Function at 0x561fb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
xor ebx, ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x562366
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp + 8], 0
je 0x562007
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x562053
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x444]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0x448], 0
lea edx, [ebp - 0x44c]
xor ecx, ecx
mov eax, 0x562380
call fcn.0040bf48
mov eax, dword [ebp - 0x444]
call fcn.0040574c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x56233d
lea eax, [ebp - 0x440]
xor ecx, ecx
mov edx, 0x420
call fcn.00403464
mov dword [ebp - 0x440], 0x1c
mov byte [ebp - 0x43c], 0x33
mov byte [ebp - 0x43b], 0x77
mov byte [ebp - 0x43a], 0x61
mov byte [ebp - 0x439], 0x72
mov byte [ebp - 0x438], 0x65
mov byte [ebp - 0x437], 0x20
mov byte [ebp - 0x436], 0x20
mov byte [ebp - 0x435], 0
mov dword [ebp - 0x434], 0xa
xor eax, eax
mov dword [ebp - 0x430], eax
xor eax, eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0x404
mov byte [ebp - 0x420], 0xb1
mov byte [ebp - 0x41f], 5
mov byte [ebp - 0x41e], 0xff
mov al, byte [ebp - 8]
and al, 0xff
mov byte [ebp - 0x41d], al
mov byte [ebp - 0x41c], 0
mov byte [ebp - 0x41b], 1
mov byte [ebp - 0x41a], 0xd
mov byte [ebp - 0x419], 0
mov byte [ebp - 0x418], 0xd0
mov byte [ebp - 0x417], 0
mov byte [ebp - 0x416], 1
mov byte [ebp - 0x415], 0
mov byte [ebp - 0x414], 0
mov byte [ebp - 0x413], 0
mov byte [ebp - 0x412], 0x4f
mov byte [ebp - 0x411], 0
mov byte [ebp - 0x410], 0xc2
mov byte [ebp - 0x40f], 0
mov byte [ebp - 0x40e], 0
mov byte [ebp - 0x40d], 0xb0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x4d008
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x5621e1
lea eax, [ebp - 0x220]
cmp dword [eax], 0
jne 0x5621c5
lea eax, [ebp - 0x21c]
cmp dword [eax], 0
jne 0x5621c5
lea eax, [ebp - 0x218]
cmp dword [eax], 0
jne 0x5621c5
lea eax, [ebp - 0x214]
cmp dword [eax], 0
je 0x56232e
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x220]
mov ecx, 0x200
call fcn.00402a80
jmp 0x56232e
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x454]
call fcn.0040a878
mov ecx, dword [ebp - 0x454]
lea eax, [ebp - 0x450]
mov edx, 0x562394
call fcn.00405598
mov eax, dword [ebp - 0x450]
call fcn.004c938c
call fcn.0057dc90
test al, al
je 0x56232e
lea eax, [ebp - 0x1f]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1e]
lea edx, [ebp - 0x1d]
mov eax, dword [ebp - 0x18]
call fcn.005dd9c8
test al, al
je 0x56232e
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x5623a8
lea edx, [ebp - 0x45c]
xor eax, eax
mov al, byte [ebp - 0x1d]
call fcn.0040a78c
push dword [ebp - 0x45c]
push 0x5623bc
lea eax, [ebp - 0x458]
mov edx, 3
call fcn.0040560c
mov eax, dword [ebp - 0x458]
call fcn.0040574c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x1c], eax
mov eax, 0x5623c8
call fcn.004c938c
cmp dword [ebp - 0x1c], 0xffffffff
je 0x56232e
mov eax, 0x5623dc
call fcn.004c938c
push 0
lea eax, [ebp - 0x14]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x4d008
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x562325
lea eax, [ebp - 0x220]
cmp dword [eax], 0
jne 0x56230e
lea eax, [ebp - 0x21c]
cmp dword [eax], 0
jne 0x56230e
lea eax, [ebp - 0x218]
cmp dword [eax], 0
jne 0x56230e
lea eax, [ebp - 0x214]
cmp dword [eax], 0
je 0x562325
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x220]
mov ecx, 0x200
call fcn.00402a80
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp + 8], 0
jne 0x56233d
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56236d
lea eax, [ebp - 0x45c]
mov edx, 4
call fcn.004052b0
lea eax, [ebp - 0x444]
call fcn.0040528c
ret