Function at 0x482764
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x4b47
mov dword [ebp - 0x90], esi
call fcn.004355f2
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x482a1f
push 0x2cc
call fcn.004355f2
mov edi, eax
test edi, edi
jne 0x4827be
call fcn.004826dc
push 0x2cc
call fcn.004355f2
mov edi, eax
push 0x2cd
call fcn.004355f2
push 0x27
mov dword [ebp - 0x9c], eax
call fcn.004355f2
mov dword [ebp - 0xa0], eax
test edi, edi
je 0x482a1f
cmp eax, 0xffffffff
je 0x482a1f
push esi
call fcn.0047d80c
test eax, eax
je 0x482a1f
mov eax, 0x74006e
mov dword [ebp - 0x84], 0x52005c
push esi
mov dword [ebp - 0x80], 0x670065
mov dword [ebp - 0x7c], 0x730069
mov dword [ebp - 0x78], 0x720074
mov dword [ebp - 0x74], 0x5c0079
mov dword [ebp - 0x70], 0x61004d
mov dword [ebp - 0x6c], 0x680063
mov dword [ebp - 0x68], 0x6e0069
mov dword [ebp - 0x64], 0x5c0065
mov dword [ebp - 0x60], 0x790053
mov dword [ebp - 0x5c], 0x740073
mov dword [ebp - 0x58], 0x6d0065
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0x6f0043
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x6f0072
mov dword [ebp - 0x38], 0x53006c
mov dword [ebp - 0x34], 0x740065
mov dword [ebp - 0x30], 0x53005c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x690076
mov dword [ebp - 0x24], 0x650063
mov dword [ebp - 0x20], 0x5c0073
mov dword [ebp - 0x1c], ebx
call fcn.0047d80c
mov esi, eax
lea eax, [ebp - 0x84]
push eax
call fcn.0047d80c
add esi, eax
lea eax, [esi*2 + 4]
push eax
push 1
mov dword [ebp - 0xac], eax
call fcn.00478d6e
mov esi, eax
mov dword [ebp - 0x98], esi
test esi, esi
je 0x482a1f
push dword [ebp - 0xac]
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0047d76c
mov esi, dword [ebp - 0x90]
push esi
call fcn.0047d80c
push eax
push esi
mov esi, dword [ebp - 0x98]
push esi
call fcn.0047d828
call dword [sym.imp.ntoskrnl.exe_KeGetCurrentThread]
mov ecx, eax
mov eax, dword [ebp - 0xa0]
push esi
mov dword [ebp - 0x90], ecx
mov dl, byte [ecx + eax]
mov byte [ecx + eax], bl
lea eax, [ebp - 0xa8]
push eax
mov byte [ebp - 0x85], dl
call dword [ebp - 0x8c]
mov esi, dword [ebp - 0x9c]
test esi, esi
je 0x4829d4
push 0x69
call fcn.00477546
mov edi, 0x914
mov byte [ebp - 0x8c], al
push edi
call fcn.004355f2
cmp eax, 0x1770
jb 0x4829ba
push edi
call fcn.004355f2
cmp eax, 0x23f0
je 0x4829ba
push edi
call fcn.004355f2
cmp eax, 0x2580
jb 0x4829a2
xor edx, edx
lea ecx, [ebp - 0xa8]
call esi
jmp 0x4829c4
pushal
push 0
lea ecx, [ebp - 0xa8]
call dword [ebp - 0x9c]
mov dword [ebp - 0x94], eax
popal
jmp 0x4829ca
push ebx
lea eax, [ebp - 0xa8]
push eax
call esi
mov dword [ebp - 0x94], eax
push dword [ebp - 0x8c]
push 0x69
jmp 0x4829f8
push 0x68
call fcn.00477546
mov byte [ebp - 0x8c], al
lea eax, [ebp - 0xa8]
push eax
call edi
push dword [ebp - 0x8c]
mov dword [ebp - 0x94], eax
push 0x68
mov bl, 1
call fcn.0047769a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x90]
mov dl, byte [ebp - 0x85]
push dword [ebp - 0x98]
mov byte [ecx + eax], dl
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 4