Function at 0x3f000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push edi
push 1
xor bl, bl
call fcn.00049640
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x3f5c3
mov eax, 0x790073
mov edx, 0x73002e
mov ecx, 0x730079
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x94], edi
mov dword [ebp - 0xf4], edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x110], edi
mov edi, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov dword [ebp - 0xc8], eax
push esi
mov esi, 0x73
mov eax, 0x1770
mov dword [ebp - 0x54], 0x640063
mov dword [ebp - 0x50], 0x6f0072
mov dword [ebp - 0x4c], 0x2e006d
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x7c], 0x690064
mov dword [ebp - 0x78], 0x6b0073
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0xa8], 0x640057
mov dword [ebp - 0xa4], 0x4c0066
mov dword [ebp - 0xa0], 0x720064
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x10c], 0x640057
mov dword [ebp - 0x108], 0x300066
mov dword [ebp - 0x104], 0x300031
mov dword [ebp - 0x100], 0x300030
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0x68], 0x700069
mov dword [ebp - 0x64], 0x650073
mov dword [ebp - 0x60], 0x2e0063
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x148], 0x700069
mov dword [ebp - 0x144], 0x6c0066
mov dword [ebp - 0x140], 0x640074
mov dword [ebp - 0x13c], 0x760072
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x90], 0x70006e
mov dword [ebp - 0x8c], 0x730066
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x40], 0x73006d
mov dword [ebp - 0x3c], 0x730066
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0x660061
mov dword [ebp - 0x28], 0x2e0064
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xf0], 0x730075
mov dword [ebp - 0xec], 0x700062
mov dword [ebp - 0xe8], 0x72006f
mov dword [ebp - 0xe4], 0x2e0074
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0x128], 0x380069
mov dword [ebp - 0x124], 0x340030
mov dword [ebp - 0x120], 0x700032
mov dword [ebp - 0x11c], 0x740072
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0xd8], 0x610070
mov dword [ebp - 0xd4], 0x740072
mov dword [ebp - 0xd0], 0x67006d
mov dword [ebp - 0xcc], 0x2e0072
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
cmp word [edi], ax
jae 0x3f24b
mov dword [ebp - 0x1c], 0x740066
mov dword [ebp - 0x18], 0x690064
mov dword [ebp - 0x14], 0x6b0073
jmp 0x3f260
mov dword [ebp - 0x1c], 0x6f0076
mov dword [ebp - 0x18], 0x6d006c
mov dword [ebp - 0x14], 0x720067
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xac], esi
mov esi, dword [eax]
mov dword [ebp - 0xc0], 0x6f0076
mov dword [ebp - 0xbc], 0x73006c
mov dword [ebp - 0xb8], 0x61006e
mov dword [ebp - 0xb4], 0x2e0070
mov dword [ebp - 0xb0], 0x790073
mov dword [ebp - 4], eax
cmp eax, esi
je 0x3f5ba
jmp 0x3f2b0
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp esi, dword [edx]
jbe 0x3f5ba
mov edi, dword [esi + 0x30]
test edi, edi
je 0x3f5af
cmp dword [esi + 0x28], 0
je 0x3f5af
movzx eax, word [esi + 0x2c]
mov ecx, 0xe
cmp cx, ax
jne 0x3f311
push 7
mov edx, edi
lea eax, [ebp - 0x2c]
call fcn.0008efd0
test eax, eax
jne 0x3f5af
mov edx, dword [esi + 0x18]
push edx
push 0x8d6
call fcn.00049620
mov eax, dword [esi + 0x20]
push eax
push 0x8d7
jmp 0x3f5a8
mov ecx, 0x10
cmp cx, ax
jne 0x3f3aa
push 8
mov edx, edi
lea eax, [ebp - 0x7c]
call fcn.0008efd0
test eax, eax
jne 0x3f34b
mov edx, dword [esi + 0x18]
push edx
push 0x8a8
call fcn.00049620
mov eax, dword [esi + 0x20]
push eax
push 0x8a9
jmp 0x3f5a8
push 8
mov edx, edi
lea eax, [ebp - 0x90]
call fcn.0008efd0
test eax, eax
jne 0x3f37a
mov ecx, dword [esi + 0x18]
push ecx
push 0x8d0
call fcn.00049620
mov edx, dword [esi + 0x20]
push edx
push 0x8d1
jmp 0x3f5a8
push 8
mov edx, edi
lea eax, [ebp - 0x40]
call fcn.0008efd0
test eax, eax
jne 0x3f5af
mov eax, dword [esi + 0x18]
push eax
push 0x8d3
call fcn.00049620
mov ecx, dword [esi + 0x20]
push ecx
push 0x8d4
jmp 0x3f5a8
mov edx, 0x12
cmp dx, ax
jne 0x3f410
push 9
mov edx, edi
lea eax, [ebp - 0x54]
call fcn.0008efd0
test eax, eax
jne 0x3f3e0
mov eax, dword [esi + 0x18]
push eax
push 0x8aa
call fcn.00049620
mov ecx, dword [esi + 0x20]
push ecx
push 0x8ab
jmp 0x3f5a8
push 9
mov edx, edi
lea eax, [ebp - 0x68]
call fcn.0008efd0
test eax, eax
jne 0x3f5af
mov edx, dword [esi + 0x18]
push edx
push 0x8c1
call fcn.00049620
mov eax, dword [esi + 0x20]
push eax
push 0x8c2
jmp 0x3f5a8
mov ecx, 0x14
cmp cx, ax
jne 0x3f479
push 0xa
mov edx, edi
lea eax, [ebp - 0xa8]
call fcn.0008efd0
test eax, eax
jne 0x3f449
mov edx, dword [esi + 0x18]
push edx
push 0x8ac
call fcn.00049620
mov eax, dword [esi + 0x20]
push eax
push 0x8ad
jmp 0x3f5a8
push 0xa
mov edx, edi
lea eax, [ebp - 0x1c]
call fcn.0008efd0
test eax, eax
jne 0x3f5af
mov ecx, dword [esi + 0x18]
push ecx
push 0x902
call fcn.00049620
mov edx, dword [esi + 0x20]
push edx
push 0x903
jmp 0x3f5a8
mov ecx, 0x16
cmp cx, ax
jne 0x3f518
push 0xb
mov edx, edi
lea eax, [ebp - 0xf0]
call fcn.0008efd0
test eax, eax
jne 0x3f4b6
mov edx, dword [esi + 0x18]
push edx
push 0x8da
call fcn.00049620
mov eax, dword [esi + 0x20]
push eax
push 0x8db
jmp 0x3f5a8
push 0xb
mov edx, edi
lea eax, [ebp - 0xd8]
call fcn.0008efd0
test eax, eax
jne 0x3f4e5
mov ecx, dword [esi + 0x18]
push ecx
push 0x8e0
call fcn.00049620
mov edx, dword [esi + 0x20]
push edx
push 0x8e1
jmp 0x3f5a8
push 0xb
mov edx, edi
lea eax, [ebp - 0xc0]
call fcn.0008efd0
test eax, eax
jne 0x3f5af
mov eax, dword [esi + 0x18]
push eax
push 0x905
call fcn.00049620
mov ecx, dword [esi + 0x20]
push ecx
push 0x906
jmp 0x3f5a8
mov edx, 0x18
cmp dx, ax
jne 0x3f5af
push 0xc
mov edx, edi
lea eax, [ebp - 0x10c]
call fcn.0008efd0
test eax, eax
jne 0x3f552
mov eax, dword [esi + 0x18]
push eax
push 0x8ae
call fcn.00049620
mov ecx, dword [esi + 0x20]
push ecx
push 0x8af
jmp 0x3f5a8
push 0xc
mov edx, edi
lea eax, [ebp - 0x148]
call fcn.0008efd0
test eax, eax
jne 0x3f57e
mov edx, dword [esi + 0x18]
push edx
push 0x8c4
call fcn.00049620
mov eax, dword [esi + 0x20]
push eax
push 0x8c5
jmp 0x3f5a8
push 0xc
mov edx, edi
lea eax, [ebp - 0x128]
call fcn.0008efd0
test eax, eax
jne 0x3f5af
mov ecx, dword [esi + 0x18]
push ecx
push 0x8dd
call fcn.00049620
mov edx, dword [esi + 0x20]
push edx
push 0x8de
call fcn.00049620
mov bl, 1
mov esi, dword [esi]
cmp dword [ebp - 4], esi
jne 0x3f2b0
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret