Function at 0x3e000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
push edi
or edi, 0xffffffff
xor al, al
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 0
test ecx, ecx
je 0x3e23e
push ebx
push esi
mov esi, dword [ebp - 0x10]
push 1
push esi
call fcn.00071e70
cmp al, 1
jne 0x3e23a
cmp dword [ebp - 0x14], 0x100000
jae 0x3e23a
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [edx]
mov edx, 0x1772
lea ecx, [esi - 0x18]
cmp ax, dx
ja 0x3e06b
mov eax, dword [esi - 0x10]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x3e0a3
mov edx, 0x2800
cmp ax, dx
jae 0x3e085
mov cl, byte [ecx + 0xc]
movzx ecx, cl
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
jmp 0x3e0a3
mov eax, ecx
shr eax, 8
xor al, byte [ecx + 0xc]
mov cl, al
movzx ecx, cl
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
jmp 0x3e0a3
mov esi, dword [ebp - 0x10]
mov ebx, dword [esi + eax*4]
mov dword [ebp - 0xc], 0
test ebx, ebx
je 0x3e20e
jmp 0x3e0c0
cmp dword [ebp - 0xc], 0x10000
jae 0x3e20e
mov esi, dword [ebx + 4]
test esi, esi
je 0x3e201
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [edx]
mov edx, 0x1772
lea ecx, [esi - 0x18]
cmp ax, dx
ja 0x3e0f6
mov ecx, dword [ebp - 8]
cmp ecx, dword [esi - 0x10]
jmp 0x3e118
mov edx, 0x2800
cmp ax, dx
jae 0x3e105
mov cl, byte [ecx + 0xc]
jmp 0x3e112
mov edi, dword [ebp - 4]
mov edx, ecx
shr edx, 8
xor dl, byte [ecx + 0xc]
mov cl, dl
movzx ecx, cl
cmp dword [ebp - 8], ecx
jne 0x3e135
mov edx, dword [ebp + 0xc]
dec edx
cmp edi, edx
jge 0x3e201
mov eax, dword [ebp + 8]
inc edi
mov dword [ebp - 4], edi
mov dword [eax + edi*4], esi
jmp 0x3e201
mov edx, 0x1db0
xor ecx, ecx
cmp ax, dx
jae 0x3e146
mov ecx, dword [esi - 0x10]
jmp 0x3e159
push 0x4a36
call fcn.00049640
test eax, eax
je 0x3e159
push esi
call eax
mov ecx, eax
cmp dword [ebp + 0x10], ecx
jne 0x3e201
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.0008b080
cmp al, 1
jne 0x3e201
mov esi, dword [ebp - 0x1c]
mov ecx, 0x30
cmp cx, word [esi]
jne 0x3e201
mov edx, dword [esi + 4]
mov eax, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp edx, dword [eax]
jbe 0x3e201
push 1
push edx
call fcn.00071e70
cmp al, 1
jne 0x3e201
mov edx, dword [esi + 4]
movzx edi, word [esi]
mov eax, 0x330030
push edx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x430041
mov dword [ebp - 0x48], 0x490050
mov dword [ebp - 0x44], 0x500023
mov dword [ebp - 0x40], 0x50004e
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0x320023
mov dword [ebp - 0x30], 0x640026
mov dword [ebp - 0x2c], 0x310061
mov dword [ebp - 0x28], 0x330061
mov dword [ebp - 0x24], 0x660066
mov dword [ebp - 0x20], 0x300026
call fcn.0008f350
test eax, eax
je 0x3e245
mov edi, dword [ebp - 4]
mov ebx, dword [ebx]
inc dword [ebp - 0xc]
test ebx, ebx
jne 0x3e0c0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x25
jb 0x3e0a0
test edi, edi
js 0x3e23a
mov eax, dword [ebp + 8]
mov eax, dword [eax + edi*4]
inc dword [ebp - 0x14]
dec edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
jne 0x3e028
pop esi
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
pop esi
pop ebx
mov byte [ecx], 1
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0x10