Function at 0x1ae70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
push 3
call fcn.00049640
mov edi, eax
xor ebx, ebx
mov dword [ebp - 4], edi
cmp edi, ebx
je 0x1b1de
push esi
push 0x877
call fcn.00049640
push eax
push 0x2d0
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebx
je 0x1b1dd
push 0x2d0
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x65
call fcn.00049640
mov dword [esi + 0x4c], eax
cmp eax, ebx
je 0x1af03
sub eax, edi
mov dword [esi + 0x48], eax
lea eax, [esi + 4]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x78457350
mov dword [ebp - 0x28], 0x70537469
mov dword [ebp - 0x24], 0x61696365
mov dword [ebp - 0x20], 0x6370416c
mov dword [ebp - 0x1c], ebx
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x43], bl
push 0x66
call fcn.00049640
mov dword [esi + 0x9c], eax
cmp eax, ebx
je 0x1af4c
sub eax, edi
mov dword [esi + 0x98], eax
lea eax, [esi + 0x54]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x72467845
mov dword [ebp - 0x28], 0x61436565
mov dword [ebp - 0x24], 0x61426c6c
mov dword [ebp - 0x20], 0x6b63
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x93], bl
push 0x67
call fcn.00049640
mov dword [esi + 0xec], eax
cmp eax, ebx
je 0x1af9b
sub eax, edi
mov dword [esi + 0xe8], eax
lea eax, [esi + 0xa4]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x45707350
mov dword [ebp - 0x28], 0x4e746978
mov dword [ebp - 0x24], 0x616d726f
mov dword [ebp - 0x20], 0x6370416c
mov dword [ebp - 0x1c], ebx
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0xe3], bl
push 0x64
call fcn.00049640
mov dword [esi + 0x13c], eax
cmp eax, ebx
jne 0x1afbe
call fcn.00090d20
push 0x64
call fcn.00049640
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x13c]
cmp eax, ebx
je 0x1b003
sub eax, edi
mov dword [esi + 0x138], eax
lea eax, [esi + 0xf4]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x45707350
mov dword [ebp - 0x28], 0x54746978
mov dword [ebp - 0x24], 0x61657268
mov dword [ebp - 0x20], 0x64
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x133], bl
push 0x63
call fcn.00049640
mov dword [esi + 0x18c], eax
cmp eax, ebx
je 0x1b064
sub eax, edi
mov dword [esi + 0x188], eax
lea eax, [esi + 0x144]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x54707350
mov dword [ebp - 0x28], 0x696d7265
mov dword [ebp - 0x24], 0x6574616e
mov dword [ebp - 0x20], 0x65726854
mov dword [ebp - 0x1c], 0x79426461
mov dword [ebp - 0x18], 0x6e696f50
mov dword [ebp - 0x14], 0x726574
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x183], bl
push 0x1cd
call fcn.00049640
mov dword [esi + 0x1dc], eax
cmp eax, ebx
je 0x1b0b3
sub eax, edi
mov dword [esi + 0x1d8], eax
lea eax, [esi + 0x194]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x6146694b
mov dword [ebp - 0x28], 0x61437473
mov dword [ebp - 0x24], 0x6e456c6c
mov dword [ebp - 0x20], 0x797274
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x1d3], bl
push 0x23f
call fcn.00049640
mov dword [esi + 0x22c], eax
cmp eax, ebx
jne 0x1b0dc
call fcn.00090ec0
push 0x23f
call fcn.00049640
mov dword [esi + 0x22c], eax
mov eax, dword [esi + 0x22c]
cmp eax, ebx
je 0x1b124
sub eax, edi
mov dword [esi + 0x228], eax
lea eax, [esi + 0x1e4]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x6e49694b
mov dword [ebp - 0x28], 0x74726573
mov dword [ebp - 0x24], 0x75657551
mov dword [ebp - 0x20], 0x63704165
mov dword [ebp - 0x1c], ebx
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x223], bl
push 0x33c
call fcn.00049640
mov dword [esi + 0x27c], eax
cmp eax, ebx
je 0x1b173
sub eax, edi
mov dword [esi + 0x278], eax
lea eax, [esi + 0x234]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x66706f49
mov dword [ebp - 0x28], 0x6c6c6143
mov dword [ebp - 0x24], 0x76697244
mov dword [ebp - 0x20], 0x7265
call fcn.0008f230
mov edi, dword [ebp - 4]
mov byte [esi + 0x273], bl
push 0x2aa
call fcn.00049640
mov dword [esi + 0x2cc], eax
cmp eax, ebx
je 0x1b1c6
sub eax, edi
mov dword [esi + 0x2c8], eax
lea eax, [esi + 0x284]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x66706f49
mov dword [ebp - 0x28], 0x706d6f43
mov dword [ebp - 0x24], 0x6574656c
mov dword [ebp - 0x20], 0x75716552
mov dword [ebp - 0x1c], 0x747365
call fcn.0008f230
mov byte [esi + 0x2c3], bl
push 9
push 0x23d
call fcn.00049620
push esi
push 0x23e
call fcn.00049620
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret