Function at 0x5d61ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47aa20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x25c]
push eax
xor edi, edi
push 1
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x25c], 0x18
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x250], 0x40
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
call fcn.004b070c
test eax, eax
jl 0x5d646b
push ebx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x230], eax
push edi
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x240]
mov word [ebp - 0x234], di
mov word [ebp - 0x232], 0x1fe
call fcn.004b057d
push dword [ebp - 0x240]
mov ebx, eax
call sym.ntoskrnl.exe_NtClose
cmp ebx, edi
jl 0x5d646a
movzx eax, word [ebp - 0x234]
mov ecx, dword [ebp - 0x230]
push 0xf003f
shr eax, 1
push 0x5b6eb0
mov word [ecx + eax*2], di
push edi
lea eax, [ebp - 0x23c]
push eax
call fcn.004c1053
test eax, eax
jl 0x5d646a
push 0x74
pop ebx
push edi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x228], eax
push 0xf003f
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
push eax
mov word [ebp - 0x24], 0x53
mov word [ebp - 0x22], 0x65
mov word [ebp - 0x20], bx
mov word [ebp - 0x1e], 0x75
mov word [ebp - 0x1c], 0x70
mov word [ebp - 0x1a], di
mov word [ebp - 0x22a], 0xc
mov word [ebp - 0x22c], 0xa
call fcn.004bf697
push dword [ebp - 0x23c]
mov dword [ebp - 0x244], eax
call sym.ntoskrnl.exe_NtClose
cmp dword [ebp - 0x244], edi
jl 0x5d646a
movzx eax, word [ebp - 0x234]
inc eax
inc eax
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
push 1
push edi
push eax
push dword [ebp - 0x238]
mov word [ebp - 0x24], 0x53
mov word [ebp - 0x22], 0x79
mov word [ebp - 0x20], 0x73
mov word [ebp - 0x1e], bx
mov word [ebp - 0x1c], 0x65
mov word [ebp - 0x1a], 0x6d
mov word [ebp - 0x18], 0x50
mov word [ebp - 0x16], 0x61
mov word [ebp - 0x14], 0x72
mov word [ebp - 0x12], bx
mov word [ebp - 0x10], 0x69
mov word [ebp - 0xe], bx
mov word [ebp - 0xc], 0x69
mov word [ebp - 0xa], 0x6f
mov word [ebp - 8], 0x6e
mov word [ebp - 6], di
mov word [ebp - 0x22a], 0x20
mov word [ebp - 0x22c], 0x1e
call fcn.0049e527
xor eax, eax
mov ax, word [esi]
cmp ax, 2
mov word [ebp - 0x24], 0x4f
mov word [ebp - 0x22], 0x73
mov word [ebp - 0x20], 0x4c
mov word [ebp - 0x1e], 0x6f
mov word [ebp - 0x1c], 0x61
mov word [ebp - 0x1a], 0x64
mov word [ebp - 0x18], 0x65
mov word [ebp - 0x16], 0x72
mov word [ebp - 0x14], 0x50
mov word [ebp - 0x12], 0x61
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], 0x68
mov word [ebp - 0xc], di
mov word [ebp - 0x22a], 0x1a
mov word [ebp - 0x22c], 0x18
ja 0x5e1ce5
movzx eax, word [esi]
inc eax
inc eax
push eax
push dword [esi + 4]
lea eax, [ebp - 0x22c]
push 1
push edi
push eax
push dword [ebp - 0x238]
call fcn.0049e527
push dword [ebp - 0x238]
call sym.ntoskrnl.exe_NtClose
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0040d8f1
leave
ret 8
mov ecx, dword [esi + 4]
movzx edx, ax
cmp word [edx + ecx - 2], 0x5c
jne 0x5d6441
add eax, 0xfffffffe
mov word [esi], ax
movzx eax, ax
mov word [ecx + eax], di
jmp 0x5d6441