Function at 0x554d88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
xor ebx, ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55513a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp + 8], 0
je 0x554ddb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x554e27
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x444]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0x448], 0
lea edx, [ebp - 0x44c]
xor ecx, ecx
mov eax, 0x555154
call fcn.0040beb0
mov eax, dword [ebp - 0x444]
call fcn.00405748
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x555111
lea eax, [ebp - 0x440]
xor ecx, ecx
mov edx, 0x420
call fcn.00403450
mov dword [ebp - 0x440], 0x1c
mov byte [ebp - 0x43c], 0x33
mov byte [ebp - 0x43b], 0x77
mov byte [ebp - 0x43a], 0x61
mov byte [ebp - 0x439], 0x72
mov byte [ebp - 0x438], 0x65
mov byte [ebp - 0x437], 0x20
mov byte [ebp - 0x436], 0x20
mov byte [ebp - 0x435], 0
mov dword [ebp - 0x434], 0xa
xor eax, eax
mov dword [ebp - 0x430], eax
xor eax, eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0x404
mov byte [ebp - 0x420], 0xb1
mov byte [ebp - 0x41f], 5
mov byte [ebp - 0x41e], 0xff
mov al, byte [ebp - 8]
and al, 0xff
mov byte [ebp - 0x41d], al
mov byte [ebp - 0x41c], 0
mov byte [ebp - 0x41b], 1
mov byte [ebp - 0x41a], 0xd
mov byte [ebp - 0x419], 0
mov byte [ebp - 0x418], 0xd0
mov byte [ebp - 0x417], 0
mov byte [ebp - 0x416], 1
mov byte [ebp - 0x415], 0
mov byte [ebp - 0x414], 0
mov byte [ebp - 0x413], 0
mov byte [ebp - 0x412], 0x4f
mov byte [ebp - 0x411], 0
mov byte [ebp - 0x410], 0xc2
mov byte [ebp - 0x40f], 0
mov byte [ebp - 0x40e], 0
mov byte [ebp - 0x40d], 0xb0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x4d008
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x554fb5
lea eax, [ebp - 0x220]
cmp dword [eax], 0
jne 0x554f99
lea eax, [ebp - 0x21c]
cmp dword [eax], 0
jne 0x554f99
lea eax, [ebp - 0x218]
cmp dword [eax], 0
jne 0x554f99
lea eax, [ebp - 0x214]
cmp dword [eax], 0
je 0x555102
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x220]
mov ecx, 0x200
call fcn.00402a6c
jmp 0x555102
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x454]
call fcn.0040a928
mov ecx, dword [ebp - 0x454]
lea eax, [ebp - 0x450]
mov edx, 0x555168
call fcn.00405594
mov eax, dword [ebp - 0x450]
call fcn.004c6770
call fcn.0056e088
test al, al
je 0x555102
lea eax, [ebp - 0x1f]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1e]
lea edx, [ebp - 0x1d]
mov eax, dword [ebp - 0x18]
call fcn.005a9b88
test al, al
je 0x555102
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x55517c
lea edx, [ebp - 0x45c]
xor eax, eax
mov al, byte [ebp - 0x1d]
call fcn.0040a83c
push dword [ebp - 0x45c]
push 0x555190
lea eax, [ebp - 0x458]
mov edx, 3
call fcn.00405608
mov eax, dword [ebp - 0x458]
call fcn.00405748
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x1c], eax
mov eax, 0x55519c
call fcn.004c6770
cmp dword [ebp - 0x1c], 0xffffffff
je 0x555102
mov eax, 0x5551b0
call fcn.004c6770
push 0
lea eax, [ebp - 0x14]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x420
lea eax, [ebp - 0x440]
push eax
push 0x4d008
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x5550f9
lea eax, [ebp - 0x220]
cmp dword [eax], 0
jne 0x5550e2
lea eax, [ebp - 0x21c]
cmp dword [eax], 0
jne 0x5550e2
lea eax, [ebp - 0x218]
cmp dword [eax], 0
jne 0x5550e2
lea eax, [ebp - 0x214]
cmp dword [eax], 0
je 0x5550f9
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x220]
mov ecx, 0x200
call fcn.00402a6c
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp + 8], 0
jne 0x555111
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555141
lea eax, [ebp - 0x45c]
mov edx, 4
call fcn.0040529c
lea eax, [ebp - 0x444]
call fcn.00405278
ret