Function at 0x14004b4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rdx
test rdx, rdx
mov r14, rcx
cmove r12, rcx
mov ecx, 0x4a
mov esi, r9d
mov rdi, r8
call fcn.140029ab4
mov rcx, r14
lea ebx, [rax - 1]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x14004b827
mov ecx, ebx
add rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x14004b827
mov ecx, 0x28
call fcn.140029ab4
mov ecx, 0x2f
mov r13, rax
call fcn.140029ab4
mov rbx, rax
cmp r13d, 0xffffffff
je 0x14004b827
cmp eax, 0xffffffff
je 0x14004b827
mov r15d, dword [rdi]
imul ecx, r15d, 0x228
add ecx, 0x230
cmp ecx, esi
jae 0x14004b827
xor edx, edx
mov ecx, edx
test r15d, r15d
je 0x14004b5b1
lea rax, [rdi + 0x28]
cmp r12, qword [rax]
je 0x14004b827
inc ecx
add rax, 0x228
cmp ecx, r15d
jb 0x14004b59b
cmp byte [rbp + 0x68], dl
je 0x14004b5c9
mov rdx, r12
mov rcx, r14
call fcn.14004a18c
cmp al, 1
jne 0x14004b827
imul rsi, r15, 0x228
mov rcx, r14
mov qword [rsi + rdi + 0x28], r12
call fcn.140049fd0
mov qword [rsi + rdi + 0x18], rax
test rax, rax
jne 0x14004b5f3
mov eax, r13d
mov rcx, qword [rax + r14]
mov qword [rsi + rdi + 0x18], rcx
mov eax, ebx
mov r13d, 0x2e
mov rcx, qword [rax + r14]
mov al, byte [rbp + 0x60]
mov qword [rsi + rdi + 0x10], rcx
mov byte [rsi + rdi + 8], al
cmp al, 1
jne 0x14004b671
mov ecx, r13d
mov bl, al
call fcn.140029ab4
cmp eax, 0xffffffff
je 0x14004b66d
mov eax, eax
movabs rcx, 0xfffff78000000014
mov rax, qword [rax + r14]
mov rcx, qword [rcx]
cmp rcx, rax
jl 0x14004b66d
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
xor ecx, ecx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, rdx
shr rax, 0x20
test eax, eax
jne 0x14004b66d
movzx ebx, bl
cmp edx, 0x14
cmovb ebx, ecx
mov byte [rsi + rdi + 8], bl
mov rcx, r14
call fcn.140079dd8
mov ecx, r13d
mov byte [rsi + rdi + 9], al
call fcn.140029ab4
cmp eax, 0xffffffff
je 0x14004b699
mov eax, eax
mov rcx, qword [rax + r14]
xor eax, eax
mov qword [rsi + rdi + 0x20], rcx
jmp 0x14004b6a0
xor eax, eax
mov qword [rsi + rdi + 0x20], rax
mov r13b, byte [rbp + 0x70]
lea rbx, [rsi + rdi]
lea r8, [rbp - 0x20]
mov word [rbx + 0x30], ax
mov rdx, qword [rsi + rdi + 0x18]
xor r9d, r9d
mov rcx, r14
mov byte [rsp + 0x20], r13b
call fcn.140049bdc
cmp al, 1
jne 0x14004b6f4
mov rdx, qword [rbp - 0x20]
lea rcx, [rbx + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.14007d514
xor eax, eax
mov word [rsi + rdi + 0x22e], ax
mov rcx, qword [rbp - 0x20]
call fcn.140077564
jmp 0x14004b821
test r13b, r13b
jne 0x14004b827
mov ecx, 0x4265
call fcn.140029ab4
xor r13d, r13d
test rax, rax
je 0x14004b72f
cmp qword [rax], r12
jne 0x14004b72f
mov dword [rbx + 0x30], 0x790053
mov dword [rbx + 0x34], 0x740073
mov qword [rbx + 0x38], 0x6d0065
jmp 0x14004b821
mov r12d, 0x914
mov ecx, r12d
call fcn.140029ab4
cmp eax, 0x3839
jb 0x14004b810
mov ecx, 0x4187
call fcn.140029ab4
test rax, rax
je 0x14004b810
mov rcx, r14
mov dword [rbp - 0x18], 0x436d654d
mov dword [rbp - 0x14], 0x72706d6f
mov dword [rbp - 0x10], 0x69737365
mov dword [rbp - 0xc], 0x6e6f
call rax
lea rdx, [rbp - 0x18]
mov rcx, rax
mov rsi, rax
call fcn.14007d2dc
test eax, eax
jne 0x14004b7c3
mov dword [rbx + 0x30], 0x65004d
mov dword [rbx + 0x34], 0x43006d
mov dword [rbx + 0x38], 0x6d006f
mov dword [rbx + 0x3c], 0x720070
mov dword [rbx + 0x40], 0x730065
mov dword [rbx + 0x44], 0x690073
mov qword [rbx + 0x48], 0x6e006f
jmp 0x14004b821
mov ecx, r12d
call fcn.140029ab4
cmp eax, 0x42ee
jb 0x14004b810
lea rdx, [rbp - 0x18]
mov rcx, rsi
mov dword [rbp - 0x18], 0x69676552
mov qword [rbp - 0x14], 0x79727473
call fcn.14007d2dc
test eax, eax
jne 0x14004b810
mov dword [rbx + 0x30], 0x650052
mov dword [rbx + 0x34], 0x690067
mov dword [rbx + 0x38], 0x740073
mov qword [rbx + 0x3c], 0x790072
jmp 0x14004b821
mov rcx, r14
call fcn.14004a0e4
cmp al, 1
jne 0x14004b827
mov word [rbx + 0x30], r13w
lea eax, [r15 + 1]
mov dword [rdi], eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret