Function at 0x47ed30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2926
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
movdqa xmm0, xmmword [0x64e4f0]
lea ecx, [ebp - 0xac]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x14]
movdqu xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0xb8], eax
xor eax, eax
movdqa xmm0, xmmword [0x64e2e0]
movdqu xmmword [ebp - 0x8c], xmm0
mov word [ebp - 0x44], ax
movdqa xmm0, xmmword [0x64e030]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x9c]
movdqu xmmword [ebp - 0x7c], xmm0
push eax
movdqa xmm0, xmmword [str.Win32_BaseBoard]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0x4c5157
movdqu xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0x650053
mov dword [ebp - 0x58], 0x690072
mov dword [ebp - 0x54], 0x6c0061
mov dword [ebp - 0x50], 0x75004e
mov dword [ebp - 0x4c], 0x62006d
mov dword [ebp - 0x48], 0x720065
mov dword [ebp - 0x24], 0x720050
mov dword [ebp - 0x20], 0x64006f
mov dword [ebp - 0x1c], 0x630075
mov dword [ebp - 0x18], 0x74
mov dword [ebp - 0x40], 0x61004d
mov dword [ebp - 0x3c], 0x75006e
mov dword [ebp - 0x38], 0x610066
mov dword [ebp - 0x34], 0x740063
mov dword [ebp - 0x30], 0x720075
mov dword [ebp - 0x2c], 0x720065
call fcn.00464750
mov esi, eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xb4]
call fcn.00464750
mov byte [ebp - 4], 1
mov edx, dword [esi]
test edx, edx
je 0x47ee77
mov edx, dword [edx]
jmp 0x47ee79
xor edx, edx
mov eax, dword [eax]
test eax, eax
je 0x47ee83
mov ecx, dword [eax]
jmp 0x47ee85
xor ecx, ecx
mov eax, dword [edi]
lea esi, [ebp - 0xa4]
push esi
push 0
push 0x30
push edx
push ecx
push edi
call dword [eax + 0x50]
mov esi, dword [ebp - 0xb4]
mov edi, eax
mov edx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test esi, esi
je 0x47eefb
lea ecx, [esi + 8]
push ecx
call edx
test eax, eax
jne 0x47eeeb
test esi, esi
je 0x47eeeb
mov eax, dword [esi]
test eax, eax
je 0x47eecb
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47eee2
push eax
call fcn.0049a336
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0049a336
add esp, 4
mov edx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0xac]
test esi, esi
je 0x47ef4d
lea eax, [esi + 8]
push eax
call edx
test eax, eax
jne 0x47ef4d
test esi, esi
je 0x47ef4d
mov eax, dword [esi]
test eax, eax
je 0x47ef2d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47ef44
push eax
call fcn.0049a336
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0049a336
add esp, 4
test edi, edi
jns 0x47ef68
push 0x669730
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], edi
push eax
call fcn.005c840b
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xb0], 0
test ecx, ecx
je 0x47f101
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ecx]
lea edx, [ebp - 0xb0]
push edx
lea edx, [ebp - 0xa0]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0xb0], 0
je 0x47f0fb
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0xcc]
push 0
push 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x5c]
push 0
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x47f019
cmp word [ebp - 0xcc], 8
jne 0x47f019
push dword [ebp - 0xc4]
call edi
cmp eax, 0x200
jae 0x47f010
push 0x200
push dword [ebp - 0xc4]
push ebx
call fcn.005c5622
add esp, 0xc
or dword [0x6803c8], 4
lea eax, [ebp - 0xcc]
push eax
call esi
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0xec]
push 0
push 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push 0
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x47f07c
cmp word [ebp - 0xec], 8
jne 0x47f07c
push dword [ebp - 0xe4]
call edi
cmp eax, 0x200
jae 0x47f073
push 0x200
push dword [ebp - 0xe4]
push dword [ebp - 0xbc]
call fcn.005c5622
add esp, 0xc
or dword [0x6803c8], 2
lea eax, [ebp - 0xec]
push eax
call esi
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0xdc]
push 0
push 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x40]
push 0
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x47f0df
cmp word [ebp - 0xdc], 8
jne 0x47f0df
push dword [ebp - 0xd4]
call edi
cmp eax, 0x200
jae 0x47f0d6
push 0x200
push dword [ebp - 0xd4]
push dword [ebp - 0xb8]
call fcn.005c5622
add esp, 0xc
or dword [0x6803c8], 1
lea eax, [ebp - 0xdc]
push eax
call esi
mov eax, dword [ebp - 0xa0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0xa4]
test ecx, ecx
jne 0x47ef96
jmp 0x47f101
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret