joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cf60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40cfed
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40cfbc
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40cfd9
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40cfd9
nop dword [rax + rax]
test rbx, rbx
jl 0x40cfd9
mov rbx, rcx
mov ecx, 1
call fcn.0040c540
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040c540
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004dfd80]
lea rbx, [0x00527bd8]
call fcn.004355e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040cf60

Function at 0x40d020
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d0c6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [rax + 0xa0]
nop
test rdx, rdx
je 0x40d04b
mov rdx, qword [rdx + 0x40]
jmp 0x40d052
mov rdx, qword [0x0061c010]
test rdx, rdx
je 0x40d0af
mov rax, qword [0x0061bf78]
nop
cmp rax, 1
jne 0x40d06a
xor eax, eax
jmp 0x40d093
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
call fcn.0040d100
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
nop dword [rax]
call fcn.0042cde0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005011a1]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d020
Function at 0x40d380
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40d617
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40d605
test rbx, rbx
je 0x40d3ce
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40d5f0
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40d3d3
jmp 0x40d5df
mov ebx, 8
cmp rax, 0x10000
jae 0x40d4a5
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40d41e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40d41e
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40d447
nop
nop
lea rax, [0x0061c180]
call fcn.0040ae00
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x0061c188]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40d479
cmp qword [rsi], 0
jne 0x40d4b7
mov eax, 0x40000
lea rbx, [0x0061ea40]
call fcn.00416480
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40d563
nop dword [rax]
jmp 0x40d5b2
mov rbx, rcx
call fcn.00416480
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40d4f8
cmp byte [r14 + 0xb1], 0
je 0x40d4f8
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x0061c188]
cmp rsi, rdi
jne 0x40d526
nop
nop
lea rax, [0x0061c180]
call fcn.0040b020
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x0061ea40]
cmp rcx, rsi
je 0x40d556
mov rbx, rax
mov rax, rcx
call fcn.0042ec40
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x0061ea40]
call fcn.0042ec40
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x0061c040]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x0061c040]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40d563
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40d4b7
lea rdx, [0x0061c188]
cmp rcx, rdx
je 0x40d5cf
lea rax, [0x004fd58a]
mov ebx, 0x1f
call fcn.00435d80
nop
nop
lea rax, [0x0061c180]
call fcn.0040b020
jmp 0x40d5be
lea rax, [0x004fe393]
mov ebx, 0x23
call fcn.00435d80
lea rax, [0x004ff87f]
mov ebx, 0x2a
nop dword [rax]
call fcn.00435d80
lea rax, [0x004fbeaf]
mov ebx, 0x1a
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00463d60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d380
Function at 0x40df00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40e103
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rbx, rbx
je 0x40dffa
cmp qword [rbx], 0
je 0x40dffa
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rcx
movzx esi, byte [rbx + 8]
test sil, 4
je 0x40df6c
lea rax, [0x004fdbec]
mov ebx, 0x21
call fcn.00435e80
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x48]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x40]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40dfe9
movzx r10d, byte [rdx + 8]
nop
test r10b, 8
jne 0x40dfc9
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rsi, [r9 + r8]
movzx r8d, byte [r9 + r8]
add r8d, 0xfffffffe
nop dword [rax]
cmp r8b, 3
jb 0x40dfe9
mov rcx, rsi
shr rax, 0x38
cmp al, 5
jae 0x40dff4
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40e033
mov esi, dword [rax + 0x54]
bt esi, 4
jae 0x40e011
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov rax, rcx
xor ebx, ebx
call rsi
lea rax, [0x0061d060]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x40e042
mov qword [rsp + 0x20], rcx
xor edx, edx
nop
jmp 0x40e058
lea rax, [0x0061d060]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
inc rdx
cmp rdx, 8
jae 0x40e024
movzx esi, byte [rdx + rcx]
cmp al, sil
je 0x40e06e
test sil, sil
jne 0x40e055
jmp 0x40e042
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40e08f
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x28]
mov rbx, rcx
call rsi
test al, al
jne 0x40e0be
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x40]
jmp 0x40e055
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx + 0x50]
movzx esi, byte [rcx + 0x51]
mov rdi, qword [rsp + 0x18]
imul rsi, rdi
lea rdx, [rsi + rdx*8]
mov rsi, qword [rsp + 0x20]
lea rdx, [rsi + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40e0f1
mov rdx, qword [rdx]
mov rax, rdx
mov ebx, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040df00
Function at 0x40f9a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40fb0a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x40fa8d
cmp qword [rbx], 0
je 0x40fa8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx + 8]
test cl, 4
je 0x40fa01
lea rax, [0x004fdbec]
mov ebx, 0x21
call fcn.00435e80
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp byte [rbx + 9], 0
jne 0x40fa10
mov rcx, qword [rbx + 0x10]
jmp 0x40faaf
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40fa88
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x40fa6b
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx ebx, byte [r9 + r8]
add ebx, 0xfffffffe
nop
cmp bl, 3
jb 0x40fa88
mov rcx, rdx
mov rax, rdi
jmp 0x40faaf
lea rax, [0x0061d060]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x40fabd
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x40fad5
lea rax, [0x0061d060]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x40fa9e
mov esi, dword [rdx]
nop dword [rax]
cmp dword [rsp + 0x30], esi
jne 0x40face
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x40face
movzx edx, byte [rax + 0x51]
imul rdx, rbx
lea rax, [rdx + rcx]
lea rax, [rax + 0x28]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0040f9a0
Function at 0x40fb40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40fcb7
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x40fc2e
cmp qword [rbx], 0
je 0x40fc2e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movzx ecx, byte [rbx + 8]
test cl, 4
je 0x40fba1
lea rax, [0x004fdbec]
mov ebx, 0x21
call fcn.00435e80
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp byte [rbx + 9], 0
jne 0x40fbb0
mov rcx, qword [rbx + 0x10]
jmp 0x40fc52
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40fc29
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x40fc0b
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
nop
cmp sil, 3
jb 0x40fc29
mov rcx, rdx
mov rax, rdi
jmp 0x40fc52
lea rax, [0x0061d060]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x40fc62
nop
lea rdx, [rcx + 8]
xor ebx, ebx
nop
jmp 0x40fc80
lea rax, [0x0061d060]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
nop dword [rax]
cmp rbx, 8
jae 0x40fc41
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x40fc75
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x40fc75
movzx edx, byte [rax + 0x51]
imul rdx, rbx
lea rax, [rdx + rcx]
lea rax, [rax + 0x28]
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0040fb40
Function at 0x412760
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41294f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.00437640
call fcn.00437640
lea rax, [0x004f8793]
mov ebx, 0x11
call fcn.00437f40
mov rax, qword [rsp + 0x38]
call fcn.00437da0
call fcn.004376c0
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x412877
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x41292a
call fcn.00437640
lea rax, [0x004f956d]
mov ebx, 0x14
call fcn.00437f40
call fcn.004376c0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.00437640
lea rax, [0x004f7204]
mov ebx, 0xd
nop dword [rax]
call fcn.00437f40
mov rax, qword [rsp + 0x28]
call fcn.00437da0
lea rax, [0x004f6d02]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x38]
call fcn.00437da0
lea rax, [0x004f6d0e]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437f40
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.00437c40
call fcn.004376c0
call fcn.00437640
nop dword [rax]
call fcn.004378a0
call fcn.004376c0
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x4128b0
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x005014d6]
mov ebx, 0x3e
call fcn.00435d80
call fcn.00437640
lea rax, [0x004fd1cf]
mov ebx, 0x1e
call fcn.00437f40
mov rax, qword [rsp + 0x60]
call fcn.00437da0
lea rax, [0x004f53bd]
mov ebx, 1
nop dword [rax]
call fcn.00437f40
mov rax, qword [rsp + 0x30]
call fcn.00437da0
lea rax, [0x004f53e5]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437f40
call fcn.004376c0
lea rax, [0x004f5b02]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.0041eda0
jmp 0x412894
call fcn.00437640
lea rax, [0x004fb38f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437f40
call fcn.004376c0
jmp 0x4127f5
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00412760
Function at 0x4131a0
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x413385
cmp byte [0x0061c174], 0
je 0x41326f
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x413375
lea r10, [0x005ee330]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x413250
mov r11, rax
shr rax, 5
and eax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11d, 3
add r8, 0x1ffff
jmp 0x41325c
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x413280
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x41336b
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x413313
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x1268]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x1268]
add r9, 0x10
mov qword [rsi + 0x1268], r9
cmp qword [rsi + 0x1270], r9
jne 0x413313
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.0042ef40
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x413325
lea r9d, [r11 + 1]
nop dword [rax]
jmp 0x413279
cmp r8, r12
je 0x413335
inc r12
xor r9d, r9d
jmp 0x413279
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.00412b00
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x413279
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.00461d00
lea rax, [0x004ff2c0]
mov ebx, 0x28
call fcn.00435d80
nop
int3
Function at 0x415360
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415595
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x415587
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x415576
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
lea rsi, [0x0061c5e0]
nop dword [rax + rax]
cmp rcx, rsi
je 0x41549a
mov esi, dword [0x005ee2d8]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x415565
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x20], rcx
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x005ee5d8]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00415e60
lea rax, [0x0061dc40]
call fcn.0042ed00
test byte [rax], al
mov rcx, qword [rsp + 0x20]
movzx edx, word [rcx + 0x60]
movzx esi, word [rcx + 0x66]
sub rdx, rsi
movzx esi, byte [rsp + 0x48]
mov edi, esi
shr sil, 1
movsx rsi, sil
cmp rsi, 0x44
jae 0x415556
mov qword [rsp + 0x18], rdx
lea rbx, [rax + rsi*8]
lea rbx, [rbx + 0x48]
lock xadd qword [rbx], rdx
cmp dil, 5
jne 0x415464
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x20]
lock xadd qword [rax + 0x30], rbx
mov qword [rdx + 0x20], 0
lea rax, [0x0061dc40]
call fcn.0042ede0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x68]
mov rbx, qword [rsp + 0x18]
imul rbx, rdx
nop
lea rdx, [0x0061c988]
lock xadd qword [rdx], rbx
mov word [rcx + 0x66], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x005ee5d8]
lea rax, [rcx + rbx]
call fcn.00415b00
test rax, rax
je 0x415545
movzx edx, word [rax + 0x60]
nop
cmp qword [rax + 0x38], rdx
je 0x415531
mov qword [rsp + 0x20], rax
mov edx, dword [0x005ee2d8]
add edx, 3
mov dword [rax + 0x58], edx
movzx edx, word [rax + 0x60]
mov word [rax + 0x66], dx
movzx edx, word [rax + 0x60]
mov rsi, qword [rax + 0x68]
imul rdx, rsi
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx + 8]
lea rax, [0x0061c840]
call fcn.004203c0
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 8], 0
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rdx + rsi*8 + 0x28], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x004fa66d]
mov ebx, 0x16
nop dword [rax]
call fcn.00435d80
lea rax, [0x004f7503]
mov ebx, 0xd
call fcn.00435d80
mov rax, rsi
mov ecx, 0x44
nop
call fcn.00461ce0
lea rax, [0x004fa447]
mov ebx, 0x16
call fcn.00435d80
lea rax, [0x004ff3b0]
mov ebx, 0x28
call fcn.00435d80
mov rax, rdx
mov ecx, 0x88
call fcn.00461ce0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call fcn.0045f600
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00415360
Function at 0x415a20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415aea
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x005ee2d8]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x415a81
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x415a8b
mov qword [rsp + 0x28], rax
call fcn.00415820
mov rax, qword [rsp + 0x28]
nop
call fcn.0044a480
mov ecx, dword [0x005ee2d8]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x10], ecx
mov dword [rsp + 0x14], edx
call fcn.00437640
lea rax, [0x004f744d]
mov ebx, 0xd
call fcn.00437f40
mov eax, dword [rsp + 0x14]
call fcn.00437c40
lea rax, [0x004fcdf1]
mov ebx, 0x1e
nop
call fcn.00437f40
mov eax, dword [rsp + 0x10]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004f6f96]
mov ebx, 0xc
call fcn.00435d80
nop
mov qword [rsp + 8], rax
call fcn.0045f600
mov rax, qword [rsp + 8]
jmp fcn.00415a20

Function at 0x415e60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415f26
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x415f0f
mov ecx, dword [0x005ee2d8]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x415ea2
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x415ea9
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x415eef
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x415ed5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042e6a0
jmp 0x415f05
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042e6a0
jmp 0x415f05
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.00423900
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004fe79f]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415e60
Function at 0x416280
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416426
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x41633a
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x41632d
lea rsi, [0x005ee330]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x41631d
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00461d00
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.00437640
call fcn.00437640
lea rax, [0x00501283]
mov ebx, 0x39
nop
call fcn.00437f40
mov rax, qword [rsp + 0x40]
call fcn.00437da0
call fcn.004378a0
call fcn.004376c0
call fcn.00437640
lea rax, [0x004fb2b6]
mov ebx, 0x18
call fcn.00437f40
mov rax, qword [rsp + 0x28]
call fcn.00437da0
lea rax, [0x004f53bd]
mov ebx, 1
call fcn.00437f40
mov rax, qword [rsp + 0x20]
call fcn.00437da0
lea rax, [0x004f53e5]
mov ebx, 2
call fcn.00437f40
call fcn.004376c0
lea rax, [0x004f56b9]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041eda0
lea rax, [0x004f5586]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041eda0
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x004fd435]
mov ebx, 0x1f
nop dword [rax]
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00416280