Function at 0x12f1c07
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [ebp - 4]
call fcn.013271fc
jp 0x12f1be4
les esi, [edi - 6]
dec eax
cwde
lodsb al, byte [esi]
adc dword [esi + ebx*4], reloc.kernel32.dll_GetProcAddress
fdivr dword [ebx]
adc ch, cl
mov edi, 0x66ffffff
mov ebx, dword [esp]
cmc
jmp 0x12f1be4
xchg edx, ebx
clc
jmp 0x13272fa
pushfd
mov dx, 0x1c4c
jmp 0x1327320
jno 0x12f1baf
jo 0x12f1baf
pop esi
test eax, 0x3eb56bc8
mov dh, 0xda
movsb byte es:[edi], byte [esi]
mov edx, 0x82e24e8e
cmp eax, 0xeb10090c
mov cl, 0x4d
push edx
sub ch, bh
inc edx
mov cl, 8
sub al, byte [ebp + 0x55]
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x12f1c1e
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]
shl esi, 8
xor esi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, ebx
shl esi, 8
xor esi, eax
xor esi, dword [ecx + 0xc]
mov dword [ebp - 0xc], edi
shr edi, 8
mov ebx, esi
shr ebx, 0x10
mov eax, 0xff
and edi, eax
and ebx, eax
mov ebx, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
xor ebx, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
mov edi, edx
shr edi, 0x18
xor ebx, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
mov edi, dword [ebp - 0x14]
and edi, eax
xor ebx, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
mov dword [ebp - 8], esi
xor ebx, dword [ecx + 0x10]
shr esi, 8
mov edi, edx
shr edi, 0x10
and edi, eax
and esi, eax
mov dword [ebp - 4], edi
mov edi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 4]
xor edi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], edx
mov dword [ebp - 0x10], ebx
shr esi, 0x18
xor edi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 0xc]
and esi, eax
xor edi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 0x14]
shr esi, 0x10
shr edx, 8
and esi, eax
and edx, eax
mov dword [ebp - 4], edx
mov edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 4]
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 0xc]
shr esi, 0x18
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 8]
and esi, eax
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 0x14]
xor edx, dword [ecx + 0x18]
xor edi, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shr edx, 0x10
shr esi, 8
and edx, eax
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
and esi, eax
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 8]
shr esi, 0x18
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
and esi, eax
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 0x18]
xor edx, dword [ecx + 0x1c]
sar esi, 1
add ecx, 0x20
dec esi
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], esi
je 0x12f1f98
mov esi, dword [ebp - 4]
shr esi, 8
and esi, eax
shr edx, 0x10
and edx, eax
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, ebx
shr esi, 0x18
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, edi
and esi, eax
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, ebx
xor edx, dword [ecx]
shr esi, 0x10
mov dword [ebp + 8], edx
mov edx, dword [ebp - 8]
and esi, eax
shr edx, 8
and edx, eax
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, edi
shr esi, 0x18
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, dword [ebp - 4]
shr ebx, 8
and ebx, eax
and esi, eax
xor edx, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, edi
shr esi, 0x10
and esi, eax
mov esi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
xor esi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 4]
shr ebx, 0x18
xor esi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 8]
and ebx, eax
xor esi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 4]
shr edi, 8
shr ebx, 0x10
and edi, eax
xor esi, dword [ecx + 8]
and ebx, eax
mov dword [ebp - 0x18], edi
mov edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 0x18]
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 8]
shr ebx, 0x18
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 0x10]
xor edx, dword [ecx + 4]
and ebx, eax
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, esi
xor edi, dword [ecx + 0xc]
shr ebx, 8
mov dword [ebp - 8], edi
shr edi, 0x10
and edi, eax
mov edi, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
and ebx, eax
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp + 8]
shr ebx, 0x18
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, edx
and ebx, eax
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp + 8]
xor edi, dword [ecx + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 8]
shr edi, 8
and edi, eax
mov edi, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
shr ebx, 0x10
and ebx, eax
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
and esi, eax
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp + 8]
xor edi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
mov esi, edx
shr esi, 0x10
and esi, eax
mov esi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
shr ebx, 8
and ebx, eax
xor esi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 0xc]
shr ebx, 0x18
xor esi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 8]
xor edi, dword [ecx + 0x14]
and ebx, eax
xor esi, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 0x10]
xor esi, dword [ecx + 0x18]
shr edx, 8
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0xc]
shr esi, 0x10
and esi, eax
mov esi, dword [esi*4 + reloc.kernel32.dll_GetProcAddress]
and edx, eax
xor esi, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
shr edx, 0x18
xor esi, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
mov edx, dword [ebp + 8]
and edx, eax
xor esi, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
add ecx, 0x20
xor esi, dword [ecx - 4]
dec dword [ebp - 0x14]
mov dword [ebp - 8], esi
mov edx, esi
jne 0x12f1dbb
shr edx, 0x10
and edx, eax
mov esi, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
shr edx, 8
and edx, eax
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
and edx, 0xff00
and esi, 0xff0000
xor esi, edx
mov edx, ebx
shr edx, 0x18
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
and edx, 0xff000000
xor esi, edx
shr ebx, 0x10
mov edx, edi
and edx, eax
movzx edx, byte [edx*4 + 0x12fdf90]
xor esi, edx
xor esi, dword [ecx]
and ebx, eax
mov dword [ebp + 8], esi
mov edx, esi
mov esi, dword [ebp + 0xc]
shr edx, 0x18
mov byte [esi], dl
mov edx, dword [ebp + 8]
shr edx, 0x10
mov byte [esi + 1], dl
mov edx, dword [ebp + 8]
shr edx, 8
mov byte [esi + 2], dl
mov dl, byte [ebp + 8]
mov byte [esi + 3], dl
mov edx, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov ebx, dword [ebp - 8]
shr ebx, 8
and ebx, eax
mov ebx, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
and ebx, 0xff00
and edx, 0xff0000
xor edx, ebx
mov ebx, edi
shr ebx, 0x18
mov ebx, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
and ebx, 0xff000000
xor edx, ebx
mov ebx, dword [ebp - 4]
and ebx, eax
movzx ebx, byte [ebx*4 + 0x12fdf90]
xor edx, ebx
xor edx, dword [ecx + 4]
mov ebx, edx
shr ebx, 0x18
mov byte [esi + 4], bl
mov ebx, edx
shr ebx, 0x10
mov byte [esi + 5], bl
mov ebx, edx
shr ebx, 8
mov byte [esi + 6], bl
mov ebx, dword [ebp - 0x10]
mov byte [esi + 7], dl
shr ebx, 8
and ebx, eax
mov ebx, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
mov edx, edi
shr edx, 0x10
and edx, eax
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
and ebx, 0xff00
and edx, 0xff0000
xor edx, ebx
mov ebx, dword [ebp - 4]
shr ebx, 0x18
mov ebx, dword [ebx*4 + reloc.kernel32.dll_GetProcAddress]
and ebx, 0xff000000
xor edx, ebx
mov ebx, dword [ebp - 8]
and ebx, eax
movzx ebx, byte [ebx*4 + 0x12fdf90]
xor edx, ebx
xor edx, dword [ecx + 8]
shr edi, 8
mov ebx, edx
shr ebx, 0x18
mov byte [esi + 8], bl
mov ebx, edx
mov byte [esi + 0xb], dl
and edi, eax
shr ebx, 0x10
mov byte [esi + 9], bl
mov ebx, edx
mov edx, dword [ebp - 4]
shr edx, 0x10
and edx, eax
shr ebx, 8
mov byte [esi + 0xa], bl
mov edi, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
mov edx, dword [edx*4 + reloc.kernel32.dll_GetProcAddress]
and edi, 0xff00
and edx, 0xff0000
xor edx, edi
mov edi, dword [ebp - 8]
shr edi, 0x18
mov edi, dword [edi*4 + reloc.kernel32.dll_GetProcAddress]
and edi, 0xff000000
xor edx, edi
mov edi, dword [ebp - 0x10]
and edi, eax
movzx eax, byte [edi*4 + 0x12fdf90]
xor edx, eax
xor edx, dword [ecx + 0xc]
mov eax, edx
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [esi + 0xe], al
mov byte [esi + 0xf], dl
jmp 0x12f2157
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, ebp
jmp 0x13271f2
bswap ecx
mov si, 0xab1f
pop cx
push ecx
jmp 0x13271d1
lea ecx, [ecx - 8]
mov dword [ecx], eax
pop ecx
mov esi, eax
jmp 0x1327238
pop word [esp]
lea esp, [esp + 2]
jmp 0x1327220
or byte [edi], cl
into
mov dword [ebp - 4], ecx
push si
jmp 0x13271e7
call fcn.0130cf7b
jmp 0x1327257
lea esp, [esp + 4]
jmp 0x12f1b85
jne 0x12f1b85
call fcn.013272bc
push ecx
rcl dword [ecx + 0x30], 0xc3
jg 0x1327216
jp 0x13272aa
les esi, [edi - 0x7d]
inc ebp
cld
add eax, dword [ebx + reloc.kernel32.dll_GetProcAddress]
clc
add dword [ebp - 4], 3
add edi, 4
dec dword [ebp - 8]
jmp 0x1327241
jmp 0x13272cb
sub ebx, eax
cmc
add ecx, eax
mov eax, ebp
jmp 0x13272d8
mov eax, dword [ebp + 8]
shl esi, 2
jmp 0x132871c
lea esp, [esp + 4]
leave
ret
jno 0x12f1bb8
pushfd
mov dx, 0x1c4c
jmp 0x1327320
xor eax, eax
mov bx, 0xf758
mov ebx, dword [esp]
jmp 0x13272f4
rdtsc
sub edi, 8
pushfd
jmp 0x1327378
cmc
jmp 0x1327353
not ebx
lea esp, [esp + 2]
mov dword [edi + 4], eax
sete bh
jmp 0x1327396
mov dword [eax], esi
rcr si, 7
mov ah, dl
pop esi
jmp 0x1327315
mov dword [edi], ebx
lea ebx, reloc.kernel32.dll_GetProcAddress
push si
bsr bx, bp
jo 0x132732b
jno 0x13273d8
push es
mov cl, 0xb0
mov bl, 0x95
popfd
sub bl, byte [ebp + 0x6b]
push es
aaa
bound edx, qword [eax + 0x6774c5aa]
mov es, word [edi - 0x548d0726]
xchg edx, ebx
clc
jb 0x1327328
cmc
jmp 0x1327329
mov bx, 0x14ec
jmp 0x1313dc4
neg eax
jg 0x1327380
mov bx, 0x14ec
call 0x13273bb
lodsd eax, dword [esi]
mov esp, 0x951c8d
add byte [eax], al
add byte [edx + 0x1c87241c], cl
and al, 0xb0
adc ebp, ebx
or ecx, dword [edi + reloc.kernel32.dll_GetProcAddress]
xchg bl, ah
mov bh, 0x84
jmp 0x13273a5
lea ebx, [edx*4]
mov bl, byte [esp]
xchg dword [esp], ebx
mov al, 0x13
jmp 0x13273c1
bsr ax, sp
shr ax, cl
mov eax, 0x352de9ed
neg ax
jmp 0x1327415
not ebx
lea esp, [esp + 2]
jmp 0x1327331
bswap ebx
xchg bx, ax
and bx, cx
push dword [esp]
ret 4
lea ebx, reloc.kernel32.dll_GetProcAddress
lea eax, [ecx*4]
mov ax, sp
mov eax, dword [esp]
bts ax, dx
xchg dword [esp], ebx
jmp 0x13273f9
add esi, 4
mov bh, dh
pop ecx
mov bl, byte [esp]
and bh, 0x17
jmp 0x1327348
pop ecx
mov cl, byte [esp]
lea ecx, [eax*4]
lea ebx, [ebx + ebp]
jmp 0x1327477
add esi, 0xc
mov eax, dword [esi]
pop esi
mov ecx, dword [esp]
mov bx, dx
jmp 0x13274cd
call fcn.0130e087
push esi
mov esi, ebp
jmp 0x132759e
add eax, esi
push ebx
push eax
jmp 0x132764e