joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430d00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430f9d
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov rax, qword [0x005c6f50]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rbx, [rsp + 0x54]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x50]
cmp eax, 0xa
jb 0x430e0e
nop
jne 0x430d96
cmp dword [rsp + 0x4c], 0
jne 0x430d96
movzx ecx, word [rsp + 0x54]
cmp ecx, 0x3ad7
jb 0x430e0e
mov rax, qword [0x005c6f48]
nop dword [rax]
call fcn.00432d80
lea rcx, [rax + 3]
mov qword [rsp + 0x60], rcx
movzx edx, byte [rcx]
mov byte [rsp + 0x4b], dl
or edx, 0xffffff80
mov byte [rcx], dl
lea rax, [0x0061cdea]
mov ebx, 0x20
mov ecx, 0x21
call fcn.004315c0
mov rcx, qword [0x0061c0b8]
nop word [rax + rax]
cmp rcx, 0x105
ja 0x430f92
mov qword [rsp + 0x58], rcx
lea rax, [0x0061cc00]
lea rbx, [0x0061c720]
call fcn.00462680
mov rcx, qword [rsp + 0x58]
xor eax, eax
jmp 0x430e20
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rdx + rbx + 1], dil
inc rax
cmp rax, 0x20
jge 0x430e8e
lea rdx, [rcx + rax*2]
lea rbx, [0x0061cc00]
movzx esi, byte [rax + rbx + 0x1ea]
shr sil, 4
movzx esi, sil
lea rdi, [0x004f7efc]
movzx esi, byte [rdi + rsi]
cmp rdx, 0x20b
jae 0x430f85
mov byte [rbx + rdx], sil
lea rsi, [rcx + rax*2]
lea rsi, [rsi + 1]
movzx r8d, byte [rax + rbx + 0x1ea]
and r8d, 0xf
movzx edi, byte [r8 + rdi]
nop word [rax + rax]
cmp rsi, 0x20b
jb 0x430e18
jmp 0x430f75
lea rdx, [rcx + 0x40]
jmp 0x430ea2
lea rbx, [0x0061cc00]
mov byte [rbx + rdx], 0x41
inc rdx
cmp rdx, 0x20a
jge 0x430eb9
cmp rdx, 0x20b
jb 0x430e94
jmp 0x430f68
mov rax, qword [0x005aa398]
lea rcx, [0x0061cc00]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 3
movups xmmword [rsp + 0x30], xmm15
call fcn.004330e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.004631c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp], 3
jne 0x430f57
movzx eax, byte [rsp + 0x4b]
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
call fcn.00437640
lea rax, [0x0050196b]
mov ebx, 0x5f
call fcn.00437f40
call fcn.004376c0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [0x0061bec3], 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
mov ecx, 0x20b
call fcn.00461ce0
mov rax, rsi
mov ecx, 0x20b
nop dword [rax]
call fcn.00461ce0
mov rax, rdx
mov ecx, 0x20b
call fcn.00461ce0
mov edx, 0x105
call fcn.00461d40
nop
nop dword [rax]
call fcn.0045f600
jmp fcn.00430d00
Function at 0x4312e0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x431599
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.0042fe60
cmp dword [0x0061c170], 0
jne 0x43135c
mov qword [0x005c6f10], rax
jmp 0x431368
lea rdi, [0x005c6f10]
call fcn.00461840
test rax, rax
je 0x431587
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.0042fe60
cmp dword [0x0061c170], 0
jne 0x4313c7
mov qword [0x005c6f30], rax
jmp 0x4313d3
lea rdi, [0x005c6f30]
call fcn.00461840
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.0042fe60
cmp dword [0x0061c170], 0
jne 0x43143b
mov qword [0x005c6f38], rax
jmp 0x431447
lea rdi, [0x005c6f38]
call fcn.00461840
cmp qword [0x005c6f30], 0
je 0x431576
test rax, rax
je 0x431576
mov qword [rsp + 0x20], 0
mov rax, qword [0x005c6f38]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x431565
cmp rax, 0x7fffffff
jg 0x431551
mov qword [rsp + 0x28], rax
mov rax, qword [0x005c6f30]
lea rcx, [0x0061c090]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x431503
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x431522
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x4314fd
sub rbx, rsi
bts edi, ecx
nop
jmp 0x4314fd
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x0061c088], rax
mov byte [0x0061bed4], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00501915]
mov ebx, 0x56
nop dword [rax]
call fcn.00435d80
lea rax, [0x00501870]
mov ebx, 0x50
call fcn.00435d80
lea rax, [0x004fc113]
mov ebx, 0x1b
call fcn.00435d80
lea rax, [0x005005fd]
mov ebx, 0x30
call fcn.00435d80
nop
mov qword [rsp + 8], rax
nop
call fcn.0045f600
mov rax, qword [rsp + 8]
jmp fcn.004312e0
Function at 0x4325a0
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rcx, qword [0x005aa388]
lea rdx, [0x004633c0]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.00433060
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x43262c
mov rcx, qword [0x005aa3a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00432de0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x0061beec]
test ecx, ecx
jne 0x4326db
mov rax, qword [0x005c8a50]
sub rax, qword [0x005c8a60]
mov qword [rsp + 0x48], rax
call fcn.004631c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00437640
lea rax, [0x0050019d]
mov ebx, 0x2e
nop
call fcn.00437f40
mov rax, qword [rsp + 0x48]
movsxd rax, eax
call fcn.00437d40
lea rax, [0x004f7e9c]
mov ebx, 0x10
nop
call fcn.00437f40
mov rax, qword [rsp + 0x40]
call fcn.00437c40
lea rax, [0x004f53e5]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437f40
call fcn.004376c0
lea rax, [0x004f874f]
mov ebx, 0x11
call fcn.00435d80
nop
nop
lea rax, [0x0061bfb8]
call fcn.0040ae00
nop
nop
lea rax, [0x0061bfb8]
call fcn.0040ae00
jmp 0x43263a
Function at 0x434ae0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x434bb3
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
lea rax, [rsp + 0x98]
call fcn.00435d40
test rax, rax
jne 0x434b28
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
cmp dword [rax + 0x10], 0x778cdb8
jne 0x434b6b
lea rdx, [0x004db7a0]
cmp rax, rdx
jne 0x434b6b
mov r9, qword [rbx + 8]
mov r8, qword [rbx]
lea rax, [rsp + 0x58]
lea rbx, [0x004fd804]
mov ecx, 0x20
lea rdi, [0x004f53f1]
mov esi, 2
call fcn.0044d3c0
call fcn.00435d80
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov rax, qword [rsp + 0x78]
nop dword [rax]
call fcn.00459a20
mov ecx, 0x20
lea rdi, [0x004f5be1]
mov esi, 7
mov r8, rax
mov r9, rbx
lea rax, [rsp + 0x38]
lea rbx, [0x004fd804]
call fcn.0044d3c0
call fcn.00435d80
nop
call fcn.0045f600
jmp fcn.00434ae0

Function at 0x4363a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4364fd
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x005f4c20], 0
jne 0x4363e5
call fcn.00437640
lea rax, [0x005001f9]
mov ebx, 0x2e
call fcn.00437f40
nop dword [rax]
call fcn.004376c0
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x43640c
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x4364a7
nop
cmp edx, 1
je 0x436471
cmp edx, 2
jne 0x436459
mov dword [rcx + 0xdc], 3
call fcn.00437640
lea rax, [0x004fb316]
mov ebx, 0x18
call fcn.00437f40
call fcn.004376c0
mov eax, 4
call fcn.004318c0
mov eax, 5
nop
call fcn.004318c0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.00437640
lea rax, [0x004f93b7]
mov ebx, 0x13
call fcn.00437f40
call fcn.004376c0
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
mov ecx, 1
lea rdx, [0x0061bf2c]
lock xadd dword [rdx], ecx
lea rax, [0x0061c038]
call fcn.0040adc0
cmp dword [0x0061c3d0], 0
jg 0x4364df
cmp dword [0x0061c3cc], 0
jle 0x4364e9
mov eax, 1
call fcn.004437c0
call fcn.00439ce0
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop dword [rax]
call fcn.0045f600
jmp fcn.004363a0
Function at 0x43a140
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a1ec
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x2c], ecx
lea edx, [rbx - 1]
cmp edx, 3
ja 0x43a18c
mov edx, ebx
bts ebx, 0xc
cmp ecx, ebx
jne 0x43a18c
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x90], ecx
sete al
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.00437640
lea rax, [0x004fdd57]
mov ebx, 0x21
nop dword [rax]
call fcn.00437f40
mov eax, dword [rsp + 0x28]
mov eax, eax
call fcn.00437da0
lea rax, [0x004f5e2e]
mov ebx, 8
nop dword [rax]
call fcn.00437f40
mov eax, dword [rsp + 0x2c]
mov eax, eax
call fcn.00437da0
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004f822c]
mov ebx, 0x10
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
jmp fcn.0043a140
Function at 0x43ad00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43aec6
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x0061bf1c]
test edx, edx
je 0x43ad54
xor eax, eax
nop dword [rax]
call fcn.0042fa00
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043e5c0
nop
nop
lea rax, [0x005c8a38]
nop dword [rax]
call fcn.0040ae00
mov ecx, dword [0x0061bf10]
mov edx, dword [0x0061bf28]
test edx, edx
je 0x43ad82
mov dword [0x0061bf28], 0
nop
jmp 0x43ad84
mov edx, ecx
mov eax, edx
call fcn.00441e80
mov qword [rsp + 0x40], rax
mov dword [0x005c8b00], 0
cmp dword [0x005c8b10], 0
je 0x43adb9
mov dword [0x005c8b10], 0
lea rax, [0x005c8b18]
call fcn.0040b100
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
mov rcx, qword [rsp + 0x40]
jmp 0x43add3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43ae2e
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rax, rax
je 0x43ae1b
nop
mov qword [rcx + 0x38], 0
cmp qword [rax + 0xa8], 0
nop dword [rax + rax]
jne 0x43aeb3
nop
mov qword [rax + 0xa8], rcx
add rax, 0x118
call fcn.0040b100
jmp 0x43adce
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043bfa0
jmp 0x43adce
nop
call fcn.00463620
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43ae73
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00453ce0
call fcn.0043cb60
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43aea4
cmp byte [r14 + 0xb1], 0
je 0x43aea4
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x004fea13]
mov ebx, 0x25
nop
call fcn.00435d80
nop
mov byte [rsp + 8], al
call fcn.0045f600
movzx eax, byte [rsp + 8]
jmp fcn.0043ad00
Function at 0x43bfa0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c10c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, r14
test byte [rdx], al
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043b780
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43c0c1
mov rcx, qword [rdx + 0x30]
nop word [rax + rax]
test rcx, rcx
je 0x43c0c1
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x238], 0
jne 0x43c026
cmp byte [rcx + 0xe8], 0
nop
je 0x43c0c1
nop
nop
lea rax, [0x0061c240]
call fcn.0040ae00
cmp dword [0x0061c260], 0
nop dword [rax + rax]
je 0x43c0fa
mov rcx, qword [0x0061c248]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x128], rcx
nop
mov qword [0x0061c248], rdx
cmp byte [0x0061c250], 0
je 0x43c07d
mov byte [0x0061c250], 0
lea rax, [0x0061c258]
call fcn.0040b100
nop
nop
lea rax, [0x0061c240]
call fcn.0040b020
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43c0b7
cmp byte [r14 + 0xb1], 0
je 0x43c0b7
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043c140
mov rcx, qword [r14 + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x43c0f0
cmp byte [r14 + 0xb1], 0
je 0x43c0f0
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x004ff82b]
mov ebx, 0x2a
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043bfa0
Function at 0x43c580
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c808
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], bl
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
nop
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
nop
lea rax, [0x005c8a38]
nop
call fcn.0040ae00
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x43c5e2
xor eax, eax
call fcn.00444540
test rax, rax
je 0x43c6d2
mov rcx, rax
nop
mov rdx, qword [0x005c8a40]
test rdx, rdx
je 0x43c606
mov rbx, qword [rdx + 0x128]
mov qword [0x005c8a40], rbx
dec dword [0x005c8a48]
test rdx, rdx
mov qword [rsp + 0x28], rcx
jne 0x43c685
call fcn.00439860
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
movzx eax, byte [rsp + 0x50]
movzx eax, al
test rax, rax
mov eax, 0
lea rcx, [0x00502118]
cmovne rax, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
call fcn.0043bfa0
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43c67b
cmp byte [r14 + 0xb1], 0
je 0x43c67b
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x30], rdx
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0xe4], 0
jne 0x43c7f6
cmp qword [rax + 0xa8], 0
jne 0x43c7e5
movzx ecx, byte [rsp + 0x50]
nop dword [rax]
test cl, cl
je 0x43c6ce
mov rdx, qword [rsp + 0x28]
jmp 0x43c7a1
xor ecx, ecx
jmp 0x43c74b
nop
nop
lea rax, [0x005c8a38]
nop dword [rax + rax]
call fcn.0040b020
movzx ecx, byte [rsp + 0x50]
test cl, cl
je 0x43c704
mov ecx, 0xffffffff
lea rdx, [0x005c8a7c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43c73a
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43c730
cmp byte [r14 + 0xb1], 0
je 0x43c730
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x004fc380]
mov ebx, 0x1b
call fcn.00435d80
mov byte [rax + 0xe4], cl
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0xa8], rcx
add rax, 0x118
call fcn.0040b100
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop dword [rax]
cmp edx, 1
jne 0x43c797
cmp byte [r14 + 0xb1], 0
je 0x43c797
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, dword [rdx + 0x190]
mov edi, dword [rdx + 0x194]
mov r8, qword [rdx + 0x998]
mov r9d, dword [rdx + 0x194]
nop dword [rax + rax]
cmp r9d, edi
jne 0x43c7a1
cmp edi, esi
jne 0x43c7d2
test r8, r8
je 0x43c74b
lea rax, [0x004fb96b]
mov ebx, 0x19
nop
call fcn.00435d80
lea rax, [0x004f7e51]
mov ebx, 0xf
call fcn.00435d80
lea rax, [0x004fa0c9]
mov ebx, 0x15
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.0045f600
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0043c580
Function at 0x43cbe0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ce1d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x130]
test rdx, rdx
je 0x43ce0b
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43ce0b
mov qword [rsp + 0x30], r14
cmp qword [rcx + 0xa0], 0
je 0x43cc35
call fcn.00442880
call fcn.0043c840
mov eax, 1
call fcn.004429e0
nop
call fcn.0043b0c0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x130]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43cc94
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00442700
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.00437640
lea rax, [0x004ffb81]
mov ebx, 0x2b
call fcn.00437f40
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.00437c40
lea rax, [0x004fe4cf]
mov ebx, 0x24
call fcn.00437f40
call fcn.004376c0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.00437640
lea rax, [0x004f838c]
mov ebx, 0x10
call fcn.00437f40
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00437ec0
lea rax, [0x004f5bc5]
mov ebx, 7
call fcn.00437f40
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437d40
lea rax, [0x004f8e13]
mov ebx, 0x13
call fcn.00437f40
mov eax, dword [rsp + 0x18]
mov eax, eax
nop dword [rax]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.00437640
lea rax, [0x004f835c]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x28]
call fcn.00437ec0
lea rax, [0x004f5bc5]
mov ebx, 7
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x20]
call fcn.00437d40
lea rax, [0x004f8e00]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00437f40
mov eax, dword [rsp + 0x14]
mov eax, eax
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fb984]
mov ebx, 0x19
call fcn.00435d80
lea rax, [0x004fdea1]
mov ebx, 0x21
call fcn.00435d80
nop
nop dword [rax]
call fcn.0045f600
jmp fcn.0043cbe0
Function at 0x43cf00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43cfd7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x005c8b00], 0
nop
je 0x43cfc5
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x43cf50
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x005c8a7c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43cfb4
call fcn.00442880
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x005c8a38]
call fcn.0040ae00
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x005c8b04]
lea ecx, [rax - 1]
mov dword [0x005c8b04], ecx
cmp eax, 1
jne 0x43cf94
lea rax, [0x005c8b08]
call fcn.0040b100
nop
nop
lea rax, [0x005c8a38]
nop dword [rax]
call fcn.0040b020
call fcn.0043c440
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004fc716]
mov ebx, 0x1c
call fcn.00435d80
lea rax, [0x004fc149]
mov ebx, 0x1b
call fcn.00435d80
nop
call fcn.0045f600
nop dword [rax]
jmp fcn.0043cf00
Function at 0x43e540
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e5b7
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
nop
je 0x43e5a5
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x005c8a7c]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43e58f
nop
call fcn.0043cb60
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x004fdc2e]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435d80
lea rax, [0x004fd56b]
mov ebx, 0x1f
call fcn.00435d80
nop
call fcn.0045f600
jmp fcn.0043e540
Function at 0x43e8e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43eb31
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x43eb1f
mov qword [rsp + 0x20], r14
cmp qword [rcx + 0x130], 0
je 0x43e937
call fcn.0043cbe0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x130]
xor ebx, ebx
mov rax, rcx
call fcn.0043d000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
cmp byte [rdx + 0xe8], 0
je 0x43e958
jmp 0x43eb0e
call fcn.0043ce40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
test byte [rdx], al
mov byte [rdx + 0x22c8], 0
mov rsi, qword [rcx + 0x30]
cmp byte [rsi + 0xe4], 0
je 0x43e999
cmp qword [rdx + 0x998], 0
jne 0x43eafd
mov esi, dword [rdx + 0x190]
cmp dword [rdx + 0x194], esi
jne 0x43eafd
call fcn.0043d180
mov qword [rsp + 0x18], rax
mov byte [rsp + 0x17], bl
mov byte [rsp + 0x16], cl
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe4], 0
je 0x43e9d9
nop dword [rax]
call fcn.0043e540
mov rax, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x17]
cmp byte [0x005c8a98], 0
jne 0x43e9e6
xor esi, esi
jmp 0x43ea09
mov ebx, 1
call fcn.004594c0
xor eax, 1
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x17]
mov esi, eax
mov rax, qword [rsp + 0x18]
test sil, sil
je 0x43eac8
nop
nop
lea rax, [0x005c8a38]
nop dword [rax + rax]
call fcn.0040ae00
cmp byte [0x005c8a98], 0
jne 0x43ea35
mov eax, 1
jmp 0x43ea45
mov rax, qword [rsp + 0x18]
mov ebx, 1
nop
call fcn.004594c0
test al, al
jne 0x43eaa6
nop
mov rcx, qword [rsp + 0x18]
mov qword [rcx + 0xa0], 0
mov rdx, qword [0x005c8aa8]
test rdx, rdx
je 0x43ea72
mov rbx, rcx
mov qword [rdx + 0xa0], rcx
jmp 0x43ea80
nop
mov rdx, rcx
mov qword [0x005c8aa0], rcx
mov rbx, rdx
nop
mov qword [0x005c8aa8], rbx
inc dword [0x005c8ab0]
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
mov rcx, qword [rsp + 0x20]
jmp 0x43e958
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
mov rax, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x17]
test cl, cl
je 0x43eae0
call fcn.0043cb60
mov rax, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x17]
cmp qword [rax + 0xe8], 0
jne 0x43e94e
call fcn.0043d000
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x004fe122]
mov ebx, 0x22
call fcn.00435d80
lea rax, [0x004f83bc]
mov ebx, 0x10
call fcn.00435d80
lea rax, [0x004fad7f]
mov ebx, 0x17
call fcn.00435d80
nop
call fcn.0045f600
jmp fcn.0043e8e0