Function at 0x4e69cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
xor ebx, ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e6d7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp + 8], 0
je 0x4e6a1f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x4e6a6b
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x444]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0x448], 0
lea edx, [ebp - 0x44c]
xor ecx, ecx
mov eax, 0x4e6d98
call fcn.0040b8b4
mov eax, dword [ebp - 0x444]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4e6d55
lea eax, [ebp - 0x440]
xor ecx, ecx
mov edx, 0x420
call fcn.0040345c
mov dword [ebp - 0x440], 0x1c
mov byte [ebp - 0x43c], 0x33
mov byte [ebp - 0x43b], 0x77
mov byte [ebp - 0x43a], 0x61
mov byte [ebp - 0x439], 0x72
mov byte [ebp - 0x438], 0x65
mov byte [ebp - 0x437], 0x20
mov byte [ebp - 0x436], 0x20
mov byte [ebp - 0x435], 0
mov dword [ebp - 0x434], 0xa
xor eax, eax
mov dword [ebp - 0x430], eax
xor eax, eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0x404
mov byte [ebp - 0x420], 0xb1
mov byte [ebp - 0x41f], 5
mov byte [ebp - 0x41e], 0xff
mov al, byte [ebp - 8]
and al, 0xff
mov byte [ebp - 0x41d], al
mov byte [ebp - 0x41c], 0
mov byte [ebp - 0x41b], 1
mov byte [ebp - 0x41a], 0xd
mov byte [ebp - 0x419], 0
mov byte [ebp - 0x418], 0xd0
mov byte [ebp - 0x417], 0
mov byte [ebp - 0x416], 1
mov byte [ebp - 0x415], 0
mov byte [ebp - 0x414], 0
mov byte [ebp - 0x413], 0
mov byte [ebp - 0x412], 0x4f
mov byte [ebp - 0x411], 0
mov byte [ebp - 0x410], 0xc2
mov byte [ebp - 0x40f], 0
mov byte [ebp - 0x40e], 0
mov byte [ebp - 0x40d], 0xb0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x4d008
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4e6bf9
lea eax, [ebp - 0x220]
cmp dword [eax], 0
jne 0x4e6bdd
lea eax, [ebp - 0x21c]
cmp dword [eax], 0
jne 0x4e6bdd
lea eax, [ebp - 0x218]
cmp dword [eax], 0
jne 0x4e6bdd
lea eax, [ebp - 0x214]
cmp dword [eax], 0
je 0x4e6d46
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x220]
mov ecx, 0x200
call fcn.00402a8c
jmp 0x4e6d46
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x454]
call fcn.0040a3c4
mov ecx, dword [ebp - 0x454]
lea eax, [ebp - 0x450]
mov edx, 0x4e6dac
call fcn.00405414
mov eax, dword [ebp - 0x450]
call fcn.0049839c
call fcn.004fd520
test al, al
je 0x4e6d46
lea eax, [ebp - 0x1f]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1e]
lea edx, [ebp - 0x1d]
mov eax, dword [ebp - 0x18]
call fcn.00525490
test al, al
je 0x4e6d46
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x4e6dc0
lea edx, [ebp - 0x45c]
xor eax, eax
mov al, byte [ebp - 0x1d]
call fcn.0040a2d8
push dword [ebp - 0x45c]
push 0x4e6dd4
lea eax, [ebp - 0x458]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x458]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x1c], eax
mov eax, 0x4e6de0
call fcn.0049839c
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4e6d46
mov eax, 0x4e6df4
call fcn.0049839c
push 0
lea eax, [ebp - 0x14]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x4d008
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4e6d3d
lea eax, [ebp - 0x220]
cmp dword [eax], 0
jne 0x4e6d26
lea eax, [ebp - 0x21c]
cmp dword [eax], 0
jne 0x4e6d26
lea eax, [ebp - 0x218]
cmp dword [eax], 0
jne 0x4e6d26
lea eax, [ebp - 0x214]
cmp dword [eax], 0
je 0x4e6d3d
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x220]
mov ecx, 0x200
call fcn.00402a8c
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp + 8], 0
jne 0x4e6d55
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6d85
lea eax, [ebp - 0x45c]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0x444]
call fcn.00405108
ret