Function at 0x5da5e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5da933
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rcx, qword [rax]
cmp qword [rcx + 0x58], 0
nop word [rax + rax]
jg 0x5da8f5
cmp qword [rax + 0x28], 0
je 0x5da8e2
mov rdx, qword [rax + 0x20]
cmp qword [rdx + 0x198], 1
nop dword [rax]
jne 0x5da8e2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x50], rax
call fcn.005da960
test rax, rax
jne 0x5da8dc
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x78]
mov rax, qword [rdx + 0x18]
call fcn.00545980
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x80], rax
cmp dword [0x009d9570], 0
je 0x5da678
call fcn.004673c0
mov qword [r11], rbx
mov rdx, qword [rcx + 0x88]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x38], rbx
mov qword [rcx + 0x88], rbx
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x30], rdx
mov rsi, qword [rcx + 0x80]
lea rax, [0x006bbd00]
mov rbx, rsi
nop
call fcn.0040b0e0
mov rbx, qword [rsp + 0x30]
mov rcx, rax
mov rdi, qword [rsp + 0x38]
lea rax, [0x0078b498]
call fcn.005f3900
nop
test rax, rax
jne 0x5da8d6
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rdx + 0x28]
cmp qword [0x0096d668], rcx
je 0x5da6e3
xor ecx, ecx
jmp 0x5da6fa
mov rbx, qword [0x0096d660]
mov rax, qword [rdx + 0x20]
call fcn.00403960
mov ecx, eax
mov rax, qword [rsp + 0x50]
test cl, cl
je 0x5da75b
mov rcx, qword [rax]
cmp qword [rcx + 0x20], 0
je 0x5da70e
xor ecx, ecx
xor ebx, ebx
jmp 0x5da731
cmp byte [rax + 0x71], 0
je 0x5da71a
xor ecx, ecx
xor ebx, ebx
jmp 0x5da731
mov byte [rax + 0x71], 1
mov rcx, qword [rax]
mov rax, rcx
call fcn.005d0560
mov rcx, rax
mov rax, qword [rsp + 0x50]
test rcx, rcx
jne 0x5da752
call fcn.005dad00
nop dword [rax + rax]
test rax, rax
jne 0x5da74c
mov rax, qword [rsp + 0x50]
jmp 0x5da75b
add rsp, 0x40
pop rbp
ret
mov rax, rcx
add rsp, 0x40
pop rbp
ret
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], rcx
mov rbx, qword [rax + 0x80]
mov rdx, qword [rax + 0x88]
mov qword [rsp + 0x38], rdx
lea rax, [0x006bbd00]
nop
call fcn.0040b0e0
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rdi, qword [rsp + 0x38]
lea rax, [0x0078b4c0]
call fcn.005f3900
nop
test rax, rax
jne 0x5da8d0
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x320], 1
mov rax, qword [rsp + 0x50]
call fcn.005dba60
nop
test rax, rax
jne 0x5da8ca
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
cmp qword [rcx + 0x20], 0
je 0x5da7de
xor ecx, ecx
xor ebx, ebx
jmp 0x5da801
cmp byte [rax + 0x71], 0
je 0x5da7ea
xor ecx, ecx
xor ebx, ebx
jmp 0x5da801
mov byte [rax + 0x71], 1
mov rcx, qword [rax]
mov rax, rcx
call fcn.005d0560
mov rcx, rax
mov rax, qword [rsp + 0x50]
test rcx, rcx
jne 0x5da8c1
call fcn.005dc000
test rax, rax
jne 0x5da8bb
mov rax, qword [rsp + 0x50]
nop dword [rax]
call fcn.005dc8a0
test rax, rax
jne 0x5da8b5
mov rax, qword [rsp + 0x50]
call fcn.005dd040
test rax, rax
jne 0x5da8af
mov rax, qword [rsp + 0x50]
call fcn.005dd7e0
test rax, rax
jne 0x5da8a9
mov rax, qword [rsp + 0x50]
call fcn.005ddc80
test rax, rax
jne 0x5da8a3
mov rax, qword [rsp + 0x50]
call fcn.005de240
test rax, rax
jne 0x5da89d
mov rax, qword [rsp + 0x20]
call fcn.005cf760
test rbx, rbx
je 0x5da885
mov rax, rbx
mov rbx, rcx
add rsp, 0x40
pop rbp
ret
nop
mov ecx, 1
mov rdx, qword [rsp + 0x20]
xchg dword [rdx + 0x28], ecx
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
mov rax, rcx
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
add rsp, 0x40
pop rbp
ret
mov rax, rcx
mov ebx, 0x50
call fcn.005cf280
add rsp, 0x40
pop rbp
ret
mov rax, rcx
mov ebx, 0x46
nop dword [rax]
call fcn.005cf280
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x2f
lea rcx, [0x0071a7d9]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.005da5e0