Function at 0x4835c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4838d9
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
test rcx, rcx
jne 0x48362a
mov rdx, qword [rax + 0x30]
sub rdx, qword [rax + 0x28]
test rdx, rdx
jg 0x48361e
mov rbx, qword [rax + 0x38]
mov rcx, qword [rax + 0x40]
mov qword [rax + 0x38], 0
cmp dword [0x009d9570], 0
je 0x48360e
mov rdx, qword [rax + 0x40]
call fcn.004673a0
mov qword [r11], rdx
mov qword [rax + 0x40], 0
xor eax, eax
add rsp, 0x28
pop rbp
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x38], rax
mov rsi, qword [rax + 0x28]
cmp qword [rax + 0x30], rsi
jne 0x4837cf
mov rdx, qword [rax + 0x38]
mov rsi, qword [rax + 0x40]
test rdx, rdx
je 0x48367e
mov qword [rax + 0x38], 0
cmp dword [0x009d9570], 0
je 0x483668
mov rdi, qword [rax + 0x40]
nop
call fcn.004673a0
mov qword [r11], rdi
mov qword [rax + 0x40], 0
xor eax, eax
mov rbx, rdx
mov rcx, rsi
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rbx
cmp qword [rax + 8], rcx
jg 0x483736
mov rdx, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
mov rdx, qword [rdx + 0x18]
mov rax, rsi
call rdx
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x38], rbx
cmp dword [0x009d9570], 0
je 0x4836c5
call fcn.004673c0
mov qword [r11], rcx
mov rsi, qword [rdx + 0x40]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x40], rcx
test rax, rax
jl 0x4838b7
jle 0x4836ff
lea rsi, [rax - 1]
mov rcx, qword [rsp + 0x48]
nop dword [rax]
cmp rcx, rsi
jbe 0x4838af
mov rsi, qword [rsp + 0x40]
movzx esi, byte [rsi + rax - 1]
mov qword [rdx + 0x48], rsi
mov qword [rdx + 0x50], 0xffffffffffffffff
mov rbx, qword [rdx + 0x38]
mov rcx, qword [rdx + 0x40]
mov qword [rdx + 0x38], 0
cmp dword [0x009d9570], 0
je 0x483728
mov rsi, qword [rdx + 0x40]
nop dword [rax]
call fcn.004673a0
mov qword [r11], rsi
mov qword [rdx + 0x40], 0
add rsp, 0x28
pop rbp
ret
movups xmmword [rax + 0x28], xmm15
mov rdx, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
mov rdx, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rax, rsi
call rdx
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x38], rbx
cmp dword [0x009d9570], 0
je 0x483779
call fcn.004673c0
mov qword [r11], rcx
mov rsi, qword [rdx + 0x40]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x40], rcx
nop dword [rax]
test rax, rax
jl 0x483890
jne 0x4837be
mov rbx, qword [rdx + 0x38]
mov qword [rdx + 0x38], 0
cmp dword [0x009d9570], 0
nop
je 0x4837ae
mov rsi, qword [rdx + 0x40]
call fcn.004673a0
mov qword [r11], rsi
mov qword [rdx + 0x40], 0
xor eax, eax
add rsp, 0x28
pop rbp
ret
add qword [rdx + 0x30], rax
mov rax, rdx
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
nop word [rax + rax]
cmp rsi, rdx
ja 0x483888
mov rdi, qword [rax + 0x28]
cmp rsi, rdi
jb 0x48387d
mov r8, qword [rax]
sub rsi, rdi
mov r9, rdi
sub rdi, rdx
sar rdi, 0x3f
and r9, rdi
lea rdx, [r8 + r9]
cmp rcx, rsi
jg 0x483815
mov rsi, rcx
cmp rbx, rdx
je 0x483837
mov qword [rsp + 0x20], rsi
mov rax, rbx
mov rbx, rdx
mov rcx, rsi
call fcn.00468160
mov rax, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
mov rdx, qword [rax + 0x28]
lea rdi, [rsi + rdx]
mov qword [rax + 0x28], rdi
mov rcx, qword [rax + 8]
lea rdx, [rsi + rdx]
lea rdx, [rdx - 1]
cmp rcx, rdx
jbe 0x483875
mov rdx, qword [rax]
movzx edx, byte [rdi + rdx - 1]
mov qword [rax + 0x48], rdx
mov qword [rax + 0x50], 0xffffffffffffffff
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x28
pop rbp
ret
mov rax, rdx
call fcn.00467760
mov rax, rdi
mov rcx, rsi
call fcn.00467820
mov rcx, rsi
call fcn.004677e0
mov rcx, qword [0x0096bd30]
test rcx, rcx
je 0x4838a0
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0096bd38]
mov rax, rcx
call fcn.00436ea0
mov rax, rsi
call fcn.00467760
mov rcx, qword [0x0096bd30]
nop
test rcx, rcx
je 0x4838c9
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0096bd38]
mov rax, rcx
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004835c0