Function at 0x62ce40
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x150]
cmp r12, qword [r14 + 0x10]
jbe 0x62dbfe
push rbp
mov rbp, rsp
sub rsp, 0x1c8
mov byte [rsp + 0x1f0], dil
mov qword [rsp + 0x200], r8
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1e8], rcx
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1f8], rsi
movups xmmword [rsp + 0x140], xmm15
mov rdx, qword [rax + 0xe8]
nop dword [rax]
test rdx, rdx
je 0x62ceae
mov r9, qword [rax + 0xf0]
jmp 0x62cebc
lea rdx, [0x0078beb0]
lea r9, [0x009d90e0]
mov rdx, qword [rdx + 0x30]
mov rax, r9
lea rbx, [0x006b8100]
lea rcx, [0x009d90e0]
call rdx
lea rdx, [0x006bc980]
cmp rax, rdx
je 0x62cee1
xor ebx, ebx
mov qword [rsp + 0x118], rbx
test rbx, rbx
je 0x62cf76
cmp qword [rbx + 0x78], 0
je 0x62cf76
movups xmmword [rsp + 0x170], xmm15
mov qword [rsp + 0x180], 0
lea rcx, [0x0062dd00]
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x178], rbx
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x180], rcx
lea rcx, [rsp + 0x170]
mov qword [rsp + 0xd0], rcx
lea rax, [rsp + 0xb8]
call fcn.00435d80
test eax, eax
jne 0x62cf58
jmp 0x62cf76
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x1a8], xmm15
movups xmmword [rsp + 0x1b8], xmm15
lea rcx, [0x0062dc60]
mov qword [rsp + 0x1a8], rcx
lea rcx, [rsp + 0x4f]
mov qword [rsp + 0x1b0], rcx
mov rcx, qword [rsp + 0x1d8]
mov qword [rsp + 0x1b8], rcx
lea rdx, [rsp + 0x140]
mov qword [rsp + 0x1c0], rdx
lea rdx, [rsp + 0x1a8]
mov qword [rsp + 0x88], rdx
lea rax, [rsp + 0x70]
nop
call fcn.00435d80
test eax, eax
jne 0x62d0a0
mov rcx, qword [rsp + 0x1d8]
mov rdx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0x80]
test rdx, rdx
jne 0x62d057
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x62d01b
mov rsi, qword [rdx + 0x28]
mov rdx, qword [rdx + 0x30]
jmp 0x62d057
mov rax, qword [0x0096bfc0]
mov rcx, qword [0x0096bfc8]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rcx
call fcn.00436380
mov rbx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x140]
add rsp, 0x1c8
pop rbp
ret
mov rax, rsi
mov rbx, rdx
nop dword [rax]
call fcn.00606460
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rdi
test rcx, rcx
jne 0x62d07e
xor ecx, ecx
jmp 0x62d0c1
nop
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x62d13e
movzx edx, byte [rax + rcx]
lea rsi, [0x00923cc0]
movzx edx, byte [rsi + rdx]
test dl, dl
jne 0x62d0be
movzx ecx, byte [rsp + 0x1f0]
test cl, cl
jne 0x62d0eb
xor ebx, ebx
xor eax, eax
jmp 0x62d13e
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x19
lea rcx, [0x0070fd94]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rax
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
nop
call fcn.0062ddc0
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x1d8]
mov rdx, qword [rcx + 0x10]
mov rax, rdx
call fcn.005a0d20
movzx ecx, byte [rsp + 0x1f0]
test cl, cl
je 0x62d1ca
mov rdx, qword [rsp + 0x1d8]
mov r12, qword [rdx + 0x10]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x62d1d2
cmp qword [r12 + 0x18], 0
jne 0x62d1d2
mov rdx, qword [r12]
lea rdi, [0x00704529]
mov esi, 3
mov r8, qword [rsp + 0x128]
mov r9, qword [rsp + 0x68]
mov r10, rax
mov r11, rbx
xor eax, eax
mov rbx, rdx
call fcn.0044fc00
mov rdx, qword [rsp + 0x1d8]
mov rdi, rbx
jmp 0x62d234
mov rdx, qword [rsp + 0x1d8]
cmp qword [rdx + 8], 7
jne 0x62d231
mov rsi, qword [rdx]
cmp dword [rsi], 0x4e4e4f43
jne 0x62d22c
cmp word [rsi + 4], 0x4345
jne 0x62d227
cmp byte [rsi + 6], 0x54
jne 0x62d222
mov rsi, qword [rdx + 0x10]
cmp qword [rsi + 0x40], 0
jne 0x62d21b
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x62d20c
mov rax, qword [rsi + 0x10]
jmp 0x62d234
mov rdi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x128]
jmp 0x62d234
mov rdi, rbx
nop
jmp 0x62d234
mov rdi, rbx
jmp 0x62d234
mov rdi, rbx
jmp 0x62d234
mov rdi, rbx
jmp 0x62d234
mov rdi, rbx
xor ecx, ecx
jmp 0x62d240
inc rcx
nop dword [rax + rax]
cmp rcx, rdi
jge 0x62d2ac
movzx esi, byte [rax + rcx]
cmp sil, 0x20
jb 0x62d255
cmp sil, 0x7f
jne 0x62d238
lea rax, [0x006c0560]
nop dword [rax]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c107]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rax
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x120], rax
lea rax, [0x006b8f00]
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1e8]
call fcn.0040b1e0
test rax, rax
je 0x62d2f1
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1e8]
xor edx, edx
jmp 0x62d3c2
nop
nop
mov rdx, qword [rsp + 0x1e0]
lea rsi, [0x00789c00]
cmp rdx, rsi
jne 0x62d311
mov rax, qword [rsp + 0x1e8]
jmp 0x62d316
mov eax, 0
jne 0x62d326
cmp qword [rax + 0x18], 0x1000
jge 0x62d3b8
lea rax, [0x006a5ea0]
mov ebx, 0x1000
mov rcx, rbx
call fcn.0044bc20
mov qword [rsp + 0x138], rax
lea rax, [0x006df420]
call fcn.0040d7c0
mov qword [rax + 0x18], 0x1000
mov qword [rax + 0x20], 0x1000
cmp dword [0x009d9570], 0
jne 0x62d371
mov rcx, qword [rsp + 0x138]
jmp 0x62d381
call fcn.004673a0
mov rcx, qword [rsp + 0x138]
mov qword [r11], rcx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x1e0]
mov qword [rax + 0x30], rcx
cmp dword [0x009d9570], 0
jne 0x62d3a4
mov rcx, qword [rsp + 0x1e8]
jmp 0x62d3b4
call fcn.004673a0
mov rcx, qword [rsp + 0x1e8]
mov qword [r11], rcx
mov qword [rax + 0x38], rcx
lea rcx, [0x00789c00]
mov rdx, rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x130], rdx
mov rsi, qword [rsp + 0x1d8]
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x62d3ed
mov r8, qword [rsi]
jmp 0x62d3f9
mov edi, 3
lea r8, [0x00704511]
movups xmmword [rsp + 0x188], xmm15
movups xmmword [rsp + 0x198], xmm15
mov rax, r8
mov rbx, rdi
call fcn.0040af80
lea rcx, [0x006a5b60]
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x60]
call fcn.0040af80
lea rcx, [0x006a5b60]
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x100]
mov edi, 0x10
lea rsi, [rsp + 0x188]
mov r8d, 2
mov r9, r8
lea rcx, [0x0070a47a]
call fcn.004cf8e0
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rcx
test rbx, rbx
jne 0x62dbe0
movups xmmword [rsp + 0x150], xmm15
mov rax, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x68]
call fcn.0040af80
lea rcx, [0x006a5b60]
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x100]
mov edi, 0xa
lea rsi, [rsp + 0x150]
mov r8d, 1
mov r9, r8
lea rcx, [0x00707308]
call fcn.004cf8e0
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rcx
test rbx, rbx
jne 0x62dbc1
mov rdx, qword [rsp + 0x118]
test rdx, rdx
je 0x62d590
cmp qword [rdx + 0x60], 0
je 0x62d590
lea rax, [0x006a8ba0]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x68]
mov qword [rax + 8], rcx
cmp dword [0x009d9570], 0
jne 0x62d554
mov r8, qword [rsp + 0x128]
jmp 0x62d564
call fcn.004673a0
mov r8, qword [rsp + 0x128]
mov qword [r11], r8
mov qword [rax], r8
mov r8, qword [rsp + 0x118]
mov rdx, qword [r8 + 0x60]
mov r9, qword [rdx]
mov ebx, 4
mov rcx, rax
mov edi, 1
mov rsi, rdi
lea rax, [0x00704805]
call r9
mov rdx, qword [rsp + 0x1d8]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006ef660]
lea rcx, [0x007072fe]
mov edi, 0xa
call fcn.00412920
test bl, bl
jne 0x62d5c6
mov ebx, 0x12
lea rax, [0x0070b5cc]
jmp 0x62d5e5
mov rdx, qword [rsp + 0x1d8]
mov rax, qword [rdx + 0x38]
lea rbx, [0x007072fe]
mov ecx, 0xa
nop
call fcn.0052cbe0
test rbx, rbx
je 0x62d6eb
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x108], rax
movups xmmword [rsp + 0x150], xmm15
call fcn.0040af80
lea rcx, [0x006a5b60]
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x100]
lea rcx, [0x0070a48a]
mov edi, 0x10
lea rsi, [rsp + 0x150]
mov r8d, 1
mov r9, r8
call fcn.004cf8e0
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rcx
nop
test rbx, rbx
jne 0x62dba2
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x62d6eb
cmp qword [rcx + 0x60], 0
je 0x62d6eb
lea rax, [0x006a8ba0]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
cmp dword [0x009d9570], 0
jne 0x62d6a5
mov r8, qword [rsp + 0x108]
jmp 0x62d6b5
call fcn.004673a0
mov r8, qword [rsp + 0x108]
mov qword [r11], r8
mov qword [rax], r8
mov r8, qword [rsp + 0x118]
mov rdx, qword [r8 + 0x60]
mov r9, qword [rdx]
mov ebx, 0xa
mov rcx, rax
mov edi, 1
mov rsi, rdi
lea rax, [0x007072fe]
nop
call r9
mov rcx, qword [rsp + 0x118]
lea rax, [0x006f9880]
mov rbx, qword [rsp + 0x1d8]
call fcn.006329a0
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rcx
test rbx, rbx
jne 0x62db84
mov qword [rsp + 0x110], rax
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x118]
call fcn.00633980
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
test rax, rax
jne 0x62db66
mov rdx, qword [rsp + 0x1d8]
mov rax, qword [rdx + 0x38]
mov rdi, qword [0x00983ab0]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x118]
nop dword [rax + rax]
call fcn.0062c0c0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
test rax, rax
jne 0x62db48
mov rax, qword [rsp + 0x1f8]
test rax, rax
je 0x62d7e9
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x100]
xor edi, edi
mov rsi, qword [rsp + 0x118]
call fcn.0062c0c0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
nop word [rax + rax]
test rax, rax
jne 0x62db2a
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x100]
lea rcx, [0x007043c7]
mov edi, 2
call fcn.00473de0
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rcx
nop word [rax + rax]
test rbx, rbx
jne 0x62db0c
mov rsi, qword [rsp + 0x118]
test rsi, rsi
je 0x62d84c
mov rdx, qword [rsi + 0x68]
test rdx, rdx
je 0x62d84c
mov rax, qword [rdx]
call rax
mov rsi, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x200]
test rdx, rdx
je 0x62d955
mov rcx, qword [rsp + 0x50]
lea rbx, [0x00789c00]
cmp rcx, rbx
jne 0x62d878
mov rax, qword [rsp + 0x100]
jmp 0x62d87d
mov eax, 0
je 0x62d884
test rsi, rsi
jmp 0x62d8cb
call fcn.004843a0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
nop dword [rax]
test rax, rax
jne 0x62d937
mov rax, qword [rsp + 0x118]
test rax, rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x200]
lea rbx, [0x00789c00]
mov rsi, rax
je 0x62d8e6
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x62d8e6
mov rcx, qword [rax]
mov rdx, rax
call rcx
mov rdx, qword [rsp + 0x200]
mov rax, qword [rdx]
call rax
test al, al
jne 0x62d955
mov byte [rsp + 0x4f], 1
mov rcx, qword [rsp + 0x1d8]
mov rdx, qword [rcx + 0x40]
nop
test rdx, rdx
je 0x62d910
mov rax, qword [rcx + 0x48]
mov rcx, qword [rdx + 0x18]
call rcx
movups xmmword [rsp + 0x140], xmm15
call fcn.00436380
mov rbx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x140]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
mov rbx, qword [rsp + 0x50]
lea rdx, [0x00789c00]
cmp rbx, rdx
jne 0x62d970
mov rax, qword [rsp + 0x100]
jmp 0x62d975
mov eax, 0
jne 0x62d9d0
mov rdx, qword [rsp + 0x110]
cmp byte [rdx + 0x88], 0
je 0x62d9d8
call fcn.004843a0
test rax, rax
jne 0x62d9a2
mov rdx, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x50]
nop
jmp 0x62d9d8
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
mov rdx, qword [rsp + 0x110]
mov byte [rsp + 0x4f], 1
mov rax, rdx
mov rcx, qword [rsp + 0x100]
call fcn.006340e0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
nop dword [rax]
test rax, rax
je 0x62daa5
mov rdx, qword [rsp + 0x110]
mov rsi, qword [rdx + 0x78]
cmp rax, rsi
jne 0x62da87
mov rdx, qword [rdx + 0x80]
mov rax, rsi
mov rcx, rbx
mov rbx, rdx
call fcn.00404a60
test al, al
je 0x62da87
movups xmmword [rsp + 0x160], xmm15
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x168], rdx
lea rax, [0x006c7080]
lea rbx, [rsp + 0x160]
call fcn.0040ad20
lea rcx, [0x0078a180]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rax
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x62dae5
call fcn.004843a0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
movups xmmword [rsp + 0x140], xmm15
call fcn.00436380
mov rbx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x140]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
nop
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
call fcn.00436380
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
add rsp, 0x1c8
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0062ce40