Function at 0x140058890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
mov ecx, 0x437f
mov rdi, rdx
xor ebx, ebx
call fcn.140029ab4
mov ecx, 0x4223
mov rsi, rax
call fcn.140029ab4
mov r14, rax
test rsi, rsi
jne 0x140058959
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x50], 0x6f0049
mov dword [rbp - 0x4c], 0x650047
mov dword [rbp - 0x48], 0x440074
mov dword [rbp - 0x44], 0x760065
mov dword [rbp - 0x40], 0x630069
mov dword [rbp - 0x3c], 0x410065
mov dword [rbp - 0x38], 0x740074
mov dword [rbp - 0x34], 0x630061
mov dword [rbp - 0x30], 0x6d0068
mov dword [rbp - 0x2c], 0x6e0065
mov dword [rbp - 0x28], 0x420074
mov dword [rbp - 0x24], 0x730061
mov dword [rbp - 0x20], 0x520065
mov qword [rbp - 0x1c], 0x660065
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rsi, rax
test r14, r14
cmove r14, qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test r15, r15
je 0x140058b00
test rsi, rsi
je 0x140058b00
test r14, r14
je 0x140058b00
mov rcx, r15
call rsi
test rax, rax
je 0x140058ade
mov qword [rdi], rax
mov rsi, qword [rax + 8]
mov rcx, rax
call r14
test rsi, rsi
je 0x140058b00
mov r15, qword [rsi + 0x30]
test r15, r15
je 0x140058b00
mov r15, qword [r15]
cmp rsi, r15
jne 0x1400589d0
mov qword [rdi + 8], rsi
mov rax, qword [rsi + 0x60]
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 0xe8]
jmp 0x140058afa
test r15, r15
je 0x140058b00
mov edx, 0x100000
mov ecx, 1
call fcn.140077530
mov r14, rax
test rax, rax
je 0x140058b00
mov edx, 0x100000
mov rcx, rax
mov dword [rax], ebx
call fcn.14003b950
cmp al, 1
jne 0x140058ad4
mov qword [rdi + 8], r15
mov edx, dword [r14]
mov ecx, ebx
test edx, edx
je 0x140058a48
mov r10, qword [r15 + 0x60]
mov eax, ecx
imul r8, rax, 0x228
mov r9, qword [r8 + r14 + 0x20]
cmp r10, r9
jbe 0x140058a3c
mov eax, dword [r8 + r14 + 0x28]
add rax, r9
cmp r10, rax
jb 0x140058a44
inc ecx
cmp ecx, edx
jae 0x140058a48
jmp 0x140058a1c
mov qword [rdi + 8], rsi
mov rax, qword [r15 + 0x60]
mov ecx, ebx
mov qword [rdi + 0x10], rax
mov r8d, dword [r14]
test r8d, r8d
je 0x140058a8b
mov rdx, qword [rsi + 0x60]
mov eax, ecx
imul r9, rax, 0x228
mov r10, qword [r9 + r14 + 0x20]
cmp rdx, r10
jbe 0x140058a7e
mov eax, dword [r9 + r14 + 0x28]
add rax, r10
cmp rdx, rax
jb 0x140058a87
inc ecx
cmp ecx, r8d
jae 0x140058a8b
jmp 0x140058a5e
mov qword [rdi + 0x10], rdx
mov rax, qword [r15 + 0xe8]
mov qword [rdi + 0x18], rax
mov r9d, dword [r14]
test r9d, r9d
je 0x140058ad2
mov rcx, qword [rsi + 0xe8]
mov eax, ebx
imul rdx, rax, 0x228
mov r8, qword [rdx + r14 + 0x20]
cmp rcx, r8
jbe 0x140058ac5
mov eax, dword [rdx + r14 + 0x28]
add rax, r8
cmp rcx, rax
jb 0x140058ace
inc ebx
cmp ebx, r9d
jae 0x140058ad2
jmp 0x140058aa5
mov qword [rdi + 0x18], rcx
mov bl, 1
mov rcx, r14
call fcn.140077564
jmp 0x140058b00
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140058b00
mov qword [rdi + 8], rcx
mov rax, qword [rcx + 0x60]
mov qword [rdi + 0x10], rax
mov rax, qword [rcx + 0xe8]
mov bl, 1
mov qword [rdi + 0x18], rax
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret