Function at 0x104e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f0
push ebx
push esi
push edi
push 0x3f
pop ecx
xor eax, eax
mov byte [ebp - 0x180], 0
lea edi, [ebp - 0x17f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xf
pop ecx
xor eax, eax
push 0xb
lea edi, [ebp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
xor edx, edx
mov word [ebp - 0x20], dx
lea edi, [ebp - 0x1e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xb
pop ecx
xor eax, eax
mov word [ebp - 0x50], dx
lea edi, [ebp - 0x4e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xb
pop ecx
xor eax, eax
mov word [ebp - 0x80], dx
lea edi, [ebp - 0x7e]
rep stosd dword es:[edi], eax
push 7
stosw word es:[edi], ax
pop ecx
mov word [ebp + 0x50], dx
xor eax, eax
lea edi, [ebp + 0x52]
rep stosd dword es:[edi], eax
push 0x5c
stosw word es:[edi], ax
pop edi
push 0x53
pop esi
mov word [ebp + 0x10], di
mov word [ebp + 0x12], 0x52
mov word [ebp + 0x14], 0x45
mov word [ebp + 0x16], 0x47
mov word [ebp + 0x18], 0x49
mov word [ebp + 0x1a], si
nop
push 0x43
pop edx
mov word [ebp + 0x1c], 0x54
mov word [ebp + 0x1e], 0x52
mov word [ebp + 0x20], 0x59
mov word [ebp + 0x22], di
mov word [ebp + 0x24], 0x4d
mov word [ebp + 0x26], 0x41
mov word [ebp + 0x28], dx
mov word [ebp + 0x2a], 0x48
mov word [ebp + 0x2c], 0x49
mov word [ebp + 0x2e], 0x4e
mov word [ebp + 0x30], 0x45
mov word [ebp + 0x32], di
mov word [ebp + 0x34], si
mov word [ebp + 0x36], 0x59
mov word [ebp + 0x38], si
mov word [ebp + 0x3a], 0x54
mov word [ebp + 0x3c], 0x45
mov word [ebp + 0x3e], 0x4d
mov word [ebp + 0x40], di
mov word [ebp - 0x20], dx
mov word [ebp - 0x1e], 0x75
mov word [ebp - 0x1c], 0x72
push 0x65
pop ebx
push 0x74
pop eax
push 0x6f
pop ecx
mov word [ebp - 0x1a], 0x72
mov word [ebp - 0x18], bx
mov word [ebp - 0x16], 0x6e
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], dx
mov word [ebp - 0x10], cx
nop
mov word [ebp - 0xc], ax
mov word [ebp], ax
mov word [ebp - 0x4a], ax
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x80]
push eax
mov word [ebp - 0xe], 0x6e
mov word [ebp - 0xa], 0x72
mov word [ebp - 8], cx
mov word [ebp - 6], 0x6c
mov word [ebp - 4], si
mov word [ebp - 2], bx
mov word [ebp - 0x50], dx
mov word [ebp - 0x4e], cx
mov word [ebp - 0x4c], 0x6e
mov word [ebp - 0x48], 0x72
mov word [ebp - 0x46], cx
mov word [ebp - 0x44], 0x6c
mov word [ebp - 0x42], si
mov word [ebp - 0x40], bx
mov word [ebp - 0x3c], 0x30
mov word [ebp - 0x3a], 0x30
mov word [ebp - 0x38], 0x31
call dword [sym.imp.ntoskrnl.exe_wcscpy]
mov word [ebp + 0x50], di
mov word [ebp + 0x62], di
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x180]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x7c]
mov eax, ecx
mov word [ebp + 0x52], si
mov esi, dword [ebp + 0x78]
shr ecx, 2
lea edi, [ebp - 0x180]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x180]
and ecx, 3
push 0x20
push eax
mov word [ebp - 0x68], 0x32
mov word [ebp + 0x54], bx
mov word [ebp + 0x56], 0x72
mov word [ebp + 0x58], 0x76
mov word [ebp + 0x5a], 0x69
mov word [ebp + 0x5c], 0x63
mov word [ebp + 0x5e], bx
mov word [ebp + 0x60], 0x73
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ntoskrnl.exe_strchr]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1082a
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push 0x206b6444
mov ebx, 0x400
push ebx
push 1
mov byte [esi], 0
call edi
mov dword [ebp + 0x7c], eax
nop
push 0x206b6444
push ebx
push 1
call edi
mov edi, dword [ebp + 0x7c]
push dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov edx, 0x100
xor eax, eax
mov ecx, edx
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x78]
mov ecx, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x180]
push eax
call fcn.00011ea0
push dword [ebp + 0x78]
inc esi
push esi
call fcn.00011ea0
mov edi, dword [sym.imp.ntoskrnl.exe_swprintf]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x10]
push eax
push 0x104ba
mov esi, 0x12750
push esi
call edi
push dword [ebp + 0x7c]
mov ebx, dword [sym.imp.ntoskrnl.exe_wcscat]
push esi
call ebx
push esi
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 0x20
push eax
push esi
push esi
call fcn.00011d90
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x10]
push eax
push 0x104ca
mov esi, 0x12950
push esi
call edi
push dword [ebp + 0x7c]
push esi
call ebx
push esi
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 0x20
push eax
push esi
push esi
call fcn.00011d90
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x10]
push eax
push 0x104da
mov esi, 0x12b50
push esi
call edi
push dword [ebp + 0x7c]
push esi
call ebx
push esi
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 0x20
push eax
push esi
push esi
call fcn.00011d90
push dword [ebp + 0x78]
push 0x12f50
call dword [sym.imp.ntoskrnl.exe_wcscpy]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop ecx
pop ecx
push 0
push dword [ebp + 0x7c]
call esi
push 0
push dword [ebp + 0x78]
call esi
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8