Function at 0x70790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 0x27
mov ecx, 0xc0000001
mov dword [ebp - 0xc], 0x1000
call fcn.00049640
mov ebx, eax
test ebx, ebx
je 0x7098c
push 0x877
call fcn.00049640
push eax
mov eax, dword [ebp - 0xc]
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x70834
call dword [sym.imp.ntoskrnl.exe_KeGetCurrentThread]
mov edx, dword [ebp - 0xc]
push edx
push edi
push 0
push 0
push 0x560000
mov esi, eax
mov cl, byte [esi + ebx]
lea eax, [ebp - 0x24]
push eax
push 0
push 0
mov byte [ebp - 5], cl
mov ecx, dword [ebp + 8]
push 0
push ecx
mov byte [esi + ebx], 0
call dword [sym.imp.ntoskrnl.exe_NtDeviceIoControlFile]
mov dl, byte [ebp - 5]
mov edi, eax
mov byte [esi + ebx], dl
cmp edi, 0xc0000004
jne 0x70842
push 0x877
call fcn.00049640
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
shl dword [ebp - 0xc], 1
jmp 0x707b6
mov eax, 0xc000009a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ebx, ebx
cmp edi, ebx
jl 0x7096c
mov eax, dword [ebp - 0x10]
mov edx, 0x65
mov dword [ebp - 0x70], 0x3f005c
mov dword [ebp - 0x6c], 0x5c003f
mov dword [ebp - 0x68], 0x680050
mov dword [ebp - 0x64], 0x730079
mov dword [ebp - 0x60], 0x630069
mov dword [ebp - 0x5c], 0x6c0061
mov dword [ebp - 0x58], 0x720044
mov dword [ebp - 0x54], 0x760069
mov word [ebp - 0x50], dx
mov eax, dword [eax + 8]
mov edi, 0xc0000001
cmp eax, 0x1000
jae 0x7096c
push eax
lea ecx, [ebp - 0x4e]
push 0x9c3e4
push ecx
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0xc
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x100
push ebx
mov esi, dword [ebp + 0x10]
push ebx
push ebx
push ebx
push ebx
push 1
push 3
push 0x80
push ebx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0xc0000000
lea ecx, [ebp - 0x1c]
push esi
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov edi, eax
cmp edi, ebx
jl 0x7096c
push 2
call fcn.00088910
mov edx, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push ebx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [esi]
push ebx
mov byte [ebp + 8], al
mov eax, dword [edx]
push eax
push ebx
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edx, dword [ebp + 8]
push edx
push 2
mov edi, eax
call fcn.00088aa0
cmp edi, ebx
jl 0x7095e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 4], ebx
je 0x7095e
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x7096c
mov eax, dword [esi]
push eax
mov edi, 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x877
call fcn.00049640
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc