joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422340
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42258e
push rbp
mov rbp, rsp
sub rsp, 0x60
movsd qword [rsp + 0x78], xmm0
mov qword [rsp + 0x70], rax
test byte [rax], al
nop
call fcn.0040b6c0
mov rcx, r14
mov rax, qword [rsp + 0x70]
cmp qword [rax + 8], rcx
jne 0x42257c
movsd xmm0, qword [0x00788430]
movsd xmm1, qword [rsp + 0x78]
ucomisd xmm0, xmm1
jbe 0x422393
movsd xmm1, qword [0x00788430]
movsd qword [rsp + 0x58], xmm1
movsd xmm0, qword [rax + 0x30]
divsd xmm1, xmm0
cvttsd2si rcx, xmm1
mov qword [rsp + 0x48], rcx
cmp qword [rax + 0x80], 0
je 0x4223d8
nop
nop
call fcn.0040b8e0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x80]
mov rbx, qword [rdx]
mov rax, qword [rsp + 0x48]
call rbx
jmp 0x4224ae
nop
call fcn.00469020
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rsp]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x48]
add rbx, rdx
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov r10, qword [rcx + 0x30]
nop
mov rax, rcx
mov rcx, rsi
mov rsi, r8
mov r8, r9
mov r9, r10
call fcn.00454aa0
mov rbx, qword [rsp + 0x70]
mov byte [rbx + 0x10], 1
nop
lea rax, [0x0073ad10]
mov ecx, 0x13
mov edi, 0x13
mov esi, 2
call fcn.0043a2c0
call fcn.00469020
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
mov qword [rsp + 0x40], rax
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040b6c0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.00454460
nop
nop
mov rax, qword [rsp + 0x70]
call fcn.0040b8e0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rcx + 0x70]
test rbx, rbx
jle 0x4224e6
movsd xmm0, qword [rsp + 0x58]
cvttsd2si rdx, xmm0
add rax, rdx
cmp rbx, rax
jge 0x4224d9
mov qword [rcx + 0x70], 0
jmp 0x4224e0
sub rbx, rax
mov qword [rcx + 0x70], rbx
add rsp, 0x60
pop rbp
ret
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd xmm1, qword [rsp + 0x58]
addsd xmm0, xmm1
movsd qword [rsp + 0x50], xmm0
mov rdx, qword [rcx + 0x98]
mov rax, qword [rdx]
call rax
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm2, qword [rsp + 0x50]
mulsd xmm0, xmm2
movsd xmm1, qword [rsp + 0x58]
divsd xmm1, xmm0
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x38]
movups xmm0, xmm1
movsd xmm1, qword [0x007883c8]
mov rax, rcx
nop dword [rax]
call fcn.00423ec0
mov rcx, qword [rsp + 0x70]
movsd qword [rcx + 0x30], xmm0
test al, al
jne 0x422576
movsd xmm0, qword [0x007883c0]
movsd qword [rcx + 0x30], xmm0
movabs rdx, 0x12a05f200
mov qword [rcx + 0x70], rdx
mov rax, rcx
call fcn.004225c0
add rsp, 0x60
pop rbp
ret
lea rax, [0x0071a603]
mov ebx, 0x2f
call fcn.00437620
nop
mov qword [rsp + 8], rax
movsd qword [rsp + 0x10], xmm0
call fcn.004654a0
mov rax, qword [rsp + 8]
movsd xmm0, qword [rsp + 0x10]
jmp fcn.00422340
Function at 0x422620
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4227ae
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
test byte [rax], al
nop
call fcn.0040b6c0
mov rcx, r14
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], rcx
jne 0x42279c
nop
call fcn.0040b8e0
xorps xmm0, xmm0
xor eax, eax
jmp 0x422664
movups xmm0, xmm1
mov rax, rcx
movsd xmm1, qword [0x00788430]
ucomisd xmm1, xmm0
jbe 0x422766
movsd qword [rsp + 0x18], xmm0
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x90]
mov rcx, qword [rdx]
call rcx
test al, al
jne 0x422759
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x88]
mov rbx, qword [rdx]
mov eax, 0x10000
call rbx
test rbx, rbx
jne 0x422713
mov rcx, qword [0x009d91b0]
nop dword [rax]
test rcx, rcx
je 0x422797
mov rdx, rax
mov rbx, rdx
xor edx, edx
div rcx
test rax, rax
jl 0x4226e3
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
jmp 0x4226fb
mov rcx, rax
and eax, 1
shr rcx, 1
or rcx, rax
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movsd xmm2, qword [0x00788418]
mulsd xmm1, xmm2
movsd xmm3, qword [rsp + 0x18]
addsd xmm1, xmm3
jmp 0x422730
xorps xmm1, xmm1
cvtsi2sd xmm1, rbx
movsd xmm2, qword [rsp + 0x18]
addsd xmm1, xmm2
mov rbx, rax
movsd xmm2, qword [0x00788418]
mov rcx, qword [rsp + 0x10]
add rcx, rbx
nop dword [rax + rax]
cmp rbx, 0x10000
jb 0x42276c
cmp qword [0x009d92f8], 0
je 0x42265e
jmp 0x42276c
mov rcx, qword [rsp + 0x10]
movsd xmm1, qword [rsp + 0x18]
jmp 0x42276c
mov rcx, rax
movups xmm1, xmm0
test rcx, rcx
jbe 0x42277a
cmp qword [0x009d91b0], rcx
ja 0x422786
mov rax, rcx
movups xmm0, xmm1
add rsp, 0x20
pop rbp
ret
lea rax, [0x00719f81]
mov ebx, 0x2e
call fcn.00437620
call fcn.00435ba0
lea rax, [0x00719a30]
mov ebx, 0x2d
call fcn.00437620
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00422620
Function at 0x422880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422986
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4228c3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42297b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00423660
test rax, rax
je 0x42297b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x004229c0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00465360
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x422969
xor eax, eax
jmp 0x422973
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4228b1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00422880
Function at 0x424680
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4247ea
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [0x009ab480], ebx
je 0x4246a2
jmp 0x4247d8
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
cmp ecx, 0x80000000
jae 0x4247c7
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42469f
cmp edx, 0x80000000
jne 0x4247c1
cmp dword [0x009d9974], 0
nop
jle 0x4247bb
nop
mov rax, qword [0x009da0a8]
mov rcx, rax
shr rax, 0x14
mov qword [rsp + 0x28], rax
mov rdx, qword [0x009ab4a8]
mov qword [rsp + 0x10], rdx
mov rbx, qword [0x009ab4b8]
sub rcx, rbx
shr rcx, 0x14
mov qword [rsp + 0x20], rcx
movsd xmm0, qword [0x009ab4c0]
movsd qword [rsp + 0x18], xmm0
call fcn.00438fc0
lea rax, [0x00713a1b]
mov ebx, 0x1f
call fcn.00439840
mov rax, qword [rsp + 0x28]
call fcn.00439580
lea rax, [0x0070956f]
mov ebx, 0xe
call fcn.00439840
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.00439580
lea rax, [0x0070ecde]
mov ebx, 0x17
call fcn.00439840
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00439580
lea rax, [0x0070743e]
mov ebx, 0xa
call fcn.00439840
movsd xmm0, qword [rsp + 0x18]
nop dword [rax]
call fcn.004392a0
lea rax, [0x0070858a]
mov ebx, 0xc
call fcn.00439840
call fcn.00439020
add rsp, 0x30
pop rbp
ret
add rsp, 0x30
pop rbp
ret
lea rax, [0x00715877]
mov ebx, 0x23
call fcn.00437620
lea rax, [0x0071b01a]
mov ebx, 0x31
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.004654a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00424680
Function at 0x427e20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x427f38
push rbp
mov rbp, rsp
sub rsp, 0x10
xor edx, edx
jmp 0x427e50
sub r11, rbx
mov rdi, r11
shr r11, 0xd
lea rbx, [rdi + r9]
sub r10, r11
mov rax, rcx
mov rcx, r10
mov edx, r12d
test rcx, rcx
jbe 0x427ed9
test byte [rax], al
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
nop
cmp rdi, 0x40
jae 0x427f2a
mov rdi, qword [rax + rdi*8 + 0x10198]
test byte [rdi], al
mov r9, rbx
and ebx, 0x3fffff
mov r10, rcx
shl rcx, 0xd
lea r11, [rcx + rbx]
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x114c8]
cmp r8, rbx
seta r12b
or r12d, edx
nop dword [rax + rax]
cmp r11, 0x400000
jbe 0x427ee7
mov r11d, 0x400000
jmp 0x427ee7
mov rcx, rax
jmp 0x427e36
mov eax, edx
add rsp, 0x10
pop rbp
ret
mov rax, rcx
mov r8, rdx
cmp r11, r8
jbe 0x427ed1
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x114c8], r11
sete dl
nop
test dl, dl
jne 0x427e36
mov rdx, qword [rdi + 0x114c8]
cmp rdx, r11
ja 0x427ee1
cmp rdx, rbx
jbe 0x427ee1
lea rax, [0x0071b842]
mov ebx, 0x33
call fcn.00437620
mov rax, rdi
mov ecx, 0x40
call fcn.00467780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.00427e20
Function at 0x429020
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429166
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
jne 0x429084
nop dword [rax + rax]
cmp qword [rax], rbx
jne 0x42904d
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x429057
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
cmp qword [rax + 8], rbx
jne 0x429067
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x429072
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.00438fc0
lea rax, [0x00719a5d]
mov ebx, 0x2d
call fcn.00439840
mov rax, qword [rsp + 0x18]
call fcn.00439580
lea rax, [0x00705350]
mov ebx, 6
call fcn.00439840
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.00439800
lea rax, [0x00705356]
mov ebx, 6
call fcn.00439840
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00439800
lea rax, [0x00707c78]
mov ebx, 0xb
call fcn.00439840
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00439800
lea rax, [0x0070535c]
mov ebx, 6
call fcn.00439840
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00439800
call fcn.00439200
call fcn.00439020
lea rax, [0x0070a60a]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00429020
Function at 0x42f160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f270
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x42f1b5
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov eax, 6
call fcn.0043c4a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x42f1cd
test dil, dil
jmp 0x42f25b
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0042f2c0]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00465360
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x42f265
nop dword [rax]
call fcn.0043c620
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.0042f160

Function at 0x4305e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430706
push rbp
mov rbp, rsp
sub rsp, 0x20
nop
mov rcx, qword [rax + 0x20]
mov rdx, rcx
shr rcx, 0x20
nop
nop
cmp edx, ecx
ja 0x430696
shr ecx, 9
mov rdx, qword [rax + 0x10]
cmp rdx, rcx
jbe 0x43065e
nop
nop
mov rdx, qword [rax + 8]
lea rcx, [rdx + rcx*8]
nop
nop
mov rbx, qword [rcx]
test rbx, rbx
je 0x43065e
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x430685
mov edx, dword [rbx + 0x10]
cmp edx, 0x200
je 0x430673
mov qword [rsp + 0x30], rax
nop
nop
xor edx, edx
xchg qword [rcx], rdx
nop
nop
xor ecx, ecx
xchg dword [rbx + 0x10], ecx
lea rax, [0x009d9220]
call fcn.0040b440
mov rax, qword [rsp + 0x30]
nop
nop
xor ecx, ecx
xchg qword [rax + 0x20], rcx
nop
xor ecx, ecx
xchg qword [rax + 0x10], rcx
add rsp, 0x20
pop rbp
ret
lea rax, [0x0071b04b]
mov ebx, 0x31
nop
call fcn.00437620
lea rax, [0x0071bbab]
mov ebx, 0x34
call fcn.00437620
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
call fcn.00438fc0
lea rax, [0x00705b21]
mov ebx, 7
call fcn.00439840
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00439580
lea rax, [0x00706e3b]
mov ebx, 9
call fcn.00439840
mov rax, qword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x007158bd]
mov ebx, 0x23
nop dword [rax + rax]
call fcn.00437620
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004305e0
Function at 0x430c00
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x430e86
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x430e7a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x009d90f8], 0
jne 0x430c5a
xor edx, edx
xor ebx, ebx
jmp 0x430ca0
xor edx, edx
jmp 0x430c85
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041fd20
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x430c5e
add rax, 0x1268
call fcn.00430b80
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x430e14
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x430c9b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00414000
test rax, rax
jne 0x430cec
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x430c9b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x430d2c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x430c9b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x430e6d
lea r10, [0x009ab4d8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x430daf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x430de5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x430c9b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x430e65
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x430c9b
cmp rbx, 0x200
ja 0x430e54
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00426560
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.00430b80
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.004677e0
mov rax, r8
call fcn.00467760
mov rax, r8
mov ecx, 0x40
call fcn.00467780
mov edx, 0x200
nop
call fcn.004677c0
nop
mov qword [rsp + 8], rax
call fcn.0046c080
mov rax, qword [rsp + 8]
jmp fcn.00430c00
Function at 0x4318c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43198d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rax, qword [sym.imp.kernel32.dll_CreateIoCompletionPort]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
call fcn.004348e0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x0091e580], rax
test rax, rax
je 0x431924
add rsp, 0x38
pop rbp
ret
call fcn.00468c00
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438fc0
lea rax, [0x0071a632]
mov ebx, 0x2f
call fcn.00439840
mov rax, qword [rsp + 0x30]
nop
call fcn.00439580
lea rax, [0x0070463d]
mov ebx, 3
call fcn.00439840
call fcn.00439020
lea rax, [0x007113af]
mov ebx, 0x1b
call fcn.00437620
nop
call fcn.004654a0
jmp fcn.004318c0

Function at 0x431a40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431b2d
push rbp
mov rbp, rsp
sub rsp, 0x38
xor eax, eax
lea rcx, [0x009d9138]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
jne 0x431a71
add rsp, 0x38
pop rbp
ret
mov rax, qword [0x0091e580]
mov rcx, qword [sym.imp.kernel32.dll_PostQueuedCompletionStatus]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.004348e0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x431abc
add rsp, 0x38
pop rbp
ret
nop dword [rax]
call fcn.00468c00
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
nop
call fcn.00438fc0
lea rax, [0x0071d0af]
mov ebx, 0x3c
call fcn.00439840
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00439580
lea rax, [0x0070463d]
mov ebx, 3
call fcn.00439840
call fcn.00439020
lea rax, [0x0071b875]
mov ebx, 0x33
call fcn.00437620
nop
call fcn.004654a0
jmp fcn.00431a40
Function at 0x433020
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4332c8
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.00431fa0
cmp dword [0x009d9570], 0
je 0x43309a
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [0x00983bb8]
mov qword [r11 + 8], rdx
mov qword [0x00983bb8], rax
test rax, rax
je 0x4332b6
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.00431fa0
cmp dword [0x009d9570], 0
je 0x43310a
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [0x00983bc0]
mov qword [r11 + 8], rdx
mov qword [0x00983bc0], rax
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.00431fa0
cmp dword [0x009d9570], 0
je 0x433183
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [0x00983bc8]
mov qword [r11 + 8], rcx
mov qword [0x00983bc8], rax
cmp qword [0x00983bc0], 0
je 0x4332a5
nop dword [rax + rax]
test rax, rax
je 0x4332a5
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00434760
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop dword [rax]
test rax, rax
je 0x433292
cmp rax, 0x7fffffff
jg 0x433281
mov qword [rsp + 0x28], rax
mov rax, qword [0x00983bc0]
lea rcx, [0x009d9238]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00434760
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov ecx, 0x1e
xor edx, edx
mov ebx, 0x3b9aca00
jmp 0x433240
dec rcx
nop
test rcx, rcx
jl 0x433258
movsxd rsi, eax
shl rsi, cl
cmp rbx, rsi
jl 0x43323b
sub rbx, rsi
bts edx, ecx
jmp 0x43323b
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge edx, eax
movsxd rax, edx
mov qword [0x009d9240], rax
mov byte [0x009d90fb], 1
add rsp, 0x88
pop rbp
nop
ret
lea rax, [0x0071edc2]
mov ebx, 0x56
call fcn.00437620
lea rax, [0x0071e9e8]
mov ebx, 0x50
nop
call fcn.00437620
lea rax, [0x007113ca]
mov ebx, 0x1b
call fcn.00437620
lea rax, [0x0071aa3e]
mov ebx, 0x30
call fcn.00437620
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00433020
Function at 0x433f80
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rcx, qword [sym.imp.kernel32.dll_CreateThread]
lea rdx, [0x00468e20]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.004349e0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x433ffe
mov rcx, qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00434760
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov ecx, dword [0x009d9140]
test ecx, ecx
jne 0x4340ac
mov rax, qword [0x00985af0]
sub rax, qword [0x00985b00]
movsxd rax, eax
mov qword [rsp + 0x48], rax
call fcn.00468c00
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00438fc0
lea rax, [0x0071a00b]
mov ebx, 0x2e
call fcn.00439840
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00439660
lea rax, [0x0070a67a]
mov ebx, 0x10
call fcn.00439840
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.00439580
lea rax, [0x007043ef]
mov ebx, 2
call fcn.00439840
call fcn.00439020
lea rax, [0x0070b00a]
mov ebx, 0x11
call fcn.00437620
nop
nop
lea rax, [0x009d9268]
call fcn.0040b6c0
nop
nop
lea rax, [0x009d9268]
call fcn.0040b6c0
jmp 0x43400c