Function at 0x617765ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x74
push 0x61771b48
call fcn.6177b16c
mov eax, dword [0x6177d2e0]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
push ebx
push 0x61776301
push 0x61771b28
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov dword [0x6177d368], eax
cmp eax, ebx
je 0x617769c8
mov dword [0x6177d36c], 0x20
mov dword [0x6177d370], 2
call fcn.61776090
push ebx
push 0x61771b20
call sub.rtutils.dll_TraceRegisterExA
mov dword [0x6177d388], eax
mov dword [ebp - 4], ebx
push 0x6177d48c
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call edi
push 0x6177d3b8
call edi
or dword [ebp - 4], 0xffffffff
push 0x61771b04
call sub.rtutils.dll_RouterLogRegisterW
mov dword [0x6177d3a0], eax
push ebx
push 0x4e20
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x6177d39c], eax
cmp eax, ebx
jne 0x61776653
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x617769b5
call fcn.61776eb2
cmp eax, ebx
jne 0x617769b5
call fcn.61776090
push ebx
push ebx
push ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
call edi
mov dword [0x6177d4a8], eax
cmp eax, ebx
je 0x61776648
push 4
pop esi
mov dword [0x6177d370], esi
mov dword [0x6177d380], ebx
mov dword [0x6177d384], ebx
mov dword [0x6177d374], 7
call fcn.61776090
or dword [0x6177d3e4], 2
call fcn.61776ff6
cmp eax, ebx
jne 0x617769b5
push ebx
push ebx
push 1
push ebx
call edi
mov dword [0x6177d4b0], eax
cmp eax, ebx
je 0x61776648
cmp dword [0x6177d360], 2
je 0x617767c7
push ebx
push ebx
push 1
push ebx
call edi
mov dword [0x6177d4a4], eax
cmp eax, ebx
je 0x61776648
push ebx
push ebx
push ebx
push ebx
call edi
mov dword [0x6177d3e0], eax
cmp eax, ebx
je 0x61776648
call fcn.61777780
cmp eax, ebx
jne 0x617769b5
push 0x6177185c
call fcn.6177ae5f
mov edi, eax
cmp edi, ebx
jne 0x6177671a
push 0x7f
jmp 0x617769b6
push 0x6177172c
call fcn.6177ae5f
mov dword [ebp - 0x40], eax
cmp eax, ebx
je 0x61776713
mov dword [ebp - 0x84], 0x6177d400
mov eax, dword [0x6177d3e8]
mov dword [ebp - 0x80], eax
mov eax, dword [0x6177d364]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], 0x6177d36c
mov dword [ebp - 0x74], 0x6177d3e0
mov dword [ebp - 0x70], 0x6177d4a4
mov eax, dword [0x6177d388]
mov dword [ebp - 0x68], eax
mov eax, dword [0x6177d3a0]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], 0x6177d390
mov dword [ebp - 0x60], fcn.61775a5b
mov dword [ebp - 0x5c], fcn.617756bf
mov dword [ebp - 0x58], fcn.61775cb3
mov dword [ebp - 0x54], fcn.61775ce3
mov dword [ebp - 0x50], fcn.61775c2a
mov dword [ebp - 0x4c], fcn.61775733
mov dword [ebp - 0x48], 0x61779ed7
lea eax, [ebp - 0x84]
push eax
call edi
cmp eax, ebx
jne 0x617769b5
or dword [0x6177d3e4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
push 0x6177d3d0
call dword [sym.imp.ntdll.dll_RtlGetNtProductType]
push 0x6177d394
push ebx
call sub.MPRAPI.dll_MprConfigServerConnect
push dword [0x6177d364]
push ebx
call fcn.61778bc7
cmp eax, ebx
jne 0x617769b5
call fcn.6177aac7
cmp eax, ebx
jne 0x617769b5
or dword [0x6177d3e4], 8
xor eax, eax
cmp dword [0x6177d360], 2
sete al
push eax
call fcn.6177aa5c
cmp eax, ebx
jne 0x617769b5
xor esi, esi
inc esi
or dword [0x6177d3e4], esi
push 0x6177d3a8
call dword [sym.imp.ntdll.dll_RtlCreateTimerQueue]
test eax, eax
jne 0x6177685b
mov eax, 0x493e0
mov dword [0x6177d3b4], eax
push ebx
push ebx
push eax
push esi
push fcn.61779de7
push 0x6177d3ac
push dword [0x6177d3a8]
call dword [sym.imp.ntdll.dll_RtlCreateTimer]
push 0x6177d3d8
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
test byte [0x6177d3e4], 4
je 0x61776873
push ebx
call dword [ebp - 0x40]
push ebx
push esi
push esi
push 0x400
push dword [0x6177d368]
call sub.ADVAPI32.dll_I_ScSetServiceBitsW
test eax, eax
je 0x61776648
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c], 0x20
mov dword [ebp - 0x38], 5
mov esi, 0x61772cfc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
lea eax, [ebp - 0x3c]
push eax
push dword [0x6177d368]
call dword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov dword [0x6177d3b0], eax
cmp eax, ebx
jne 0x617768f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x61771ad4
push 0x10006
push dword [0x6177d388]
call sub.rtutils.dll_TracePrintfExA
add esp, 0x10
push esi
jmp 0x617769b6
push 1
call fcn.61775e5f
mov esi, 0x10006
cmp eax, ebx
je 0x61776919
push eax
push 0x61771a9c
push esi
push dword [0x6177d388]
call sub.rtutils.dll_TracePrintfExA
add esp, 0x10
push 1
call fcn.61776052
cmp eax, ebx
je 0x61776939
push eax
push 0x61771a58
push esi
push dword [0x6177d388]
call sub.rtutils.dll_TracePrintfExA
add esp, 0x10
push 0x61771a2c
push esi
push dword [0x6177d388]
call sub.rtutils.dll_TracePrintfExA
add esp, 0xc
or dword [0x6177d3e4], 0x10
xor esi, esi
cmp dword [0x6177d364], ebx
jbe 0x61776978
xor edi, edi
mov eax, dword [0x6177d3e8]
call dword [edi + eax + 0x18]
inc esi
add edi, 0x90
cmp esi, dword [0x6177d364]
jb 0x61776960
test byte [0x6177d360], 4
je 0x6177699c
push 0x21
call fcn.6177ae25
push 0x61771808
call fcn.6177ae5f
call eax
push dword [ebp - 0x44]
call fcn.61775733
push 0xffffffffffffffff
push dword [0x6177d4b0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x61776648
xor eax, eax
push eax
call fcn.617760bc
jmp 0x617769c8
mov ecx, dword [ebp - 0x1c]
call fcn.6177afa9
call fcn.6177b1a7
ret 8