Function at 0x6ff10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x4a66
mov esi, eax
mov byte [ebp - 5], 0
call fcn.00049640
push 0x490a
mov ecx, eax
call fcn.00049640
mov edi, eax
test ecx, ecx
jne 0x6ffbd
lea eax, [ebp - 0x54]
mov dword [ebp - 0x1c], ecx
push eax
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x54], 0x6f0049
mov dword [ebp - 0x50], 0x650047
mov dword [ebp - 0x4c], 0x440074
mov dword [ebp - 0x48], 0x760065
mov dword [ebp - 0x44], 0x630069
mov dword [ebp - 0x40], 0x410065
mov dword [ebp - 0x3c], 0x740074
mov dword [ebp - 0x38], 0x630061
mov dword [ebp - 0x34], 0x6d0068
mov dword [ebp - 0x30], 0x6e0065
mov dword [ebp - 0x2c], 0x420074
mov dword [ebp - 0x28], 0x730061
mov dword [ebp - 0x24], 0x520065
mov dword [ebp - 0x20], 0x660065
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov ecx, eax
test edi, edi
jne 0x6ffc7
mov edi, dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test esi, esi
je 0x7015d
test ecx, ecx
je 0x7015d
test edi, edi
je 0x7015d
push esi
call ecx
test eax, eax
je 0x70143
mov esi, dword [eax + 8]
mov ecx, eax
mov dword [ebx], eax
mov dword [ebp - 0x10], esi
call edi
test esi, esi
je 0x7015d
mov eax, dword [esi + 0x18]
test eax, eax
je 0x7015d
mov edi, dword [eax]
mov dword [ebp - 0xc], edi
cmp esi, edi
jne 0x70031
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x74]
mov byte [ebp - 5], 1
mov dword [ebx + 8], eax
mov al, byte [ebp - 5]
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x7015d
push 0x100000
mov ecx, 1
call fcn.0008b8a0
mov esi, eax
test esi, esi
je 0x7015d
push 0x100000
push esi
mov dword [esi], 0
call fcn.00055e40
cmp al, 1
jne 0x70125
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebx + 4], edi
test eax, eax
je 0x700a7
mov edi, dword [edi + 0x30]
lea eax, [esi + 0x14]
lea esp, [esp]
mov edx, dword [eax]
cmp edi, edx
jbe 0x70092
mov ebx, dword [eax + 4]
add ebx, edx
cmp edi, ebx
mov ebx, dword [ebp + 8]
jb 0x7009e
inc ecx
add eax, 0x218
cmp ecx, dword [esi]
jb 0x70080
jmp 0x700a4
mov edx, dword [ebp - 0x10]
mov dword [ebx + 4], edx
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x30]
xor edx, edx
mov dword [ebx + 8], eax
cmp dword [esi], edx
jbe 0x700e4
mov ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 0x30]
lea eax, [esi + 0x14]
lea esp, [esp]
mov ecx, dword [eax]
cmp edi, ecx
jbe 0x700d2
mov ebx, dword [eax + 4]
add ebx, ecx
cmp edi, ebx
mov ebx, dword [ebp + 8]
jb 0x700de
inc edx
add eax, 0x218
cmp edx, dword [esi]
jb 0x700c0
jmp 0x700e1
mov dword [ebx + 8], edi
mov edi, dword [ebp - 0xc]
mov edx, dword [edi + 0x74]
mov dword [ebx + 0xc], edx
xor edx, edx
cmp dword [esi], edx
jbe 0x70121
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x74]
lea eax, [esi + 0x14]
lea esp, [esp]
mov ecx, dword [eax]
cmp edi, ecx
jbe 0x7010f
mov ebx, dword [eax + 4]
add ebx, ecx
cmp edi, ebx
jb 0x7011b
inc edx
add eax, 0x218
cmp edx, dword [esi]
jb 0x70100
jmp 0x70121
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], edi
mov byte [ebp - 5], 1
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
test eax, eax
je 0x7015d
mov edx, dword [eax + 0x30]
mov dword [ebx + 4], eax
mov eax, dword [eax + 0x74]
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], eax
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4