Function at 0x10012920
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x590
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov dword [0x100f484c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [0x100f4850], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x100f4854], eax
lea eax, [ebp - 0x527]
push 0
push eax
mov byte [ebp - 0x528], 0
call fcn.1003e130
lea eax, [ebp - 0x528]
push eax
call fcn.10010f40
add esp, 0x10
mov dword [ebp - 0x52c], 0x736579
lea ecx, [ebp - 0x52c]
lea eax, [ebp - 0x528]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100129b0
test dl, dl
je 0x100129ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100129b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10012990
xor eax, eax
jmp 0x100129b5
sbb eax, eax
or eax, 1
test eax, eax
sete byte [ebp - 0x551]
call fcn.100024b5
mov ecx, eax
test ecx, ecx
je 0x10012f6b
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, 1
mov ecx, ebx
sub ecx, dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [esi - 8]
sub eax, 0x400
mov dword [ebp - 0x56c], esi
or ecx, eax
jge 0x10012a07
push 0x400
lea ecx, [ebp - 0x56c]
call fcn.10002b53
mov esi, dword [ebp - 0x56c]
push esi
call fcn.10010f40
push dword [esi - 8]
push esi
call fcn.1003acb5
add esp, 0xc
test eax, eax
js 0x10012fa7
cmp eax, dword [esi - 8]
jg 0x10012fa7
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
call fcn.100024b5
mov ecx, eax
test ecx, ecx
je 0x10012f75
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, ebx
sub ecx, dword [eax + 0xc]
lea edi, [eax + 0x10]
mov eax, dword [edi - 8]
sub eax, 0x400
mov dword [ebp - 0x55c], edi
or ecx, eax
jge 0x10012a75
push 0x400
lea ecx, [ebp - 0x55c]
call fcn.10002b53
mov edi, dword [ebp - 0x55c]
push edi
call fcn.10010f40
push dword [edi - 8]
push edi
call fcn.1003acb5
add esp, 0xc
test eax, eax
js 0x10012fa7
cmp eax, dword [edi - 8]
jg 0x10012fa7
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
call fcn.100024b5
mov ecx, eax
test ecx, ecx
je 0x10012f7f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [eax + 8]
add eax, 0x10
mov edx, ebx
mov dword [ebp - 0x564], eax
sub ecx, 0x400
mov dword [ebp - 0x578], eax
sub edx, dword [eax - 4]
or edx, ecx
jge 0x10012af0
push 0x400
lea ecx, [ebp - 0x578]
call fcn.10002b53
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x564], eax
push eax
call fcn.10010f40
mov eax, dword [ebp - 0x564]
push dword [eax - 8]
push eax
call fcn.1003acb5
mov ecx, eax
add esp, 0xc
test ecx, ecx
js 0x10012fa7
mov eax, dword [ebp - 0x564]
cmp ecx, dword [eax - 8]
jg 0x10012fa7
mov dword [eax - 0xc], ecx
mov byte [ecx + eax], 0
call fcn.100024b5
mov ecx, eax
test ecx, ecx
je 0x10012f89
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [eax + 8]
add eax, 0x10
mov edx, ebx
mov dword [ebp - 0x568], eax
sub ecx, 0x400
mov dword [ebp - 0x570], eax
sub edx, dword [eax - 4]
or edx, ecx
jge 0x10012b79
push 0x400
lea ecx, [ebp - 0x570]
call fcn.10002b53
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x568], eax
push eax
call fcn.10010f40
mov eax, dword [ebp - 0x568]
push dword [eax - 8]
push eax
call fcn.1003acb5
mov ecx, eax
add esp, 0xc
test ecx, ecx
js 0x10012fa7
mov eax, dword [ebp - 0x568]
cmp ecx, dword [eax - 8]
jg 0x10012fa7
mov dword [eax - 0xc], ecx
mov byte [ecx + eax], 0
call fcn.100024b5
mov ecx, eax
test ecx, ecx
je 0x10012f93
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [eax + 8]
add eax, 0x10
sub ecx, 0x400
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x574], eax
sub ebx, dword [eax - 4]
or ebx, ecx
jge 0x10012c00
push 0x400
lea ecx, [ebp - 0x574]
call fcn.10002b53
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x52c], eax
push eax
call fcn.10010f40
mov eax, dword [ebp - 0x52c]
push dword [eax - 8]
push eax
call fcn.1003acb5
mov ecx, eax
add esp, 0xc
test ecx, ecx
js 0x10012fa7
mov eax, dword [ebp - 0x52c]
cmp ecx, dword [eax - 8]
jg 0x10012fa7
mov dword [eax - 0xc], ecx
mov byte [ecx + eax], 0
call fcn.1000b180
push 0x103
mov byte [ebp - 0x558], al
lea eax, [ebp - 0x127]
push 0
push eax
mov byte [ebp - 0x128], 0
call fcn.1003e130
push 0x104
lea eax, [ebp - 0x128]
push eax
push 0
call fcn.100178e0
lea eax, [ebp - 0x128]
push eax
call fcn.10007fb0
add esp, 0x1c
cmp byte [ebp - 0x551], 0
jne 0x10012c90
test al, al
je 0x10012c90
xor bl, bl
jmp 0x10012c92
mov bl, 1
push dword [ebp - 0x558]
lea eax, [ebp - 0x54c]
push esi
push eax
call fcn.1000c310
add esp, 0xc
test bl, bl
jne 0x10012cb9
cmp dword [ebp - 0x53c], 0
jne 0x10012ddc
call fcn.100024b5
mov ecx, eax
test ecx, ecx
je 0x10012f9d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22], 0x73257325
push 0x10
mov dword [ebp - 0x558], eax
lea ecx, [ebp - 0x55c]
push 0
lea eax, [ebp - 0x560]
mov word [ebp - 0x24], 0x7325
push eax
mov byte [ebp - 0x1e], 0
call fcn.10003c3c
push esi
push str.08ad6b0c342646c9baca1a95d219c791
push dword [eax]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.10003e70
mov edx, dword [ebp - 0x560]
or ebx, 0xffffffff
add edx, 0xfffffff0
add esp, 0x14
mov eax, ebx
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10012d3a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x558]
sub esp, 0x18
mov ecx, esp
push esi
call fcn.10002100
lea eax, [ebp - 0x590]
push eax
call fcn.100150e0
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x560], eax
add esp, 0x1c
cmp ecx, eax
je 0x10012dae
cmp dword [ebp - 0x538], 0x10
jb 0x10012d87
push dword [ebp - 0x54c]
call fcn.1003a126
mov eax, dword [ebp - 0x560]
add esp, 4
push eax
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x538], 0xf
mov dword [ebp - 0x53c], 0
mov byte [ebp - 0x54c], 0
call fcn.10003b6b
cmp dword [ebp - 0x57c], 0x10
jb 0x10012dc5
push dword [ebp - 0x590]
call fcn.1003a126
add esp, 4
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x10012ddc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x53c]
cmp dword [ebp - 0x538], 0x10
lea eax, [ebp - 0x54c]
mov word [ebp - 0xa], 0x4f53
cmovae eax, dword [ebp - 0x54c]
push eax
push 1
lea eax, [ebp - 0x1c]
mov word [ebp - 0x11], 0x7774
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf], 0x5c657261
push eax
push reloc.WS2_32.dll_bind
mov byte [ebp - 8], 0
mov word [ebp - 0x14], 0x6f53
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0x12], 0x66
mov dword [ebp - 0x1c], 0x6b636954
mov word [ebp - 0x17], 0x74
mov byte [ebp - 0x18], 0x65
call fcn.100187e0
mov eax, dword [ebp - 0x52c]
add esp, 0x18
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp dword [ebp - 0x538], 0x10
lea ecx, [ebp - 0x54c]
push 0
cmovae ecx, dword [ebp - 0x54c]
mov esi, eax
lea eax, [ebp - 0x550]
mov dword [ebp - 0x550], 0
push eax
push dword [ebp - 0x53c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.100174b0
mov dword [ebp - 0x534], 0x646967
lea eax, [ebp - 0x534]
push dword [edi - 0xc]
push edi
push 1
push eax
lea eax, [ebp - 0x14]
push eax
push reloc.WS2_32.dll_bind
call fcn.100187e0
mov eax, dword [ebp - 0x564]
mov word [ebp - 0x52f], 0x69
mov byte [ebp - 0x530], 0x63
push dword [eax - 0xc]
push eax
push 1
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x14]
push eax
push reloc.WS2_32.dll_bind
call fcn.100187e0
mov eax, dword [ebp - 0x568]
push dword [eax - 0xc]
push eax
push 1
push 0x100d0764
lea eax, [ebp - 0x14]
push eax
push reloc.WS2_32.dll_bind
call fcn.100187e0
add esp, 0x4c
lea ecx, [ebp - 0x54c]
call fcn.10002594
lea ecx, [ebp - 0x574]
call fcn.10002cf1
lea ecx, [ebp - 0x570]
call fcn.10002cf1
lea ecx, [ebp - 0x578]
call fcn.10002cf1
lea ecx, [ebp - 0x55c]
call fcn.10002cf1
lea ecx, [ebp - 0x56c]
call fcn.10002cf1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002d1a
push 0x80004005
call fcn.10002d1a
push 0x80004005
call fcn.10002d1a
push 0x80004005
call fcn.10002d1a
push 0x80004005
call fcn.10002d1a
push 0x80004005
call fcn.10002d1a
push 0x80070057
call fcn.10002d1a
int3