Function at 0x180049530
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
push r13
lea rbp, [rax - 0x5f]
sub rsp, 0x88
cmp dword [rdx + 0x28], 0
mov r13, rcx
mov qword [rax - 0x28], r15
mov r15, rdx
je 0x18004975b
cmp qword [rdx + 0x20], 0
je 0x18004975b
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r12
mov r12d, 2
mov qword [rax + 0x20], r14
lea r14, [rcx + 0x11b8]
nop dword [rax + rax]
mov rbx, qword [r15 + 0x20]
test rbx, rbx
je 0x180049603
test r14, r14
je 0x180049603
cmp byte [rbx], 0
je 0x180049603
movzx edi, byte [r14]
mov r11, rbx
sub r11, r14
nop dword [rax]
mov rax, r14
test dil, dil
je 0x1800495f3
nop dword [rax + rax]
movzx r10d, byte [r11 + rax]
test r10b, r10b
je 0x1800495f3
movzx r8d, byte [rax]
lea edx, [r8 - 0x61]
cmp dl, 0x19
lea ecx, [r8 - 0x20]
movzx r9d, cl
lea ecx, [r10 - 0x20]
cmova r9d, r8d
movzx edx, cl
lea r8d, [r10 - 0x61]
cmp r8b, 0x19
cmova edx, r10d
cmp dl, r9b
jne 0x1800495f3
inc rax
cmp byte [rax], 0
jne 0x1800495b0
jmp 0x180049605
cmp byte [rax], 0
je 0x180049605
inc rbx
inc r11
cmp byte [rbx], 0
jne 0x1800495a0
xor ebx, ebx
xor eax, eax
lea rdi, [r14 + 0x120]
test rbx, rbx
setne al
mov dword [r14 - 0x18], eax
mov rbx, qword [r15 + 0x20]
test rbx, rbx
je 0x180049691
test rdi, rdi
je 0x180049691
cmp byte [rbx], 0
je 0x180049691
movzx esi, byte [rdi]
mov r11, rbx
sub r11, rdi
mov r10, rdi
test sil, sil
je 0x180049680
nop dword [rax]
movzx edx, byte [r11 + r10]
test dl, dl
je 0x180049680
movzx r9d, byte [r10]
lea ecx, [rdx - 0x61]
cmp cl, 0x19
lea eax, [rdx - 0x20]
movzx r8d, al
cmova r8d, edx
lea edx, [r9 - 0x61]
cmp dl, 0x19
lea eax, [r9 - 0x20]
movzx ecx, al
cmova ecx, r9d
cmp r8b, cl
jne 0x180049680
inc r10
cmp byte [r10], 0
jne 0x180049640
jmp 0x180049693
cmp byte [r10], 0
je 0x180049693
inc rbx
inc r11
cmp byte [rbx], 0
jne 0x180049634
xor ebx, ebx
xor eax, eax
lea rdi, [r14 + 0x240]
test rbx, rbx
setne al
mov dword [r14 + 0x108], eax
mov rbx, qword [r15 + 0x20]
test rbx, rbx
je 0x180049721
test rdi, rdi
je 0x180049721
cmp byte [rbx], 0
je 0x180049721
movzx esi, byte [rdi]
mov r11, rbx
sub r11, rdi
mov r10, rdi
test sil, sil
je 0x180049710
nop dword [rax]
movzx edx, byte [r11 + r10]
test dl, dl
je 0x180049710
movzx r9d, byte [r10]
lea ecx, [rdx - 0x61]
cmp cl, 0x19
lea eax, [rdx - 0x20]
movzx r8d, al
cmova r8d, edx
lea edx, [r9 - 0x61]
cmp dl, 0x19
lea eax, [r9 - 0x20]
movzx ecx, al
cmova ecx, r9d
cmp r8b, cl
jne 0x180049710
inc r10
cmp byte [r10], 0
jne 0x1800496d0
jmp 0x180049723
cmp byte [r10], 0
je 0x180049723
inc rbx
inc r11
cmp byte [rbx], 0
jne 0x1800496c5
xor ebx, ebx
xor eax, eax
test rbx, rbx
setne al
mov dword [r14 + 0x228], eax
add r14, 0x360
sub r12, 1
jne 0x180049580
mov r14, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
lea rdx, [r13 + 0x80]
mov rcx, r13
call fcn.18004df00
mov r15, qword [rsp + 0x80]
lea rbx, [r13 + 0x11a8]
mov edi, 6
nop
cmp qword [rbx + 8], 0
je 0x180049944
cmp dword [rbx - 8], 0
jne 0x18004990e
cmp qword [rbx], 0
je 0x180049944
movdqa xmm1, xmmword [0x1800bb9e0]
xor eax, eax
movdqa xmm0, xmmword [0x1800bb370]
movdqu xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0x453c4838
movdqa xmm1, xmmword [0x1800babe0]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp + 0x2b], 0x3645
mov byte [rbp + 0x2d], 0
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + rax + 7]
psubb xmm0, xmm1
movdqu xmmword [rbp + rax + 7], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x1800497e0
cmp rax, 0x26
jae 0x18004980e
add byte [rbp + rax + 7], 0xfd
inc rax
cmp rax, 0x26
jb 0x180049800
mov qword [rbp - 9], 0
lea rax, [rbp + 7]
mov qword [rbp - 1], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbp - 0x19], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180049830
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.18000b0f0
lea rdx, [rbp - 0x19]
call fcn.18000a540
mov rcx, qword [rbx]
xor edx, edx
call rax
mov rax, qword [rbx]
test rax, rax
je 0x180049944
cmp rax, 0xffffffffffffffff
je 0x180049944
movdqa xmm0, xmmword [0x1800bb700]
mov eax, 0x10
psubb xmm0, xmmword [0x1800baca0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x4b404b40
mov dword [rbp - 5], 0x3838394c
mov dword [rbp - 1], 0x4c3f4848
mov word [rbp + 3], 0x3c4d
mov byte [rbp + 5], 0
nop word [rax + rax]
add byte [rbp + rax - 0x19], 0xf9
inc rax
cmp rax, 0x1e
jb 0x1800498b0
mov qword [rbp + 0x17], 0
lea rax, [rbp - 0x19]
mov qword [rbp + 0x1f], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbp + 7], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800498e0
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.18000b0f0
lea rdx, [rbp + 7]
call fcn.18000a540
mov rcx, qword [rbx]
call rax
mov qword [rbx], 0
jmp 0x180049944
mov rcx, qword [rbx]
xor edx, edx
call fcn.18000d0b0
cmp eax, 0x102
je 0x180049944
mov r8, qword [rbx + 8]
mov r9, r13
mov qword [rsp + 0x28], 0
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
add rbx, 0x120
sub rdi, 1
jne 0x180049780
mov rcx, r13
call fcn.1800488b0
lea eax, [rdi + 1]
add rsp, 0x88
pop r13
pop rdi
pop rbx
pop rbp
ret