Function at 0x54d80
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
push ebx
push esi
push edi
xor edi, edi
push 0x877
mov dword [esp + 0x24], edi
call fcn.00049640
push eax
push 0x20a
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x551f8
push 0x20a
push edi
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 1
push 0xffdf0030
call fcn.00071e70
cmp al, 1
jne 0x54eb2
mov eax, 0x3a
cmp ax, word [0xffdf0032]
jne 0x54eb2
mov ecx, 0x5c
cmp cx, word [0xffdf0034]
jne 0x54eb2
mov ecx, 0xffdf0032
sub ecx, esi
mov dword [esp + 0xc], ecx
mov ecx, 0xffdf0034
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, 0xffdf0036
sub ecx, esi
mov dword [esp + 0x10], ecx
mov edi, 0xffdf0030
mov ecx, 0xffdf002e
xor edx, edx
sub edi, esi
sub ecx, esi
lea eax, [esi + 2]
mov dword [esp + 0x14], ecx
jmp 0x54e44
mov ecx, dword [esp + 0x14]
movzx ecx, word [eax + ecx]
xor ebx, ebx
mov word [eax - 2], cx
cmp bx, cx
je 0x54ea0
movzx ecx, word [edi + eax]
mov word [eax], cx
cmp bx, cx
je 0x54ea0
mov ecx, dword [esp + 0xc]
movzx ecx, word [ecx + eax]
mov word [eax + 2], cx
cmp bx, cx
je 0x54ea0
mov ecx, dword [esp + 0x18]
movzx ecx, word [ecx + eax]
mov word [eax + 4], cx
cmp bx, cx
je 0x54ea0
mov ecx, dword [esp + 0x10]
movzx ecx, word [ecx + eax]
mov word [eax + 6], cx
cmp bx, cx
je 0x54ea0
add edx, 5
add eax, 0xa
cmp edx, 0x104
jb 0x54e40
xor edx, edx
mov word [esi + 0x208], dx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20a
push 0
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x4904
call fcn.00049640
push 0x48c2
mov edi, eax
call fcn.00049640
mov ecx, eax
push 0x491c
mov dword [esp + 0x50], ecx
call fcn.00049640
push 0x4922
mov ebx, eax
call fcn.00049640
mov edx, eax
push 0x4925
mov dword [esp + 0x4c], edx
call fcn.00049640
push 0x4928
mov dword [esp + 0x34], eax
call fcn.00049640
push 0x48ad
mov dword [esp + 0x14], eax
call fcn.00049640
push 0x490a
mov dword [esp + 0x3c], eax
call fcn.00049640
push 0x4916
mov dword [esp + 0x1c], eax
call fcn.00049640
push 0x4a1b
mov dword [esp + 0x40], eax
call fcn.00049640
mov dword [esp + 0xc], eax
test edi, edi
je 0x551db
test ecx, ecx
je 0x551db
test ebx, ebx
je 0x551db
test edx, edx
je 0x551db
cmp dword [esp + 0x30], 0
je 0x551db
cmp dword [esp + 0x10], 0
je 0x551db
cmp dword [esp + 0x38], 0
je 0x551db
cmp dword [esp + 0x18], 0
je 0x551db
test eax, eax
je 0x551db
cmp dword [esp + 0x3c], 0
je 0x551db
push 0x877
call fcn.00049640
push eax
push 0x20a
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x14], eax
test eax, eax
je 0x551db
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x78], 0x53005c
mov dword [esp + 0x7c], 0x730079
mov dword [esp + 0x80], 0x650074
mov dword [esp + 0x84], 0x52006d
mov dword [esp + 0x88], 0x6f006f
mov dword [esp + 0x8c], 0x74
call edi
push 0x100
xor edi, edi
push edi
push edi
push edi
push edi
push 0x21
push 1
push 3
push edi
push edi
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x94]
push ecx
mov dword [esp + 0x88], edx
push 0x100000
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x88], 0x18
mov dword [esp + 0x8c], edi
mov dword [esp + 0x94], 0x240
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
call ebx
test eax, eax
js 0x551c9
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx]
push edi
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x34]
push edi
push edx
push 1
push eax
call dword [esp + 0x50]
test eax, eax
js 0x551c0
mov eax, dword [esp + 0x1c]
cmp dword [eax + 4], edi
je 0x551b8
mov ecx, dword [eax + 4]
call fcn.0008aba0
cmp al, 1
jne 0x551b8
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [esp + 0x50]
test eax, eax
js 0x551b8
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x551b8
push eax
call dword [esp + 0x50]
cmp al, 1
jne 0x551b8
mov eax, dword [esp + 0x24]
lea ecx, [eax - 1]
mov edx, 0x206
cmp cx, dx
ja 0x551ac
test al, 1
jne 0x551ac
lea eax, [esp + 0x50]
push eax
push 1
lea ecx, [esp + 0x3c]
push ecx
call dword [esp + 0x3c]
test eax, eax
js 0x551ac
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x44]
push ecx
push edx
mov dword [esp + 0x4c], 0x2080000
mov dword [esp + 0x50], edi
call dword [esp + 0x1c]
test eax, eax
js 0x551a1
movzx eax, word [esp + 0x40]
shr eax, 1
xor ecx, ecx
mov edx, edi
mov word [edi + eax*2], cx
call fcn.0008f0a0
mov edi, eax
test edi, edi
je 0x551a1
xor edx, edx
cmp dx, word [edi + 2]
je 0x551a1
movzx eax, word [esp + 0x24]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push esi
call sub.ntoskrnl.exe_memcpy
movzx eax, word [esp + 0x30]
shr eax, 1
add esp, 0xc
mov edx, 0x104
sub edx, eax
push edx
push edi
lea eax, [esi + eax*2]
call fcn.0008f180
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x34]
push eax
call dword [esp + 0x10]
xor edi, edi
mov ecx, dword [esp + 0x28]
push edi
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [esp + 0x1c]
call dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
push edx
call dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push eax
call fcn.0008b8c0
mov eax, dword [esp + 0x20]
cmp eax, edi
jne 0x551fa
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret