joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461de0
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop word [rax + rax]
cmp qword [r14 + 0x70], rcx
jb 0x462053
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.00442220
test al, al
jne 0x461e5a
cmp byte [0x0098b248], 0
je 0x461f8e
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp 0x462001
cmp byte [0x0097e904], 0
je 0x461e9f
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x004421e0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00465360
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x0098b248], 0
je 0x461efe
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
nop dword [rax]
cmp rsi, rdi
jne 0x461ed0
mov edx, dword [rdx + 0x268]
cmp dword [rsi + 0x14], edx
je 0x461f03
lea rax, fcn.00457bc0
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.00465360
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
jmp 0x461f03
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop dword [rax + rax]
call fcn.0043bf60
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x461f4f
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x461f5d
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x00985b40], 0
je 0x461f88
mov ebx, 1
call fcn.0045b900
test al, al
jne 0x461f88
nop
lea rax, [0x0073aaf0]
call fcn.004652e0
add rsp, 0x30
pop rbp
ret
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x0073aa30]
call fcn.004652e0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
add rsp, 0x30
pop rbp
ret
nop
lea rax, [0x0073adb8]
mov qword [rsp], rax
nop dword [rax]
call fcn.00465360
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
test rcx, rcx
je 0x462015
mov edx, dword [rcx + 0x14]
mov rbx, qword [rax + 0x30]
cmp dword [rbx + 0x268], edx
je 0x461fd1
call fcn.00467220
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, rax
sar rax, 0x3f
shr rax, 0x3a
add rax, rcx
sar rax, 6
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x170], rax
jmp 0x461f8e
lea rax, [0x00719ae4]
mov ebx, 0x2d
nop
call fcn.00437620
nop
int3
Function at 0x467280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404003
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409ce0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403fe0
cmp byte [0x009d90f1], 0
je 0x467295
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4644e0
jmp 0x403fe0

Function at 0x4672a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x009d96a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x009d90f1], 0
je 0x4672d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x009d99c0]
aesenc xmm0, xmmword [0x009d99d0]
aesenc xmm0, xmmword [0x009d99e0]
movq rax, xmm0
ret
jmp 0x409f00

Function at 0x4672e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x009d96a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x009d90f1], 0
je 0x467316
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x009d99c0]
aesenc xmm0, xmmword [0x009d99d0]
aesenc xmm0, xmmword [0x009d99e0]
movq rax, xmm0
ret
jmp 0x409f60

Function at 0x469080
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4690b4
mov rcx, 0x28
jmp 0x4690bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x009d9398], rcx
pop rbp
ret

Function at 0x46e0c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e152
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
nop dword [rax]
test rbx, rbx
je 0x46e13e
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x30], rbx
mov rdx, qword [rbx + 0x38]
mov rax, rcx
call rdx
nop dword [rax]
cmp rax, 0x14
jne 0x46e12b
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x60]
mov rax, qword [rsp + 0x38]
call rcx
mov rbx, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.0046e240
add rsp, 0x18
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788df0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00788de0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046e0c0
Function at 0x46e180
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e1ee
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
test rbx, rbx
je 0x46e1da
mov qword [rsp + 0x18], rax
mov rdx, qword [rbx + 0x60]
mov rax, rcx
call rdx
mov qword [rsp + 0x10], rax
mov rbx, qword [rsp + 0x18]
call fcn.0046e820
test al, al
je 0x46e1c5
mov eax, 1
jmp 0x46e1d4
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
call fcn.0046e240
add rsp, 0x20
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788e00]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0046e180
Function at 0x47b2c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b42e
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov byte [rax + 0x20], 0
xor edx, edx
jmp 0x47b2ef
mov rdx, rax
mov rax, rsi
mov qword [rsp + 0x30], rdx
mov ebx, 0x200
call fcn.0047ae60
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x10]
cmp rax, rdx
ja 0x47b425
mov qword [rcx + 8], rax
mov rdi, qword [rcx + 0x10]
nop dword [rax + rax]
cmp rax, rdi
ja 0x47b418
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x18]
sub rdi, rax
mov r8, rdi
neg r8
sar r8, 0x3f
and r8, rax
mov r9, qword [rcx]
lea rbx, [r9 + r8]
mov rax, qword [rsp + 0x68]
mov rcx, rdi
call rsi
nop dword [rax + rax]
test rax, rax
jl 0x47b3f6
mov rsi, qword [rsp + 0x58]
mov rdx, qword [rsi + 0x10]
mov rdi, qword [rsp + 0x20]
add rdi, rax
cmp rdx, rdi
jb 0x47b3ee
mov qword [rsi + 8], rdi
mov rdx, qword [rsp + 0x30]
add rax, rdx
cmp qword [0x0096bc10], rbx
jne 0x47b3d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rax
mov rdx, qword [0x0096bc18]
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00404a60
test al, al
jne 0x47b3df
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
test rbx, rbx
je 0x47b2e9
add rsp, 0x48
pop rbp
ret
mov rax, qword [rsp + 0x28]
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rdi
call fcn.004677e0
mov rcx, qword [0x0096bdb0]
nop dword [rax]
test rcx, rcx
je 0x47b409
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0096bdb8]
mov rax, rcx
call fcn.00436ea0
mov rcx, rdi
nop dword [rax + rax]
call fcn.00467820
mov rcx, rax
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0047b2c0
Function at 0x483120
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4832eb
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov rsi, qword [rax + 0x28]
nop dword [rax + rax]
test rsi, rsi
jle 0x4831aa
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x30]
cmp rdx, rcx
jb 0x4832e5
cmp rcx, rsi
jb 0x4832da
mov r8, qword [rax]
mov r9, qword [rax + 8]
sub rcx, rsi
mov r10, rsi
sub rsi, rdx
sar rsi, 0x3f
and r10, rsi
lea rbx, [r10 + r8]
cmp r9, rcx
cmovg r9, rcx
test r10, r10
je 0x483196
mov rax, r8
mov rcx, r9
call fcn.00468160
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rax + 0x28]
mov qword [rax + 0x30], rdx
mov qword [rax + 0x28], 0
mov rdx, qword [rax + 8]
cmp qword [rax + 0x30], rdx
jge 0x4832c7
mov ecx, 0x64
jmp 0x4831ca
mov rcx, qword [rsp + 0x20]
dec rcx
mov rax, rdx
test rcx, rcx
jle 0x483268
mov rdx, qword [rax + 8]
mov rsi, qword [rax + 0x30]
nop dword [rax + rax]
cmp rsi, rdx
ja 0x4832bc
mov qword [rsp + 0x20], rcx
mov r8, qword [rax + 0x18]
mov r9, qword [rax + 0x20]
mov r8, qword [r8 + 0x18]
mov r10, qword [rax]
mov rdi, qword [rax + 0x10]
sub rdi, rsi
sub rdx, rsi
mov r11, rdi
neg r11
sar r11, 0x3f
and r11, rsi
lea rbx, [r11 + r10]
mov rcx, rdx
mov rax, r9
nop
call r8
test rax, rax
jl 0x48329d
mov rdx, qword [rsp + 0x38]
add qword [rdx + 0x30], rax
test rbx, rbx
jne 0x483241
test rax, rax
jle 0x4831bf
add rsp, 0x28
pop rbp
ret
mov qword [rdx + 0x38], rbx
cmp dword [0x009d9570], 0
je 0x48325e
call fcn.004673c0
mov qword [r11], rcx
mov rax, qword [rdx + 0x40]
mov qword [r11 + 8], rax
mov qword [rdx + 0x40], rcx
add rsp, 0x28
pop rbp
ret
mov rcx, qword [0x0096bc30]
mov rdx, qword [0x0096bc38]
mov qword [rax + 0x38], rcx
cmp dword [0x009d9570], 0
je 0x483293
call fcn.004673c0
mov qword [r11], rdx
mov rcx, qword [rax + 0x40]
mov qword [r11 + 8], rcx
mov qword [rax + 0x40], rdx
add rsp, 0x28
pop rbp
ret
mov rcx, qword [0x0096bd30]
test rcx, rcx
je 0x4832ad
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0096bd38]
mov rax, rcx
call fcn.00436ea0
mov rax, rsi
mov rcx, rdx
call fcn.00467820
lea rax, [0x006a5b60]
lea rbx, [0x00788740]
call fcn.00436ea0
mov rax, rsi
nop dword [rax]
call fcn.00467820
call fcn.004677e0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00483120
Function at 0x4842a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48434e
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
cmp rdx, rsi
jb 0x484345
mov r8, qword [rax + 0x28]
cmp rsi, r8
jb 0x484338
mov qword [rsp + 0x30], rax
mov r9, qword [rbx + 0x18]
mov r10, qword [rax]
sub rdx, r8
sub rsi, r8
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rbx, [r10 + r8]
mov rax, rcx
mov rcx, rsi
call r9
nop
test rax, rax
jl 0x484314
mov rdx, qword [rsp + 0x30]
add qword [rdx + 0x28], rax
add rsp, 0x20
pop rbp
ret
mov rcx, qword [0x0096bd40]
nop dword [rax + rax]
test rcx, rcx
je 0x484329
mov rcx, qword [rcx + 8]
mov rbx, qword [0x0096bd48]
mov rax, rcx
call fcn.00436ea0
mov rax, r8
mov rcx, rsi
nop
call fcn.00467820
mov rcx, rsi
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004842a0
Function at 0x48e460
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e6ce
push rbp
mov rbp, rsp
sub rsp, 0x38
test rdi, rdi
jl 0x48e6ba
nop dword [rax + rax]
cmp rdi, 9
jg 0x48e6a7
test ebx, ebx
jne 0x48e499
movups xmmword [rax + 0x18], xmm15
add rsp, 0x38
pop rbp
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x48e4ce
lea rsi, [rdx - 0x19]
neg rsi
mov r8, rcx
mov rcx, rsi
shl ebx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x19]
cmp rcx, 0x20
sbb esi, esi
and ebx, esi
jmp 0x48e4d1
mov rdx, rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rsi, rdx, 0x13441
add rsi, 0x1ce618
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x30], rcx
lea rsi, [rcx - 1]
nop dword [rax]
cmp rsi, 0x1b
jg 0x48e50f
test rsi, rsi
setge r8b
jmp 0x48e512
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rdx
mov rcx, rsi
call fcn.0048f660
test rbx, rbx
jge 0x48e694
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
nop
cmp r8, 0xa
jae 0x48e566
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x48e645
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x48e660
movzx esi, byte [rsp + 0x23]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
mov r10d, eax
shr eax, cl
cmp rcx, 0x20
sbb ebx, ebx
and r9d, ebx
dec r9d
and ebx, eax
and r9d, r10d
test sil, sil
je 0x48e5e7
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8d, cl
cmp rcx, 0x20
sbb r10d, r10d
and r8d, r10d
cmp r8d, r9d
jb 0x48e5d8
jne 0x48e5e2
nop dword [rax + rax]
test dil, dil
je 0x48e5d8
cmp r8d, r9d
jne 0x48e5e2
test dil, dil
je 0x48e5e2
mov r8d, ebx
and r8d, 1
jmp 0x48e609
mov r8d, 1
nop
jmp 0x48e609
xor r8d, r8d
jmp 0x48e609
lea rcx, [r8 + 1]
neg rcx
mov r10d, r9d
shr r9d, cl
cmp rcx, 0x20
sbb r11d, r11d
and r9d, r11d
cmp r9d, 1
sete r8b
mov r9d, r10d
test r9d, r9d
je 0x48e610
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x48]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x60]
call fcn.0048e9a0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x38
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x48e56b
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
nop
cmp rsi, r9
jge 0x48e645
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
nop
cmp r8, r11
je 0x48e654
mov eax, edi
mov rdx, r10
movzx esi, byte [rsp + 0x23]
jmp 0x48e56b
lea rax, [0x006a5b60]
lea rbx, [0x00789100]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007890f0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007890e0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0048e460
Function at 0x48e700
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e95c
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp rdi, 0x12
jg 0x48e948
nop dword [rax]
test rbx, rbx
jne 0x48e730
movups xmmword [rax + 0x18], xmm15
add rsp, 0x40
pop rbp
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x48e76d
lea rsi, [rdx - 0x36]
neg rsi
mov r8, rcx
mov rcx, rsi
shl rbx, cl
lea rdx, [rdx + r8]
lea rdx, [rdx - 0x36]
cmp rcx, 0x40
sbb rsi, rsi
and rbx, rsi
jmp 0x48e770
mov rdx, rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rsi, rdx, 0x13441
add rsi, 0x4105b6
sar rsi, 0x12
mov rcx, rdi
sub rcx, rsi
mov qword [rsp + 0x38], rcx
lea rsi, [rcx - 1]
nop dword [rax + rax]
cmp rsi, 0x37
jg 0x48e7af
test rsi, rsi
setge r8b
jmp 0x48e7b2
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rdx
mov rcx, rsi
call fcn.0048f740
test rbx, rbx
jge 0x48e935
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x48e805
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x48e8e5
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
nop
jmp 0x48e900
movzx esi, byte [rsp + 0x27]
mov r8, rbx
neg rbx
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
mov r10, rax
shr rax, cl
cmp rcx, 0x40
sbb rbx, rbx
and r9, rbx
dec r9
and rbx, rax
and r9, r10
test sil, sil
je 0x48e887
lea rcx, [r8 + 1]
neg rcx
mov r8d, 1
shl r8, cl
cmp rcx, 0x40
sbb r10, r10
and r8, r10
cmp r8, r9
jb 0x48e878
jne 0x48e882
nop dword [rax]
test dil, dil
je 0x48e878
cmp r8, r9
jne 0x48e882
test dil, dil
je 0x48e882
mov r8, rbx
and r8d, 1
jmp 0x48e8a9
mov r8d, 1
nop
jmp 0x48e8a9
xor r8d, r8d
jmp 0x48e8a9
lea rcx, [r8 + 1]
neg rcx
mov r10, r9
shr r9, cl
cmp rcx, 0x40
sbb r11, r11
and r9, r11
cmp r9, 1
sete r8b
mov r9, r10
test r9, r9
je 0x48e8b0
xor edi, edi
xor edi, 1
mov rax, qword [rsp + 0x50]
mov ecx, edi
mov edi, r8d
mov rsi, qword [rsp + 0x68]
call fcn.0048e9a0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
add rsp, 0x40
pop rbp
ret
mov esi, 1
mov ecx, 1
jmp 0x48e80a
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x48e8e5
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x48e8f4
mov rax, rdi
mov rdx, r10
movzx esi, byte [rsp + 0x27]
jmp 0x48e80a
lea rax, [0x006a5b60]
lea rbx, [0x00789120]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00789110]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0048e700
Function at 0x495640
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x4958e6
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rdi
bt esi, 9
jae 0x4958d1
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0x280], rax
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xf0], rcx
mov rdx, rsi
and esi, 0x1e0
movzx r8d, byte [rcx + 0x17]
and r8d, 0x1f
or r8, rsi
mov qword [rsp + 0xd0], r8
mov rax, rcx
mov rbx, rdi
mov rcx, rdx
call fcn.0049d680
lea rdx, [0x0078ef68]
nop dword [rax]
cmp rax, rdx
jne 0x4958be
mov qword [rsp + 0xe0], rbx
lea rcx, [0x004a1840]
mov qword [rsp + 0xc8], rcx
nop
movups xmmword [rsp + 0x1b8], xmm15
lea rdi, [rsp + 0x1c0]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a6f
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.00498080
mov rcx, qword [rsp]
mov qword [rsp + 0x1b8], rcx
lea rdi, [rsp + 0x1c0]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467da6
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0x100], rcx
lea rdi, [rsp + 0x108]
lea rsi, [rsp + 0x1c0]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467da6
mov rbp, qword [rbp]
lea rax, [0x006d6420]
call fcn.0040d7c0
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1a8]
cmp dword [0x009d9570], 0
je 0x4957e8
nop dword [rax + rax]
call fcn.004673a0
mov qword [r11], rcx
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x190]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b0]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xd8]
mov rdx, r8
sar rdx, 0xa
mov qword [rax + 0x20], rdx
mov rsi, qword [rsp + 0xd0]
mov qword [rax + 0x38], rsi
cmp dword [0x009d9570], 0
jne 0x495840
mov rcx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
jmp 0x49586c
call fcn.00467400
mov rcx, qword [rsp + 0xf0]
mov qword [r11], rcx
mov r9, qword [rax + 0x28]
mov qword [r11 + 8], r9
mov rdi, qword [rsp + 0xf8]
mov qword [r11 + 0x10], rdi
mov r9, qword [rax + 0x30]
mov qword [r11 + 0x18], r9
mov qword [rsp + 0xe8], rax
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdi
mov rbx, qword [rsp + 0x288]
mov r8, rdx
mov rax, qword [rsp + 0x280]
call fcn.00499800
mov rax, qword [rsp + 0xe0]
test byte [rax], al
mov rcx, qword [rsp + 0xd8]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe8]
add rsp, 0x270
pop rbp
ret
mov rbx, qword [0x0078ef70]
lea rcx, [0x006f1f80]
call fcn.0040ac60
lea rax, [0x006a5b60]
lea rbx, [0x00788da0]
nop
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00495640
Function at 0x4968e0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496b1b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x49697a
mov qword [rsp + 0x88], rax
lea rbx, [0x006fcaa0]
mov rcx, rax
lea rax, [0x00984800]
call fcn.00470fe0
test cl, cl
jne 0x496963
mov rax, qword [rsp + 0x88]
call fcn.00495c00
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x00786640]
call fcn.0044faa0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
call fcn.00497d20
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x496997
lea rdx, [0x006f5800]
cmp rax, rdx
jne 0x496985
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.00462780
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x006b0220]
call fcn.0040aba0
inc rdx
cmp rbx, rdx
jle 0x4969e1
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x496994
lea rax, [0x00984800]
lea rbx, [0x006fcaa0]
lea rdi, [0x006f5800]
nop dword [rax + rax]
call fcn.004711a0
lea rdx, [0x006f5800]
cmp rax, rdx
jne 0x496b0b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x0069e860]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x006c2460]
call fcn.0040d7c0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x009d9570], 0
nop
je 0x496a3b
mov rbx, rax
lea rax, [0x006c2460]
call fcn.004139c0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.004014c0
call fcn.00462880
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x496aa2
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x496a94
mov dword [rsi + 0x10], edx
cmp dword [0x009d9570], 0
je 0x496ac3
call fcn.004673c0
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00984800]
lea rbx, [0x006fcaa0]
lea rdi, [0x006f5800]
nop dword [rax]
call fcn.004711a0
lea rdx, [0x006f5800]
cmp rax, rdx
jne 0x496afc
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x006b0220]
call fcn.0040aba0
mov rbx, rdx
lea rcx, [0x006b0220]
call fcn.0040aba0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004968e0