Function at 0x402890
Capabilities:
Check for debugger via api
Check for hardware breakpoints
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check os version
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x402ed5
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 1
je 0x402ed5
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 4], 0
jne 0x402ed5
mov eax, dword fs:[0x18]
xor esi, esi
push str.IsWow64Process
push str.kernel32.dll
mov dword [ebp - 8], esi
mov edi, dword [eax + 0x30]
add edi, 0x68
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x402917
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
cmp dword [ebp - 8], esi
je 0x40292e
mov eax, dword fs:[0x18]
mov esi, dword [eax - 0x1fa0]
add esi, 0xbc
test edi, edi
je 0x40293e
test byte [edi], 0x70
je 0x40293e
mov ecx, 1
jmp 0x402940
xor ecx, ecx
test esi, esi
je 0x402950
test byte [esi], 0x70
je 0x402950
mov eax, 1
jmp 0x402952
xor eax, eax
test ecx, ecx
jne 0x402ed5
test eax, eax
jne 0x402ed5
push ecx
xor edx, edx
lea ecx, [eax + 6]
call fcn.00402130
add esp, 4
test al, al
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x18]
je 0x402982
add eax, 0x40
jmp 0x402985
add eax, 0xc
cmp dword [eax], 2
ja 0x402ed5
xor edx, edx
push ecx
lea ecx, [edx + 6]
call fcn.00402130
add esp, 4
test al, al
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x18]
je 0x4029ae
add eax, 0x44
jmp 0x4029b1
add eax, 0x10
cmp dword [eax], 0
ja 0x402ed5
mov dword [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0x3a], 0xc550c4e
mov dword [ebp - 0x36], 0xc4f0c46
mov dword [ebp - 0x32], 0xc0b0c48
mov dword [ebp - 0x2e], 0xc4b0c42
mov dword [ebp - 0x2a], 0xc44
mov byte [ebp - 0x26], 1
nop word [eax + eax]
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x3a], ax
inc ecx
cmp ecx, 9
jb 0x4029f0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x3a]
push eax
mov byte [ebp - 0x26], 0
call edi
movaps xmm0, xmmword [0x4500e0]
mov edx, eax
movups xmmword [ebp - 0x97], xmm0
mov dword [ebp - 0x87], 0x41625f5f
xor ecx, ecx
mov dword [ebp - 0x83], 0x4453565b
mov word [ebp - 0x7f], 0x4b
mov byte [ebp - 0x7d], 1
mov al, cl
add al, 0x20
xor byte [ebp + ecx - 0x97], al
inc ecx
cmp ecx, 0x19
jb 0x402a41
lea eax, [ebp - 0x97]
mov byte [ebp - 0x7d], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
test esi, esi
je 0x402a8c
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 7
call ebx
push eax
call esi
test eax, eax
jne 0x402a8c
cmp dword [ebp - 0xc], eax
jne 0x402ed5
mov dword [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0x50], 0xc550c4e
mov dword [ebp - 0x4c], 0xc4f0c46
mov dword [ebp - 0x48], 0xc0b0c48
mov dword [ebp - 0x44], 0xc4b0c42
mov dword [ebp - 0x40], 0xc44
mov byte [ebp - 0x3c], 1
nop dword [eax]
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x50], ax
inc ecx
cmp ecx, 9
jb 0x402ac0
lea eax, [ebp - 0x50]
mov byte [ebp - 0x3c], 0
push eax
call edi
movaps xmm0, xmmword [0x4500e0]
mov edx, eax
movups xmmword [ebp - 0xb2], xmm0
mov dword [ebp - 0xa2], 0x41625f5f
xor ecx, ecx
mov dword [ebp - 0x9e], 0x4453565b
mov word [ebp - 0x9a], 0x4b
mov byte [ebp - 0x98], 1
mov al, cl
add al, 0x20
xor byte [ebp + ecx - 0xb2], al
inc ecx
cmp ecx, 0x19
jb 0x402b11
lea eax, [ebp - 0xb2]
mov byte [ebp - 0x98], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov esi, eax
lea eax, [ebp - 0x10]
push 4
push eax
push 0x1f
call ebx
push eax
call esi
test eax, eax
jne 0x402b55
cmp dword [ebp - 0x10], eax
je 0x402ed5
mov dword [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x66], 0xc550c4e
mov dword [ebp - 0x62], 0xc4f0c46
mov dword [ebp - 0x5e], 0xc0b0c48
mov dword [ebp - 0x5a], 0xc4b0c42
mov dword [ebp - 0x56], 0xc44
mov byte [ebp - 0x52], 1
nop word [eax + eax]
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x66], ax
inc ecx
cmp ecx, 9
jb 0x402b90
lea eax, [ebp - 0x66]
mov byte [ebp - 0x52], 0
push eax
call edi
movaps xmm0, xmmword [0x4500e0]
mov edx, eax
movups xmmword [ebp - 0xcd], xmm0
mov dword [ebp - 0xbd], 0x41625f5f
xor ecx, ecx
mov dword [ebp - 0xb9], 0x4453565b
mov word [ebp - 0xb5], 0x4b
mov byte [ebp - 0xb3], 1
mov al, cl
add al, 0x20
xor byte [ebp + ecx - 0xcd], al
inc ecx
cmp ecx, 0x19
jb 0x402be1
lea eax, [ebp - 0xcd]
mov byte [ebp - 0xb3], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push 4
push eax
push 0x1e
call ebx
push eax
call esi
test eax, eax
jne 0x402c25
cmp dword [ebp - 0x14], eax
jne 0x402ed5
mov dword [ebp - 0x7c], 0xc550c4e
xor ecx, ecx
mov dword [ebp - 0x78], 0xc4f0c46
mov dword [ebp - 0x74], 0xc0b0c48
mov dword [ebp - 0x70], 0xc4b0c42
mov dword [ebp - 0x6c], 0xc44
mov byte [ebp - 0x68], 1
nop
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x7c], ax
inc ecx
cmp ecx, 9
jb 0x402c50
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x68], 0
push eax
call edi
movaps xmm0, xmmword [0x450070]
mov edx, eax
movups xmmword [ebp - 0xe5], xmm0
mov dword [ebp - 0xd5], 0x56405964
xor ecx, ecx
mov dword [ebp - 0xd1], 0x1005155
mov al, cl
add al, 0x20
xor byte [ebp + ecx - 0xe5], al
inc ecx
cmp ecx, 0x16
jb 0x402c91
lea eax, [ebp - 0xe5]
mov byte [ebp - 0xce], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push 0
push 0
push 0x11
call ebx
push eax
call esi
test eax, eax
jne 0x402ed5
call fcn.004022d0
test eax, eax
jne 0x402ed5
mov edi, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x402360
call edi
push 0
push 0
push 0
push 0xc000008e
mov esi, eax
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret