Function at 0x5c9f1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x47aa20]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x34]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x110]
xor ebx, ebx
push eax
mov byte [ebp - 0x10], 0x5c
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x4e
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x5c
mov byte [ebp - 7], 0x25
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], bl
call sym.ntoskrnl.exe_sprintf
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x2d8]
push eax
call sym.ntoskrnl.exe_RtlInitAnsiString
push 1
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2d0]
push eax
call sym.ntoskrnl.exe_RtlAnsiStringToUnicodeString
test eax, eax
jl 0x5e1ccd
push esi
push 0x18
pop esi
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2b4]
push eax
push 0xf0001
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2a8], 0x40
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
call fcn.004b070c
test eax, eax
jl 0x5e1cd4
lea eax, [ebp - 0x290]
mov dword [ebp - 0x298], eax
push ebx
lea eax, [ebp - 0x29c]
push eax
push dword [ebp - 0x294]
mov word [ebp - 0x29c], bx
mov word [ebp - 0x29a], 0x80
call fcn.004b057d
test eax, eax
jl 0x5ca21a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x2b8], eax
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2bc]
push eax
mov word [ebp - 0x2bc], bx
mov word [ebp - 0x2ba], 0x100
call sym.ntoskrnl.exe_RtlUnicodeStringToAnsiString
movzx eax, word [ebp - 0x2bc]
push dword [ebp - 0x294]
mov byte [ebp + eax - 0x210], bl
call sym.ntoskrnl.exe_NtClose
lea eax, [ebp - 0x2d0]
push eax
call sym.ntoskrnl.exe_RtlFreeAnsiString
push 0x5ca21e
lea eax, [ebp - 0x2e0]
push eax
call sym.ntoskrnl.exe_RtlInitAnsiString
push 1
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x2c4]
push eax
call sym.ntoskrnl.exe_RtlAnsiStringToUnicodeString
test eax, eax
jl 0x5ca21a
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2b4]
push eax
push 0xf0001
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2a8], 0x40
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
call fcn.004b070c
test eax, eax
jl 0x5ca21a
push dword [ebp - 0x294]
call fcn.004cbc6e
push dword [ebp - 0x294]
call sym.ntoskrnl.exe_NtClose
push dword [edi + 0x3c]
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x110]
push 0x5ca22a
push eax
call sym.ntoskrnl.exe_sprintf
add esp, 0x10
lea eax, [ebp - 0x2bc]
push eax
push dword [ebp - 0x2c8]
call sym.ntoskrnl.exe_RtlCopyString
lea eax, [ebp - 0x110]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5ca15d
sub eax, edi
mov byte [ebp + eax - 0x111], bl
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x2d8]
push eax
call sym.ntoskrnl.exe_RtlInitAnsiString
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2ac], eax
push 1
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x29c]
push eax
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2a8], 0x50
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
call sym.ntoskrnl.exe_RtlAnsiStringToUnicodeString
test eax, eax
jl 0x5ca21a
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2b4]
push eax
push 0xf0001
lea eax, [ebp - 0x294]
push eax
call fcn.004cb7b0
lea eax, [ebp - 0x29c]
push eax
call sym.ntoskrnl.exe_RtlFreeAnsiString
lea eax, [ebp - 0x2c4]
push eax
call sym.ntoskrnl.exe_RtlFreeAnsiString
push dword [ebp - 0x294]
call sym.ntoskrnl.exe_NtClose
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0040d8f1
leave
ret 8
xor al, al
jmp 0x5ca20b
xor al, al
jmp 0x5ca20c
lea eax, [ebp - 0x2d0]
push eax
call sym.ntoskrnl.exe_RtlFreeAnsiString
jmp 0x5ca21a