Function at 0x8a200
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
push ebx
push esi
push edi
xor ebx, ebx
push 0x494c
mov dword [esp + 0x1c], ebx
call fcn.00049640
push 0x4a15
mov dword [esp + 0x5c], eax
call fcn.00049640
mov edi, eax
push 0x4a18
mov dword [esp + 0x4c], edi
call fcn.00049640
push 0x48d1
mov dword [esp + 0x3c], eax
call fcn.00049640
mov ecx, eax
push 0x4a1b
mov dword [esp + 0x38], ecx
call fcn.00049640
mov edx, eax
push 0x4940
mov dword [esp + 0x2c], edx
call fcn.00049640
mov esi, eax
push 0x4943
mov dword [esp + 0x54], esi
call fcn.00049640
push 0x4841
mov dword [esp + 0x30], eax
call fcn.00049640
push 0x48ad
mov dword [esp + 0x28], eax
call fcn.00049640
push 0x490a
mov dword [esp + 0x40], eax
call fcn.00049640
push 0x30
mov dword [esp + 0x20], eax
call fcn.00049640
mov dword [esp + 0x4c], eax
cmp edi, ebx
je 0x8a6d3
cmp dword [esp + 0x38], ebx
je 0x8a6d3
cmp ecx, ebx
je 0x8a6d3
cmp edx, ebx
je 0x8a6d3
cmp esi, ebx
je 0x8a6d3
cmp dword [esp + 0x2c], ebx
je 0x8a6d3
cmp dword [esp + 0x24], ebx
je 0x8a6d3
cmp dword [esp + 0x3c], ebx
je 0x8a6d3
cmp dword [esp + 0x1c], ebx
je 0x8a6d3
cmp eax, ebx
je 0x8a6d3
mov eax, 0x740072
mov ecx, 0x6f0050
push 0x877
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], 0x4c0041
mov dword [esp + 0xac], 0x430050
mov dword [esp + 0xb0], 0x500020
mov dword [esp + 0xb4], 0x72006f
mov dword [esp + 0xb8], 0x74
mov dword [esp + 0x78], 0x57005c
mov dword [esp + 0x7c], 0x6e0069
mov dword [esp + 0x80], 0x6f0064
mov dword [esp + 0x84], 0x730077
mov dword [esp + 0x88], 0x41005c
mov dword [esp + 0x8c], 0x690070
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ebx
mov dword [esp + 0x6c], 0x73727363
mov dword [esp + 0x70], 0x78652e73
mov dword [esp + 0x74], 0x65
call fcn.00049640
push eax
push 0x2000
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, ebx
je 0x8a6d3
call fcn.0008a110
mov dword [esp + 0x5c], eax
cmp eax, ebx
je 0x8a6cd
mov ecx, dword [eax]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x40], ebx
cmp ecx, ebx
jbe 0x8a6bf
lea edi, [eax + 4]
lea esp, [esp]
mov dword [esp + 0xb8], 0x18
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc4], 0x200
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
movzx eax, word [edi]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0xbc]
push edx
mov dword [esp + 0x68], eax
push 0x40
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x74], ebx
call dword [esp + 0x58]
test eax, eax
js 0x8a66a
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x1db0
xor eax, eax
cmp word [edx], cx
jb 0x8a494
mov eax, 0x200
movzx ecx, word [edi + 6]
mov edx, dword [esp + 0x30]
push 2
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ecx
push edx
call dword [esp + 0x54]
mov esi, eax
cmp esi, ebx
jl 0x8a4bd
mov byte [esp + 0xe], 1
jmp 0x8a567
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x1770
mov byte [esp + 0xe], bl
mov byte [esp + 0xd], bl
cmp word [ecx], ax
jb 0x8a567
movzx eax, word [edi]
lea edx, [esp + 0x14]
push edx
push eax
call dword [esp + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x8a661
movzx ecx, word [edi + 6]
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x1db0
mov dword [esp + 0x10], ecx
cmp word [eax], dx
mov edx, dword [esp + 0x14]
jb 0x8a51f
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x8a51f
cmp dword [eax], edx
jne 0x8a51f
or dword [esp + 0x10], 0x80000000
call fcn.0008a7b0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xd0]
push ecx
push edx
mov byte [esp + 0x17], al
call dword [esp + 0x58]
mov ecx, dword [esp + 0x10]
push ebx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push 0x80000000
push ecx
mov byte [esp + 0x25], 1
call dword [esp + 0x54]
test eax, eax
js 0x8a567
mov ecx, dword [esp + 0x44]
cmp ecx, dword [edi + 8]
jne 0x8a563
xor esi, esi
call dword [esp + 0x1c]
cmp esi, ebx
jl 0x8a624
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push ebx
push 0x2000
push esi
push 2
push edx
call dword [esp + 0x48]
test eax, eax
js 0x8a624
mov esi, dword [esi + 4]
cmp esi, ebx
je 0x8a624
push 4
lea edx, [esp + 0x9c]
mov eax, esi
call fcn.0008efd0
test eax, eax
je 0x8a5c0
push 9
lea edx, [esp + 0xa8]
mov eax, esi
call fcn.0008efd0
test eax, eax
jne 0x8a624
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push ebx
push 0x2000
push eax
push 1
push ecx
call dword [esp + 0x48]
test eax, eax
js 0x8a624
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
cmp eax, ebx
je 0x8a624
mov esi, eax
lea eax, [esp + 0x74]
xor ecx, ecx
sub esi, eax
nop
lea edx, [esi + ecx*2]
movzx eax, word [esp + edx + 0x74]
movzx edx, word [esp + ecx*2 + 0x74]
cmp ax, dx
ja 0x8a611
jb 0x8a617
cmp ax, bx
je 0x8a61d
inc ecx
cmp ecx, 0x10
jb 0x8a5f0
jmp 0x8a61d
mov ecx, edx
sub eax, ecx
jmp 0x8a619
sub eax, edx
cmp eax, ebx
jne 0x8a624
movzx eax, word [edi]
mov dword [esp + 0x18], eax
cmp byte [esp + 0xe], 1
jne 0x8a636
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x2c]
jmp 0x8a661
cmp byte [esp + 0xd], 1
jne 0x8a661
lea edx, [esp + 0xd0]
push edx
call dword [esp + 0x30]
cmp byte [esp + 0xf], 1
jne 0x8a659
mov ecx, dword [esp + 0x14]
call fcn.0008a870
mov ecx, dword [esp + 0x14]
call dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push eax
call dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x8a6a9
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [esp + 0x2c]
test eax, eax
js 0x8a6a5
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x4c]
push 0x10
add edx, esi
lea eax, [esp + 0x6c]
call fcn.0008f2e0
test eax, eax
je 0x8a6bf
mov ecx, esi
mov dword [esp + 0x18], ebx
call dword [esp + 0x1c]
jmp 0x8a6a9
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x40]
inc eax
add edi, 0x10
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x54]
jb 0x8a420
mov eax, dword [esp + 0x5c]
push eax
call fcn.0008b8c0
mov esi, dword [esp + 0x20]
push esi
call fcn.0008b8c0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret