Function at 0xa140a512
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x690
mov eax, dword [0xa1411fb0]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x660], eax
xor eax, eax
mov esi, 0xa140a4e8
lea edi, [ebp - 0x23c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7f
pop ecx
lea edi, [ebp - 0x232]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0xa140a4f4]
mov dword [ebp - 0x34], eax
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x65c], bx
lea edi, [ebp - 0x65a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x678], ebx
lea edi, [ebp - 6]
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], bl
stosw word es:[edi], ax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x648], ebx
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
lea edi, [ebp - 0x68c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xffdf0030
stosd dword es:[edi], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x64c], ebx
call fcn.a1405112
push 0xa140a4f8
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.a1405112
xor eax, eax
movsx cx, byte [ebp + eax - 0x10]
mov word [ebp + eax*2 - 0x32], cx
inc eax
cmp eax, 0xa
jb 0xa140a616
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.a1405112
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.ntoskrnl.exe_Ordinal_22150]
push 0x18
pop esi
push ebx
push ebx
push 0x20
push 1
push 1
push 0x80
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x670], eax
push ebx
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x678]
push eax
push 0x80000000
lea eax, [ebp - 0x640]
push eax
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x66c], 0x240
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x664], ebx
call dword [sym.imp.ntoskrnl.exe_Ordinal_22694]
cmp eax, ebx
jl 0xa140a7c8
push 5
push esi
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x648]
push eax
push dword [ebp - 0x640]
call dword [sym.imp.ntoskrnl.exe_Ordinal_22668]
cmp eax, ebx
jge 0xa140a6db
mov ebx, eax
jmp 0xa140a7ba
mov eax, dword [ebp - 0x688]
push 0x70466266
push eax
push 1
mov dword [ebp - 0x650], eax
call dword [sym.imp.ntoskrnl.exe_Ordinal_21076]
cmp eax, ebx
mov ecx, dword [ebp - 0x654]
mov dword [ecx], eax
jne 0xa140a74d
mov ebx, 0xc0000001
jmp 0xa140a7ba
mov ecx, dword [ebp - 0x644]
cmp ecx, ebx
je 0xa140a784
mov eax, dword [ebp - 0x654]
mov edi, dword [eax]
mov eax, dword [ebp - 0x64c]
mov edx, ecx
shr ecx, 2
add edi, eax
lea esi, [ebp - 0x63c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, dword [ebp - 0x644]
cmp eax, dword [ebp - 0x650]
mov dword [ebp - 0x64c], eax
jae 0xa140a7ac
push ebx
push ebx
xor eax, eax
push 0x400
lea edi, [ebp - 0x63c]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x648]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x640]
call dword [sym.imp.ntoskrnl.exe_Ordinal_22654]
test eax, eax
je 0xa140a70b
mov eax, dword [ebp - 0x650]
cmp dword [ebp - 0x64c], eax
jae 0xa140a7ac
mov esi, dword [ebp - 0x654]
push 0x70466266
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_Ordinal_21100]
mov dword [esi], ebx
jmp 0xa140a701
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0x650]
mov dword [eax], ecx
push dword [ebp - 0x640]
call dword [sym.imp.ntoskrnl.exe_Ordinal_22256]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.a140e6a2
leave
ret 8