
lea eax, [ebp - 0x24]
mov byte [ebp - 0x29], 0
push eax
push edi
call dword [0x12ed5e4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x12ecf44
lea eax, [ebp - 0x40]
push eax
push 0x12ecf44
call fcn.012e9804
add esp, 0x14
mov ecx, dword [0x12ecf64]
xor edi, edi
cmp ecx, 0x1ff
jae 0x12e9430
inc ecx
mov dword [0x12ecf64], ecx
mov byte [ecx + 0x12ecf68], 0x13
mov ecx, dword [0x12ecf64]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x12e949c
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
jne 0x12e949c
mov eax, 0x10b
cmp word [esi + 0x18], ax
jne 0x12e949c
movzx eax, word [esi + 0x14]
xor edx, edx
movzx edi, word [esi + 6]
add eax, 0x18
add eax, esi
test edi, edi
je 0x12e9483
cmp dword [eax + 8], 0x1dfb4
jbe 0x12e947b
mov esi, dword [eax + 0xc]
add esi, ebx
cmp dword [esi], 0x20170408
je 0x12e9498
inc edx
add eax, 0x28
cmp edx, edi
jb 0x12e9465
xor esi, esi
xor edi, edi
dec ecx
mov dword [0x12ecf64], ecx
test esi, esi
jne 0x12e95f0
jmp 0x12e94a5
mov edi, eax
jmp 0x12e9487
xor esi, esi
dec ecx
mov dword [0x12ecf64], ecx
cmp dword [0x12ed6c4], 0xffffffff
je 0x12e95e1
mov dword [ebp - 0x60], 0x5e
mov eax, dword [ebp - 0x60]
xor eax, 0x63
mov byte [ebp - 0x5c], al
mov eax, dword [ebp - 0x60]
inc al
xor eax, 0x61
mov byte [ebp - 0x5b], al
mov eax, dword [ebp - 0x60]
add al, 2
xor eax, 0x6e
mov byte [ebp - 0x5a], al
mov eax, dword [ebp - 0x60]
add al, 3
xor eax, 0x27
mov byte [ebp - 0x59], al
mov eax, dword [ebp - 0x60]
add al, 4
xor eax, 0x74
mov byte [ebp - 0x58], al
mov eax, dword [ebp - 0x60]
add al, 5
xor eax, 0x20
mov byte [ebp - 0x57], al
mov eax, dword [ebp - 0x60]
add al, 6
xor eax, 0x66
mov byte [ebp - 0x56], al
mov eax, dword [ebp - 0x60]
add al, 7
xor eax, 0x69
mov byte [ebp - 0x55], al
mov eax, dword [ebp - 0x60]
add al, 8
xor eax, 0x6e
mov byte [ebp - 0x54], al
mov eax, dword [ebp - 0x60]
add al, 9
xor eax, 0x64
mov byte [ebp - 0x53], al
mov eax, dword [ebp - 0x60]
add al, 0xa
xor eax, 0x20
mov byte [ebp - 0x52], al
mov eax, dword [ebp - 0x60]
add al, 0xb
xor eax, 0x72
mov byte [ebp - 0x51], al
mov eax, dword [ebp - 0x60]
add al, 0xc
xor eax, 0x67
mov byte [ebp - 0x50], al
mov eax, dword [ebp - 0x60]
add al, 0xd
xor eax, 0x70
mov byte [ebp - 0x4f], al
mov eax, dword [ebp - 0x60]
add al, 0xe
xor eax, 0x20
mov byte [ebp - 0x4e], al
mov eax, dword [ebp - 0x60]
add al, 0xf
xor eax, 0x73
mov byte [ebp - 0x4d], al
mov eax, dword [ebp - 0x60]
add al, 0x10
xor eax, 0x65
mov byte [ebp - 0x4c], al
mov eax, dword [ebp - 0x60]
add al, 0x11
xor eax, 0x63
mov byte [ebp - 0x4b], al
mov eax, dword [ebp - 0x60]
add al, 0x12
xor eax, 0x74
mov byte [ebp - 0x4a], al
mov eax, dword [ebp - 0x60]
add al, 0x13
xor eax, 0x69
mov byte [ebp - 0x49], al
mov eax, dword [ebp - 0x60]
add al, 0x14
xor eax, 0x6f
mov byte [ebp - 0x48], al
mov eax, dword [ebp - 0x60]
add al, 0x15
mov byte [ebp - 0x46], 0
xor eax, 0x6e
xor edx, edx
mov byte [ebp - 0x47], al
mov al, byte [ebp - 0x5c]
nop
mov al, byte [ebp + edx - 0x5c]
mov ecx, dword [ebp - 0x60]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x5c], cl
inc edx
cmp edx, 0x16
jb 0x12e95b4
lea eax, [ebp - 0x5c]
mov byte [ebp - 0x46], 0
push eax
push 0x12ecf44
call fcn.012e9804
add esp, 8
push 0xe0410008
push 0x12ecf44
call fcn.012ea844
cmp dword [esi + 8], 0x1dfb4
je 0x12e9780
cmp dword [0x12ed6c4], 0xffffffff
je 0x12e9771
mov dword [ebp - 0x80], 0x42
mov eax, dword [ebp - 0x80]
xor eax, 0x72
mov byte [ebp - 0x7c], al
mov eax, dword [ebp - 0x80]
inc al
xor eax, 0x67
mov byte [ebp - 0x7b], al
mov eax, dword [ebp - 0x80]
add al, 2
xor eax, 0x70
mov byte [ebp - 0x7a], al
mov eax, dword [ebp - 0x80]
add al, 3
xor eax, 0x20
mov byte [ebp - 0x79], al
mov eax, dword [ebp - 0x80]
add al, 4
xor eax, 0x73
mov byte [ebp - 0x78], al
mov eax, dword [ebp - 0x80]
add al, 5
xor eax, 0x65
mov byte [ebp - 0x77], al
mov eax, dword [ebp - 0x80]
add al, 6
xor eax, 0x63
mov byte [ebp - 0x76], al
mov eax, dword [ebp - 0x80]
add al, 7
xor eax, 0x74
mov byte [ebp - 0x75], al
mov eax, dword [ebp - 0x80]
add al, 8
xor eax, 0x69
mov byte [ebp - 0x74], al
mov eax, dword [ebp - 0x80]
add al, 9
xor eax, 0x6f
mov byte [ebp - 0x73], al
mov eax, dword [ebp - 0x80]
add al, 0xa
xor eax, 0x6e
mov byte [ebp - 0x72], al
mov eax, dword [ebp - 0x80]
add al, 0xb
xor eax, 0x20
mov byte [ebp - 0x71], al
mov eax, dword [ebp - 0x80]
add al, 0xc
xor eax, 0x73
mov byte [ebp - 0x70], al
mov eax, dword [ebp - 0x80]
add al, 0xd
xor eax, 0x69
mov byte [ebp - 0x6f], al
mov eax, dword [ebp - 0x80]
add al, 0xe
xor eax, 0x7a
mov byte [ebp - 0x6e], al
mov eax, dword [ebp - 0x80]
add al, 0xf
xor eax, 0x65
mov byte [ebp - 0x6d], al
mov eax, dword [ebp - 0x80]
add al, 0x10
xor eax, 0x20
mov byte [ebp - 0x6c], al
mov eax, dword [ebp - 0x80]
add al, 0x11
xor eax, 0x69
mov byte [ebp - 0x6b], al
mov eax, dword [ebp - 0x80]
add al, 0x12
xor eax, 0x73
mov byte [ebp - 0x6a], al
mov eax, dword [ebp - 0x80]
add al, 0x13
xor eax, 0x20
mov byte [ebp - 0x69], al
mov eax, dword [ebp - 0x80]
add al, 0x14
xor eax, 0x69
mov byte [ebp - 0x68], al
mov eax, dword [ebp - 0x80]
add al, 0x15
xor eax, 0x6e
mov byte [ebp - 0x67], al
mov eax, dword [ebp - 0x80]
add al, 0x16
xor eax, 0x76
mov byte [ebp - 0x66], al
mov eax, dword [ebp - 0x80]
add al, 0x17
xor eax, 0x61
mov byte [ebp - 0x65], al
mov eax, dword [ebp - 0x80]
add al, 0x18
xor eax, 0x6c
mov byte [ebp - 0x64], al
mov eax, dword [ebp - 0x80]
add al, 0x19
xor eax, 0x69
mov byte [ebp - 0x63], al
mov eax, dword [ebp - 0x80]
add al, 0x1a
mov byte [ebp - 0x61], 0
xor eax, 0x64
xor edx, edx
mov byte [ebp - 0x62], al
mov al, byte [ebp - 0x7c]
nop dword [eax]
mov al, byte [ebp + edx - 0x7c]
mov ecx, dword [ebp - 0x80]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x7c], cl
inc edx
cmp edx, 0x1b
jb 0x12e9744
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x61], 0
push eax
push 0x12ecf44
call fcn.012e9804
add esp, 8
push 0xe0410009
push 0x12ecf44
call fcn.012ea844
xor ecx, ecx
mov eax, 0x130b684
cmp eax, 0x12ed6d0
sbb edx, edx
and edx, 0xfffe204c
add edx, 0x1dfb4
je 0x12e97b2
nop dword [eax + eax]
mov al, byte [ecx + esi]
mov byte [ecx + 0x12ed6d0], al
inc ecx
cmp ecx, edx
jb 0x12e97a4
mov dword [0x12ed6cc], esi
mov dword [0x12ed644], ebx
mov dword [0x12ed64c], 0x12e8904
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x50]
add eax, ebx
mov dword [0x12ed650], edi
mov dword [0x12ed648], eax
mov eax, dword [0x12ed72c]
and eax, 0x8000
neg eax
pop edi
sbb eax, eax
and eax, 0x12eabf4
pop esi
mov dword [0x12ed680], eax
pop ebx
mov esp, ebp
pop ebp
ret 4