Function at 0x5f4ba0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x5f50af
push rbp
mov rbp, rsp
sub rsp, 0x118
mov qword [rsp + 0x150], rsi
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x168], r10
mov qword [rsp + 0x160], r9
mov qword [rsp + 0x170], r11
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x138], rbx
movups xmmword [rsp + 0xc0], xmm15
mov rdx, rdi
lea rdi, [rsp + 0xc8]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a90
mov rbp, qword [rbp]
mov r12, qword [rsp + 0x128]
mov r13, r12
rol r12w, 8
nop
mov word [rsp + 0x3e], 0
mov word [rsp + 0x3e], r12w
cmp qword [rsp + 0xc0], 0
nop word [rax + rax]
jne 0x5f4e4c
cmp qword [rsp + 0xf0], 0
jne 0x5f509b
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x150], rsi
mov r12, qword [rsp + 0xd8]
add r12, 2
cmp r12, 2
jge 0x5f4d20
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x1b
lea rcx, [0x007116d9]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x150]
mov r8, qword [rsp + 0x158]
mov r9, qword [rsp + 0x160]
mov r10, qword [rsp + 0x168]
mov r11, qword [rsp + 0x170]
mov r13, qword [rsp + 0x128]
cmp byte [rsp + 0xe8], 0
je 0x5f4d94
mov r12, qword [rsp + 0xd8]
add r12, 2
nop word [rax + rax]
nop
cmp qword [rsp + 0xe0], r12
jge 0x5f4d94
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c2b7]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
mov rsi, qword [rsp + 0x150]
mov r8, qword [rsp + 0x158]
jmp 0x5f4e4c
mov r12, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xd8]
lea rdi, [r15 + 2]
mov rcx, qword [rsp + 0xd0]
cmp r12, rdi
jae 0x5f4e2a
mov qword [rsp + 0x50], r15
mov rax, rcx
mov rbx, rdi
mov rcx, r12
mov edi, 2
lea rsi, [0x006a5ea0]
call fcn.0044bd00
mov rdx, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov r8, qword [rsp + 0x158]
mov r9, qword [rsp + 0x160]
mov r10, qword [rsp + 0x168]
mov r11, qword [rsp + 0x170]
mov r13, qword [rsp + 0x128]
mov r15, qword [rsp + 0x50]
mov rdi, rbx
mov r12, rcx
mov rbx, qword [rsp + 0x138]
mov rcx, rax
mov rax, qword [rsp + 0x130]
movzx edx, word [rsp + 0x3e]
mov word [rcx + r15], dx
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0x88], 0
movups xmmword [rsp + 0x90], xmm15
lea rdx, [0x005f5300]
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r8
lea rax, [rsp + 0xc0]
mov ebx, 1
xor ecx, ecx
lea rdi, [rsp + 0x88]
call fcn.0058c3e0
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
lea rdx, [0x005f5120]
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rsp + 0x160]
mov qword [rsp + 0xa8], rdx
mov rdx, qword [rsp + 0x168]
mov qword [rsp + 0xb0], rdx
mov rdx, qword [rsp + 0x170]
mov qword [rsp + 0xb8], rdx
lea rax, [rsp + 0xc0]
mov ebx, 1
xor ecx, ecx
lea rdi, [rsp + 0xa0]
call fcn.0058c3e0
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x5f4f28
mov r8, qword [rsp + 0xc8]
xor r11d, r11d
xor ecx, ecx
xor r9d, r9d
jmp 0x5f4f74
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xf8]
nop dword [rax + rax]
cmp rcx, rax
jb 0x5f5096
mov r9, qword [rsp + 0xd0]
mov r10, qword [rsp + 0xe0]
sub r10, rax
mov r11, r10
neg r10
sar r10, 0x3f
and r10, rax
sub rcx, rax
add r9, r10
xor edx, edx
xor r8d, r8d
test rdx, rdx
je 0x5f4f8b
movups xmmword [rsp + 0x78], xmm15
nop
jne 0x5f5059
jmp 0x5f505d
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rcx
lea rax, [0x006a5ea0]
mov rbx, qword [rsp + 0x128]
mov rcx, rbx
call fcn.0044bc20
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x005fa9e0]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x130]
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x60], rdx
mov rbx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
call fcn.005c67a0
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x128]
mov rdi, rcx
call rdx
test rbx, rbx
jne 0x5f5046
mov rcx, qword [rsp + 0x128]
cmp rax, rcx
jne 0x5f5046
mov rax, qword [rsp + 0x70]
mov rbx, rcx
add rsp, 0x118
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789220]
call fcn.00436ea0
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], r8
lea rax, str.failed_to_construct_HKDF_label:__sinvalid_nested_repetition_operatorinvalid_or_unsupported_Perl_syntaxCM_Get_Device_Interface_List_SizeWcrypto_rsa:_missing_public_modulusadding_nil_Certificate_to_CertPoolx509:_unknown_public_key_algorithmx509:_invalid_certificate_policies_s__q_is_excluded_by_constraint__qx509:_Ed25519_verification_failurex509:_unhandled_critical_extensioncrypto_aes:_invalid_buffer_overlapcrypto_des:_invalid_buffer_overlapcrypto_rc4:_invalid_buffer_overlapinvalid_padding_bits_in_BIT_STRINGGODEBUG_sys_cpu:_can_not_disable__chacha20:_wrong_HChaCha20_key_sizeUsers_of_the_corresponding_process:Norton_AntiVirus_Quarantine_Consolegzip:_invalid_compression_level:__dgzip.Write:_Extra_data_is_too_largeform_data__name__s___filename__s_http:_server_closed_idle_connectionCONTINUATION_frame_with_stream_ID_02006_01_02T15:04:05.999999999Z07:00executable_file_not_found_in__PATH_transform:_short_destination_bufferflate:_corrupt_input_before_offset_persistentalloc:_align_is_too_large_memory_classes_heap_released:bytesgreyobject:_obj_not_pointer_alignedmismatched_begin_end_of_activeSweepmheap.freeSpanLocked___invalid_freeattempt_to_clear_non_empty_span_setruntime:_close_polldesc_w_o_unblockruntime:_inconsistent_read_deadlinefindrunnable:_netpoll_with_spinningpidleput:_P_has_non_empty_run_queuetraceback_did_not_unwind_completelyruntime:_createevent_failed__errnonetwork_dropped_connection_on_resettransport_endpoint_is_not_connectedfile_type_does_not_support_deadlinereflect.MakeSlice_of_non_slice_type1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32_called_with_prec___9mime:_bogus_characters_after___:__qunsupported_signature_algorithm:__vtls:_too_many_non_advancing_recordstls:_server_selected_an_invalid_PSKhpack:_invalid_Huffman_encoded_datadynamic_table_size_update_too_largecant_get_IEnumVARIANT__enum_is_nilSubscribeServiceChangeNotifications__must_separate_successive_digitsbigmod:_modulus_is_smaller_than_natx509:_malformed_extension_OID_fieldx509:_wrong_Ed25519_public_key_sizex509:_invalid_authority_info_accesscrypto_md5:_invalid_hash_state_sizetoo_many_Questions_to_pack___65535_P224_point_is_the_point_at_infinityP256_point_is_the_point_at_infinityP384_point_is_the_point_at_infinityP521_point_is_the_point_at_infinitysuperfluous_leading_zeros_in_lengthchacha20:_output_smaller_than_inputjson:_encoding_error_for_type__q:__qhttp:_unexpected_EOF_reading_trailer_LastStreamID_v_ErrCode_v_Debug_qRoundTrip_retrying_after_failure:__vno_acceptable_authentication_methodsstrings.Builder.Grow:_negative_countstrings:_Join_output_length_overflowTime.UnmarshalBinary:_invalid_lengthlfstack_node_allocated_from_the_heap__is_larger_than_maximum_page_size__key_size_not_a_multiple_of_key_alignruntime:_invalid_typeBitsBulkBarrieruncaching_span_but_s.allocCount__0_memory_classes_metadata_other:bytesuser_arena_span_is_on_the_wrong_listruntime:_marked_free_object_in_span_runtime:_unblock_on_closing_polldescruntime:_inconsistent_write_deadlineUnable_to_determine_system_directoryruntime:_VirtualQuery_failed__errnoruntime:_sudog_with_non_nil_waitlinkruntime:_mcall_called_on_m__g0_stackstartm:_P_required_for_spinningtrue__is_not_Grunnable_or_Gscanrunnable_nruntime:_bad_notifyList_size___syncaccessed_data_from_freed_user_arena_runtime:_wrong_goroutine_in_newstackruntime:_invalid_pc_encoded_table_faccessing_a_corrupted_shared_librarymethod_ABI_and_value_ABI_dont_align444089209850062616169452667236328125ryuFtoaFixed64_called_with_prec___180123456789abcdefghijklmnopqrstuvwxyzreflect:_NumField_of_non_struct_typemalformed_MIME_header_initial_line:_expected_an_ECDSA_public_key__got__Tunsupported_SSLv2_handshake_receivedtls:_server_did_not_send_a_key_shareinvalid_pattern_syntax___after___:_no_assembly_implementation_availablex509:_zero_or_negative_DSA_parameterx509:_invalid_CRL_distribution_pointx509:_invalid_subject_key_identifierx509:_malformed_algorithm_identifiercrypto_cipher:_input_not_full_blockscrypto_sha1:_invalid_hash_state_sizecrypto_sha512:_invalid_hash_functioncompressed_name_in_SRV_resource_dataedwa
mov ebx, 0x22
lea rcx, [rsp + 0x78]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
test rax, rax
je 0x5f5091
mov rax, qword [rax + 8]
call fcn.00436ea0
call fcn.00467820
lea rax, [0x006a5b60]
lea rbx, [0x00789210]
call fcn.00436ea0
nop
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], r11
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
jmp fcn.005f4ba0