Function at 0x67960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9caf0
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp + 0xc]
jbe 0x681ce
call fcn.00067800
mov dword [ebp - 0x2c], eax
xor esi, esi
cmp eax, esi
je 0x681ce
mov dword [ebp - 0x2b0], 0x690077
mov dword [ebp - 0x2ac], 0x6c006e
mov dword [ebp - 0x2a8], 0x67006f
mov dword [ebp - 0x2a4], 0x6e006f
mov dword [ebp - 0x2a0], 0x65002e
mov ebx, 0x650078
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x22c], 0x620077
mov dword [ebp - 0x228], 0x6d0065
mov dword [ebp - 0x224], 0x57005c
mov dword [ebp - 0x220], 0x6e0069
mov dword [ebp - 0x21c], 0x67004d
mov dword [ebp - 0x218], 0x74006d
mov dword [ebp - 0x214], 0x2e0052
mov ecx, 0x6c0064
mov dword [ebp - 0x210], ecx
mov eax, 0x6c
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0xf0], 0x710074
mov dword [ebp - 0xec], 0x650075
mov dword [ebp - 0xe8], 0x790072
mov edi, 0x64002e
mov dword [ebp - 0xe4], edi
mov edx, 0x6c006c
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0x270], 0x720070
mov dword [ebp - 0x26c], 0x66006f
mov dword [ebp - 0x268], 0x760073
mov dword [ebp - 0x264], 0x2e0063
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x28c], 0x650077
mov dword [ebp - 0x288], 0x740076
mov dword [ebp - 0x284], 0x700061
mov dword [ebp - 0x280], 0x2e0069
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x120], 0x690077
mov dword [ebp - 0x11c], 0x68006e
mov dword [ebp - 0x118], 0x740074
mov dword [ebp - 0x114], 0x2e0070
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x90], 0x650069
mov dword [ebp - 0x8c], 0x720066
mov dword [ebp - 0x88], 0x6d0061
mov dword [ebp - 0x84], 0x2e0065
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x158], 0x6d0069
mov dword [ebp - 0x154], 0x670061
mov dword [ebp - 0x150], 0x720065
mov dword [ebp - 0x14c], 0x730065
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x208], 0x720064
mov dword [ebp - 0x204], 0x760069
mov dword [ebp - 0x200], 0x720065
mov dword [ebp - 0x1fc], 0x5c0073
mov dword [ebp - 0x1f8], 0x75006c
mov dword [ebp - 0x1f4], 0x660061
mov dword [ebp - 0x1f0], 0x2e0073
mov dword [ebp - 0x1ec], 0x790073
mov dword [ebp - 0x1e8], 0x73
mov dword [ebp - 0x254], 0x720064
mov dword [ebp - 0x250], 0x760069
mov dword [ebp - 0x24c], 0x720065
mov dword [ebp - 0x248], 0x5c0073
mov dword [ebp - 0x244], 0x6c0066
mov dword [ebp - 0x240], 0x6d0074
mov dword [ebp - 0x23c], 0x720067
mov dword [ebp - 0x238], 0x73002e
mov dword [ebp - 0x234], 0x730079
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x1ac], 0x640061
mov dword [ebp - 0x1a8], 0x730074
mov dword [ebp - 0x1a4], 0x680063
mov dword [ebp - 0x1a0], 0x6d0065
mov dword [ebp - 0x19c], 0x2e0061
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x3c], 0x690063
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x190], 0x630073
mov dword [ebp - 0x18c], 0x650068
mov dword [ebp - 0x188], 0x730064
mov dword [ebp - 0x184], 0x630076
mov dword [ebp - 0x180], edi
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x1c8], 0x650073
mov dword [ebp - 0x1c4], 0x760072
mov dword [ebp - 0x1c0], 0x630069
mov dword [ebp - 0x1bc], 0x730065
mov dword [ebp - 0x1b8], 0x65002e
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x108], 0x750077
mov dword [ebp - 0x104], 0x750061
mov dword [ebp - 0x100], 0x6e0065
mov dword [ebp - 0xfc], 0x2e0067
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xd8], 0x690077
mov dword [ebp - 0xd4], 0x73006e
mov dword [ebp - 0xd0], 0x740061
mov dword [ebp - 0xcc], 0x65002e
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0x50], 0x730070
mov dword [ebp - 0x4c], 0x650068
mov dword [ebp - 0x48], 0x2e0064
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x64], 0x6d0071
mov dword [ebp - 0x60], 0x720067
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0xa8], 0x620074
mov dword [ebp - 0xa4], 0x730073
mov dword [ebp - 0xa0], 0x630076
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x78], 0x700067
mov dword [ebp - 0x74], 0x760073
mov dword [ebp - 0x70], 0x2e0063
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc0], 0x690064
mov dword [ebp - 0xbc], 0x73006d
mov dword [ebp - 0xb8], 0x6f006a
mov dword [ebp - 0xb4], 0x2e0062
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x13c], 0x650073
mov dword [ebp - 0x138], 0x750074
mov dword [ebp - 0x134], 0x610070
mov dword [ebp - 0x130], 0x690070
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x1e4], 0x610072
mov dword [ebp - 0x1e0], 0x610063
mov dword [ebp - 0x1dc], 0x650067
mov dword [ebp - 0x1d8], 0x74006e
mov eax, 0x65002e
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x174], 0x70006c
mov dword [ebp - 0x170], 0x73006b
mov dword [ebp - 0x16c], 0x740065
mov dword [ebp - 0x168], 0x700075
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], esi
call fcn.00055210
mov ecx, eax
mov dword [ebp - 0x28], ecx
cmp ecx, esi
je 0x681ce
xor eax, eax
mov dword [ebp - 0x24], eax
xor edx, edx
cmp dx, word [ecx]
je 0x67eff
inc eax
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x67ef3
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 8]
cmp esi, dword [ebx]
jae 0x681a0
mov edx, esi
imul edx, edx, 0x210
lea edi, [edx + ebx + 4]
mov dword [ebp + 0xc], edi
push eax
lea edx, [edi + 0x10]
mov eax, ecx
call fcn.0008efd0
test eax, eax
jne case.default.0x67f5d
mov eax, esi
imul eax, eax, 0x108
add eax, dword [ebp - 0x24]
mov edx, 0x5c
cmp dx, word [ebx + eax*2 + 0x14]
jne case.default.0x67f5d
mov ecx, dword [ebp - 0x2c]
dec ecx
cmp ecx, 3
ja case.default.0x67f5d
jmp dword [ecx*4 + 0x681e4]
lea edi, [ebx + eax*2 + 0x16]
mov eax, edi
lea ecx, [ebp - 0x2b0]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x22c]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0xf0]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x270]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x28c]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x208]
call fcn.0008f040
test eax, eax
je 0x68121
push edi
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x1ac]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x3c]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x190]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x1c8]
call fcn.0008f040
test eax, eax
je 0x68121
mov eax, edi
lea ecx, [ebp - 0x108]
call fcn.0008f040
test eax, eax
je 0x68121
push edi
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea edx, [ebp - 0x1e4]
push edx
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
je 0x68121
push edi
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
add esp, 8
test eax, eax
jne case.default.0x67f5d
dec dword [ebx]
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 1]
cmp esi, ecx
je 0x68190
sub eax, esi
dec eax
imul eax, eax, 0x210
push eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 0x210]
push edx
push eax
jmp 0x68188
lea ecx, [ebp - 0x158]
jmp 0x6815a
lea ecx, [ebp - 0x90]
jmp 0x6815a
lea ecx, [ebp - 0x120]
lea eax, [ebx + eax*2 + 0x16]
call fcn.0008f040
test eax, eax
jne case.default.0x67f5d
mov eax, dword [ebx]
dec eax
mov dword [ebx], eax
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 1]
cmp esi, ecx
je 0x68190
sub eax, esi
dec eax
imul eax, eax, 0x210
push eax
lea edx, [edi + 0x210]
push edx
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec esi
mov dword [ebp - 0x1c], esi
inc esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
jmp 0x67f05
mov dword [ebp - 4], 0xffffffff
jmp 0x681bc
push 0x877
call fcn.00049640
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8