Function at 0x10048620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x784
mov eax, dword [0x10269114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x780], 0
mov dword [ebp - 0x76c], 0
mov dword [ebp - 0x76c], 0
jmp 0x10048662
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 0x10
jge 0x100488d3
mov dword [ebp - 0x774], 0
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x5c
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x76
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x25
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov ecx, dword [ebp - 0x76c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.10033ac0
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 0xffffffff
je 0x100488ce
mov dword [ebp - 0x77c], 0
xor edx, edx
mov dword [ebp - 0x740], edx
mov dword [ebp - 0x73c], edx
mov dword [ebp - 0x738], edx
mov dword [ebp - 0x734], edx
mov dword [ebp - 0x730], edx
mov dword [ebp - 0x72c], edx
push 0
lea eax, [ebp - 0x77c]
push eax
push 0x18
lea ecx, [ebp - 0x740]
push ecx
push 0
push 0
push 0x74080
mov edx, dword [ebp - 0x774]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100488c1
movzx eax, byte [ebp - 0x73d]
test eax, eax
jle 0x100488c1
mov byte [ebp - 0x765], 0
movzx edx, byte [ebp - 0x73d]
mov ecx, dword [ebp - 0x76c]
sar edx, cl
and edx, 0x10
je 0x100487a8
mov dword [ebp - 0x778], 0xa1
jmp 0x100487b2
mov dword [ebp - 0x778], 0xec
mov al, byte [ebp - 0x778]
mov byte [ebp - 0x765], al
xor ecx, ecx
mov dword [ebp - 0x764], ecx
mov dword [ebp - 0x760], ecx
mov dword [ebp - 0x75c], ecx
mov dword [ebp - 0x758], ecx
mov dword [ebp - 0x754], ecx
mov dword [ebp - 0x750], ecx
mov dword [ebp - 0x74c], ecx
mov dword [ebp - 0x748], ecx
mov byte [ebp - 0x744], cl
push 0x210
push 0
lea edx, [ebp - 0x328]
push edx
call fcn.1004e550
add esp, 0xc
lea eax, [ebp - 0x77c]
push eax
movzx ecx, byte [ebp - 0x76c]
push ecx
movzx edx, byte [ebp - 0x765]
push edx
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x764]
push ecx
mov edx, dword [ebp - 0x774]
push edx
call fcn.10047fe0
add esp, 0x18
test eax, eax
je 0x100488c1
lea eax, [ebp - 0x318]
mov dword [ebp - 0x784], eax
mov dword [ebp - 0x770], 0
mov dword [ebp - 0x770], 0
jmp 0x10048875
mov ecx, dword [ebp - 0x770]
add ecx, 1
mov dword [ebp - 0x770], ecx
cmp dword [ebp - 0x770], 0x100
jge 0x100488a0
mov edx, dword [ebp - 0x770]
mov eax, dword [ebp - 0x784]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x770]
mov dword [ebp + edx*4 - 0x728], ecx
jmp 0x10048866
mov eax, dword [ebp + 8]
push eax
push 0x13
push 0xa
lea ecx, [ebp - 0x728]
push ecx
call fcn.10047f20
add esp, 0x10
mov dword [ebp - 0x780], 1
mov edx, dword [ebp - 0x774]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10048653
mov eax, dword [ebp - 0x780]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100499a5
mov esp, ebp
pop ebp
ret