Function at 0x12700
Capabilities:
Contain obfuscated stackstrings
Hash data with md5
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x36c
push ebx
push esi
mov esi, eax
or eax, 0xffffffff
cmp dword [ebp + 8], 0x100
push edi
jne 0x12aaa
test esi, esi
je 0x12aaa
push 0x84
lea eax, [esp + 0x8c]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
xor edi, edi
lea ecx, [esi + 2]
mov al, byte [ecx - 2]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x12754
mov al, dl
jmp 0x1275e
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x1275e
add al, 0xc9
cmp al, 0xf
ja 0x128a3
shl al, 4
mov byte [esp + edi + 0x88], al
mov al, byte [ecx - 1]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x1277f
mov al, dl
jmp 0x12789
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x12789
add al, 0xc9
cmp al, 0xf
ja 0x128a3
or byte [esp + edi + 0x88], al
mov al, byte [ecx]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x127a6
mov al, dl
jmp 0x127b0
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x127b0
add al, 0xc9
cmp al, 0xf
ja 0x12898
shl al, 4
mov byte [esp + edi + 0x89], al
mov al, byte [ecx + 1]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x127d1
mov al, dl
jmp 0x127db
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x127db
add al, 0xc9
cmp al, 0xf
ja 0x12898
or byte [esp + edi + 0x89], al
mov al, byte [ecx + 2]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x127f9
mov al, dl
jmp 0x12803
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x12803
add al, 0xc9
cmp al, 0xf
ja 0x1289b
shl al, 4
mov byte [esp + edi + 0x8a], al
mov al, byte [ecx + 3]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x12824
mov al, dl
jmp 0x1282e
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x1282e
add al, 0xc9
cmp al, 0xf
ja 0x1289b
or byte [esp + edi + 0x8a], al
mov al, byte [ecx + 4]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x12848
mov al, dl
jmp 0x12852
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x12852
add al, 0xc9
cmp al, 0xf
ja 0x128a0
shl al, 4
mov byte [esp + edi + 0x8b], al
mov al, byte [ecx + 5]
lea edx, [eax - 0x30]
cmp dl, 9
ja 0x1286f
mov al, dl
jmp 0x12879
lea edx, [eax - 0x41]
cmp dl, 5
ja 0x12879
add al, 0xc9
cmp al, 0xf
ja 0x128a0
or byte [esp + edi + 0x8b], al
add edi, 4
add ecx, 8
cmp edi, 0x80
jb 0x12745
jmp 0x128a3
inc edi
jmp 0x128a3
add edi, 2
jmp 0x128a3
add edi, 3
cmp edi, 0x80
jne 0x12a99
mov dword [esp + 0x1c], 0x756f6853
mov dword [esp + 0x20], 0x7245694a
mov dword [esp + 0x24], 0x53696853
mov dword [esp + 0x28], 0x69685369
mov dword [esp + 0x2c], 0
call section..text
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x128e3
sub eax, edx
push eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x194]
call fcn.00011280
lea eax, [esp + 0x88]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x198]
push edx
call fcn.00012670
push 0x58
lea eax, [esp + 0x34]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [esp + 0x88]
lea ecx, [esp + 0x30]
mov dword [esp + 0x78], 0x67452301
mov dword [esp + 0x7c], 0xefcdab89
mov dword [esp + 0x80], 0x98badcfe
mov dword [esp + 0x84], 0x10325476
call fcn.00013140
mov ecx, dword [esp + 0x30]
and ecx, 0x3f
lea edx, [esp + ecx + 0x38]
mov eax, 0x37
mov byte [edx], 0x80
inc edx
sub eax, ecx
jns 0x1299a
add eax, 8
push eax
push 0
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea ecx, [esp + 0x78]
push ecx
lea eax, [esp + 0x3c]
call fcn.00012ac0
lea edx, [esp + 0x38]
mov eax, 0x38
push eax
push 0
push edx
call sub.ntoskrnl.exe_memset
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea edx, [eax*8]
shrd eax, ecx, 0x1d
mov dword [esp + 0x7c], edx
add esp, 0xc
lea edx, [esp + 0x78]
mov dword [esp + 0x74], eax
push edx
lea eax, [esp + 0x3c]
sar ecx, 0x1d
call fcn.00012ac0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0xc]
cmp cl, byte [esp + eax + 0xec]
jne 0x12a49
mov dl, byte [esp + eax + 0xd]
cmp dl, byte [esp + eax + 0xed]
jne 0x12a3e
mov cl, byte [esp + eax + 0xe]
cmp cl, byte [esp + eax + 0xee]
jne 0x12a41
mov dl, byte [esp + eax + 0xf]
cmp dl, byte [esp + eax + 0xef]
jne 0x12a46
add eax, 4
cmp eax, 0x10
jb 0x12a00
jmp 0x12a4e
inc eax
jmp 0x12a49
add eax, 2
jmp 0x12a49
add eax, 3
cmp eax, 0x10
jb 0x12a99
mov edx, dword [0xffdf0014]
mov ecx, dword [esp + 0xdc]
mov eax, dword [0xffdf0018]
mov esi, dword [esp + 0xd8]
mov ebx, dword [esp + 0xe0]
mov edi, dword [esp + 0xe4]
cmp eax, ecx
jl 0x12a99
jg 0x12a7f
cmp edx, esi
jb 0x12a99
cmp eax, edi
jg 0x12a99
jl 0x12a89
cmp edx, ebx
ja 0x12a99
mov eax, dword [ebp + 0xc]
dec dword [eax]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
inc dword [eax]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
inc dword [ecx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8