Function at 0x284a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
and dword [rax + 8], 0
and dword [rax + 0x20], 0
and dword [rsp + 0x4c], 0
and dword [rsp + 0x48], 0
mov rbx, rcx
lea rcx, [rax - 0x68]
mov rax, qword [rdx + 0x10]
mov r13d, 1
mov rsi, r8
mov qword [rcx], rax
mov rax, qword [rdx + 0x18]
mov rbp, rdx
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x20]
mov dword [rsp + 0x50], 0x3052505f
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x28]
mov dword [rsp + 0x54], 0x3152505f
mov dword [rcx + 0x18], eax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x74]
shr rax, 0x20
mov dword [rsp + 0x58], 0x3252505f
mov dword [rsp + 0x60], 0x3053505f
cmp eax, r13d
movabs rax, 0x8000000000000
mov dword [rsp + 0x64], 0x3153505f
cmovne ecx, r13d
xor r12d, r12d
xor edx, edx
xor r8d, r8d
xor r14d, r14d
test qword [rbx], rax
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x74], ecx
mov dword [rsp + 0x68], 0x3253505f
mov dword [rsp + 0x6c], 0x3353505f
lea r15d, [r13 + 1]
je 0x28580
lea r8d, [r13 + 0x11]
jmp 0x2869c
mov rax, qword [rbx + 0x240]
mov r9d, r13d
lea r10, [rsp + 0x60]
mov rdi, qword [rax + 0x18]
test rdi, rdi
mov rax, rdi
je 0x285ce
mov r11d, dword [r10]
cmp r11d, dword [rax + 0x20]
je 0x285be
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x285b7
mov rax, qword [rax + 8]
cmp qword [rcx + 0x18], rax
jne 0x285b9
xor eax, eax
test rax, rax
jne 0x2859e
test rax, rax
je 0x285ce
mov ecx, r9d
mov eax, r13d
shl eax, cl
or r8d, eax
add r9d, r13d
add r10, 4
cmp r9d, 4
jle 0x28593
mov r9d, r13d
lea r10, [rsp + 0x50]
test rdi, rdi
mov rax, rdi
je 0x28620
mov r11d, dword [r10]
cmp r11d, dword [rax + 0x20]
je 0x2860e
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x28607
mov rax, qword [rax + 8]
cmp qword [rcx + 0x18], rax
jne 0x28609
xor eax, eax
test rax, rax
jne 0x285ee
test rax, rax
je 0x28620
mov ecx, r9d
mov eax, r13d
shl eax, cl
or eax, 0x10
or edx, eax
add r9d, r13d
add r10, 4
cmp r9d, 3
jle 0x285e3
mov eax, r8d
or eax, edx
je 0x286a6
test r15b, al
jne 0x28665
neg edx
mov r8, rbx
mov ecx, 0xa5
sbb r9, r9
and qword [rsp + 0x20], r12
mov edx, 0xd
and r9, 0xffffffffffff0000
add r9, 0x3053505f
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
int3
test al, 0x10
jne 0x28688
and qword [rsp + 0x20], r12
mov r9d, 0x3353505f
mov r8, rbx
mov edx, 0xd
mov ecx, 0xa5
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
int3
test edx, edx
je 0x2869c
test r8d, r8d
je 0x2869c
cmp edx, r8d
je 0x2869c
and edx, r8d
and r8d, edx
mov r12d, edx
mov dword [rsp + 0x44], edx
mov r14d, r8d
or r14d, r12d
jne 0x286e1
test byte [rbx], 0x40
je 0x286c5
test byte [rbx], 0x20
jne 0x286c5
test byte [rsi + 4], r13b
jne 0x286c5
test byte [rsi + 4], r15b
je 0x2889d
test byte [rsi + 4], r13b
mov r14d, 0x12
lea eax, [r14 + 4]
cmovne r14d, eax
test byte [rsi + 4], r15b
je 0x286e1
or r14d, 8
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x70]
mov r8, rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov rdx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
call fcn.00053f74
test eax, eax
js 0x2899c
lea rbp, [rsp + 0x78]
bt dword [0x00047194], r15d
jae 0x2887c
xor eax, eax
movabs rcx, 0x8000000000000
test qword [rbx], rcx
mov dword [rsp + 0x40], eax
jne 0x2876b
lea r8, [rsp + 0x40]
mov edx, r15d
mov rcx, rbx
call fcn.00053d50
mov r11d, eax
mov eax, dword [rsp + 0x40]
jmp 0x28771
mov r11d, 0xc0000034
test r11d, r11d
js 0x28787
cmp eax, dword [rbp]
jle 0x2887c
mov dword [rbp], eax
jmp 0x2887c
mov ecx, dword [rbp]
mov esi, 1
xor r13b, r13b
shl esi, cl
sub esi, 1
not esi
and esi, r14d
je 0x289cb
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_RtlFindLeastSignificantBit]
movsx rdi, al
mov eax, 1
mov ecx, edi
mov dword [rsp + 0x40], edi
shl eax, cl
not eax
and esi, eax
cmp r15d, dword [rsp + 0xe0]
jg 0x287e0
mov eax, dword [rsp + 0xf8]
test eax, esi
jne 0x2884a
cmp edi, dword [rsp + 0x48]
jne 0x287e0
mov r13b, 1
mov dword [rbp], edi
cmp edi, 4
je 0x2886f
test r12d, r12d
je 0x2886a
lea rcx, [0x00047158]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [rbx + rdi*8 + 0x158]
mov r12d, 7
test rdx, rdx
je 0x28825
cmp dword [rdx + 0x10], r12d
cmovl r12d, dword [rdx + 0x10]
mov rdx, qword [rdx]
test rdx, rdx
jne 0x2880e
cmp r12d, 7
jne 0x28828
xor r12d, r12d
test r12d, r12d
je 0x289b0
lea rcx, [0x00047158]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp r12d, r15d
jge 0x28854
mov r12d, dword [rsp + 0x44]
test esi, esi
jne 0x287a2
jmp 0x2885a
mov r13b, 1
mov dword [rbp], edi
test r13b, r13b
je 0x289cb
mov r12d, dword [rsp + 0x44]
jmp 0x28876
mov dword [rbp], edi
jmp 0x28876
mov dword [rbp], 4
mov r13d, 1
add r15d, r13d
add rbp, 4
cmp r15d, 6
jle 0x2872f
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x70]
mov r8, rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov rdx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
call fcn.00053f74
test eax, eax
js 0x2899c
lea rcx, [0x00047158]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
and dword [rbx + 0x1f8], 0xffffffc0
shr r14d, 2
mov dl, al
lea rax, [rsp + 0x70]
and r14d, 3
mov rcx, qword [rax]
mov qword [rbx + 0x1a4], rcx
mov rcx, qword [rax + 8]
mov qword [rbx + 0x1ac], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x1b4], rcx
mov ecx, dword [rax + 0x18]
mov eax, dword [rsp + 0xf8]
mov dword [rbx + 0x1bc], ecx
mov ecx, dword [rsp + 0x4c]
and eax, 0x1e
mov dword [rbx + 0x1c4], ecx
mov ecx, dword [rsp + 0xe0]
add eax, eax
mov dword [rbx + 0x1c0], ecx
or eax, r14d
lea rcx, [0x00047158]
or dword [rbx + 0x1f8], eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
movabs rax, 0x8000000000000
test qword [rbx], rax
jne 0x2899a
mov rax, qword [rbx]
movabs r8, 0x100000000000000
mov rcx, rax
mov rdx, rax
or rcx, r8
lock cmpxchg qword [rbx], rcx
cmp rdx, rax
jne 0x2897d
xor eax, eax
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor r9d, r9d
mov r8, rbx
mov ecx, 0xa5
lea edx, [r9 + 0x10]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
int3
mov r9d, 1
movsxd rax, r15d
mov r8, rbx
lea edx, [r9 + 0xf]
mov ecx, 0xa5
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
int3