Function at 0x618b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push edi
push 0x192
call fcn.00049640
push 0x1b88
mov edi, eax
call fcn.00049650
mov ebx, eax
mov dword [ebp - 4], ebx
test edi, edi
je 0x61b66
test ebx, ebx
je 0x61b66
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.00061310
cmp al, 1
jne 0x61ab1
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov esi, dword [ebp - 0xc]
mov edx, 0x1770
cmp word [eax], dx
jae 0x61981
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp - 0x1c], 0x736f746e
mov dword [ebp - 0x18], 0x6c6e726b
mov dword [ebp - 0x14], 0x6578652e
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0x43666f49
mov dword [ebp - 0x2c], 0x6c706d6f
mov dword [ebp - 0x28], 0x52657465
mov dword [ebp - 0x24], 0x65757165
mov dword [ebp - 0x20], 0x7473
call fcn.00014e00
cmp al, 1
jne 0x61973
mov ecx, dword [ebp - 0xc]
add ecx, edi
push ecx
push 0x2b1
call fcn.00049620
mov edx, dword [ebp - 4]
push edx
push edi
push ebx
push esi
call fcn.000613f0
jmp 0x6198d
push ebx
mov ebx, dword [ebp - 8]
push edi
push ebx
push esi
call fcn.00061610
cmp al, 1
jne 0x61a9c
push ebx
push esi
xor eax, eax
mov ecx, edi
call fcn.00014be0
cmp al, 1
jne 0x61a9c
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 0xc], 7
mov ecx, dword [eax]
mov dword [eax - 4], 0
test ecx, ecx
je 0x619ec
lea edx, [ecx + 0x10]
cmp edx, ebx
ja 0x619ec
add ecx, esi
mov edx, 1
mov dword [eax - 4], edx
mov edi, dword [ecx]
mov dword [eax + 8], edi
mov edi, dword [ecx + 4]
mov dword [eax + 0xc], edi
mov edi, dword [ecx + 8]
mov dword [eax + 0x10], edi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x14], ecx
jmp 0x619f1
mov edx, 1
mov ecx, dword [eax + 0x1c]
mov dword [eax + 0x18], 0
test ecx, ecx
je 0x61a22
lea edi, [ecx + 0x10]
cmp edi, ebx
ja 0x61a22
add ecx, esi
mov dword [eax + 0x18], edx
mov edi, dword [ecx]
mov dword [eax + 0x24], edi
mov edi, dword [ecx + 4]
mov dword [eax + 0x28], edi
mov edi, dword [ecx + 8]
mov dword [eax + 0x2c], edi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x30], ecx
mov ecx, dword [eax + 0x38]
mov dword [eax + 0x34], 0
test ecx, ecx
je 0x61a53
lea edi, [ecx + 0x10]
cmp edi, ebx
ja 0x61a53
add ecx, esi
mov dword [eax + 0x34], edx
mov edi, dword [ecx]
mov dword [eax + 0x40], edi
mov edi, dword [ecx + 4]
mov dword [eax + 0x44], edi
mov edi, dword [ecx + 8]
mov dword [eax + 0x48], edi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x4c], ecx
mov ecx, dword [eax + 0x54]
mov dword [eax + 0x50], 0
test ecx, ecx
je 0x61a84
lea edi, [ecx + 0x10]
cmp edi, ebx
ja 0x61a84
add ecx, esi
mov dword [eax + 0x50], edx
mov edi, dword [ecx]
mov dword [eax + 0x5c], edi
mov edi, dword [ecx + 4]
mov dword [eax + 0x60], edi
mov edi, dword [ecx + 8]
mov dword [eax + 0x64], edi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x68], ecx
add eax, 0x70
sub dword [ebp - 0xc], edx
jne 0x619b5
push 1
push 0x191
call fcn.00049620
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, dword [ebp - 4]
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x1770
cmp word [eax], dx
jb 0x61b65
push 0x191
call fcn.00049640
test eax, eax
je 0x61b65
push 0x2a7
call fcn.00049640
mov edx, eax
test edx, edx
jne 0x61af7
call fcn.0008b3d0
push 0x2a7
call fcn.00049640
mov edx, eax
push 0x4c
call fcn.00049640
push 0x21
mov esi, eax
call fcn.00049640
push 3
mov ecx, eax
call fcn.00049640
test edx, edx
je 0x61b65
test esi, esi
je 0x61b65
test ecx, ecx
je 0x61b65
test eax, eax
je 0x61b65
lea edi, [edx + 0x10]
cmp edi, ecx
ja 0x61b65
lea ecx, [ebx + 4]
mov edi, 0x1c
nop
cmp dword [ecx], 0
jne 0x61b5f
mov dword [ecx - 4], 1
mov dword [ecx], edx
lea ebx, [eax + edx]
mov dword [ecx + 4], ebx
mov ebx, dword [esi + edx]
mov dword [ecx + 8], ebx
mov ebx, dword [esi + edx + 4]
mov dword [ecx + 0xc], ebx
mov ebx, dword [esi + edx + 8]
mov dword [ecx + 0x10], ebx
mov ebx, dword [esi + edx + 0xc]
mov dword [ecx + 0x14], ebx
add ecx, 0x1c
dec edi
jne 0x61b30
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret