joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55bfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x55c15b
push rbp
mov rbp, rsp
sub rsp, 0xa0
nop word [rax + rax]
cmp cl, 0x10
jae 0x55c147
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xc0], cl
mov qword [rsp + 0xb8], rbx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x55c115
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0055bee0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
cmp dl, 0x10
jae 0x55c131
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x55c0c8
jmp 0x55c13a
add rsp, 0xa0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00467760
lea rax, [0x006a5b60]
lea rbx, [0x007896d0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax]
jmp fcn.0055bfc0
Function at 0x55e360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55e47e
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.0055e1c0
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.00569b20
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x55e3f3
test byte [rcx], al
mov rsi, qword [rsp + rax*8 + 0x18]
xor rsi, qword [rcx + rax*8]
inc rax
or rdx, rsi
cmp rax, 4
jl 0x55e3e2
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
nop
nop dword [rax + rax]
cmp rcx, 1
je 0x55e474
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x17
lea rcx, [0x0070f259]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x68
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0055e360
Function at 0x563160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x563346
push rbp
mov rbp, rsp
sub rsp, 0xd0
nop word [rax + rax]
cmp cl, 0x10
jae 0x563332
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x563300
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.00563080
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
nop
cmp dl, 0x10
jae 0x56331c
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x5632b2
jmp 0x563325
add rsp, 0xd0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00467760
lea rax, [0x006a5b60]
lea rbx, [0x007896e0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00563160
Function at 0x566c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x566ebd
push rbp
mov rbp, rsp
sub rsp, 0x118
nop dword [rax]
cmp cl, 0x10
jae 0x566ea9
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x566e77
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.00566ba0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x566e93
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x566e2a
jmp 0x566e9c
add rsp, 0x118
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00467760
lea rax, [0x006a5b60]
lea rbx, [0x007896f0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop
jmp fcn.00566c80
Function at 0x56a060
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x56a0ad
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x56a140
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x56a185
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x56cbe0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56cc85
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
cmp rcx, 0x20
je 0x56cc2d
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x2e
lea rcx, [0x0071a3ff]
mov qword [rax], rcx
lea rbx, [0x00789ac0]
mov rcx, rax
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov rdx, qword [rbx]
movabs rsi, 0x7ffffffffffff
and rdx, rsi
mov qword [rax], rdx
mov rdx, qword [rbx + 6]
shr rdx, 3
and rdx, rsi
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0xc]
shr rdx, 6
and rdx, rsi
mov qword [rax + 0x10], rdx
mov rdx, qword [rbx + 0x13]
shr rdx, 1
and rdx, rsi
mov qword [rax + 0x18], rdx
mov rdx, qword [rbx + 0x18]
shr rdx, 0xc
and rsi, rdx
mov qword [rax + 0x20], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0056cbe0

Function at 0x56ccc0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56cdf4
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.0056c180
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x56cd54
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x56cd97
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x56cdc1
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x56cd4e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x56cd4e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x56cdaa
mov rax, rsi
mov ecx, 0x20
call fcn.00467760
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0056ccc0
Function at 0x56e4c0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x56e626
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
cmp rsi, rbx
jne 0x56e60e
cmp rbx, 0x48
jg 0x56e5fb
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor ecx, ecx
jmp 0x56e560
movzx r9d, byte [rax + rbx - 1]
mov byte [rsp + rcx + 0x58], r9b
mov byte [rsp + rcx + 0x10], sil
inc rcx
mov rbx, r8
mov rsi, rdx
nop dword [rax]
cmp rbx, rcx
jle 0x56e58a
mov rdx, rsi
sub rsi, rcx
lea r8, [rsi - 1]
cmp rdx, r8
jbe 0x56e5f0
mov r8, rbx
sub rbx, rcx
lea r9, [rbx - 1]
movzx esi, byte [rdi + rsi - 1]
cmp r8, r9
ja 0x56e543
jmp 0x56e5e5
xor eax, eax
xor ecx, ecx
jmp 0x56e5a9
mov rdx, qword [rsp + rbx + 0x58]
mov rbx, qword [rsp + rbx + 0x10]
add rax, 8
neg ecx
sbb rdx, rbx
sbb rcx, rcx
neg rcx
cmp rax, 0x48
jge 0x56e5c8
lea rdx, [rax - 0x48]
mov rbx, rdx
neg rdx
sar rbx, 0x3f
and rbx, rax
cmp rdx, 7
ja 0x56e590
jmp 0x56e5d8
cmp rcx, 1
sete al
add rsp, 0xa0
pop rbp
ret
mov eax, 7
mov rcx, rdx
call fcn.00467760
mov rax, r9
mov rcx, r8
call fcn.00467760
mov rax, r8
mov rcx, rdx
call fcn.00467760
lea rax, [0x006a5b60]
lea rbx, [0x007895f0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007895e0]
nop dword [rax]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0056e4c0
Function at 0x56f360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56f45e
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x30], rdx
call fcn.00547fc0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
call rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rbx + 0x10]
mov rdi, qword [rbx + 0x18]
mov rbx, qword [rbx + 0x20]
mov r8, rbx
mov rbx, rsi
mov rcx, rdi
mov rdi, r8
mov r10, rdx
mov rdx, qword [rsp + 0x30]
call r10
test rbx, rbx
jne 0x56f44b
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x50]
lea r8, [rdx + 0x18]
mov r9, qword [rdx + 0x18]
mov r10, qword [rsp + 0x58]
mov rcx, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x18]
mov rsi, qword [r10 + 0x20]
mov rbx, rax
mov rdx, r8
call r9
test rbx, rbx
je 0x56f42e
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x38
pop rbp
ret
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 0x20]
mov rbx, qword [rdx + 0x20]
mov rax, qword [rsp + 0x28]
mov rdx, rcx
call rbx
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0056f360

Function at 0x570580
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x570618
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
cmp qword [rcx + 0x10], 0
jne 0x5705a7
xor edx, edx
jmp 0x5705ba
cmp byte [rcx], 0
je 0x5705b5
mov rdx, 0xffffffffffffffff
jmp 0x5705ba
mov edx, 1
test rdx, rdx
jne 0x5705eb
cmp qword [rdi + 0x10], 0
jne 0x5705ca
xor edx, edx
jmp 0x5705e0
cmp byte [rdi], 0
je 0x5705d8
mov rdx, 0xffffffffffffffff
jmp 0x5705e0
mov edx, 1
nop dword [rax]
test rdx, rdx
jne 0x5705eb
add rsp, 0x18
pop rbp
ret
mov rdx, qword [rax + 0x28]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call rdx
test al, al
je 0x570604
add rsp, 0x18
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893c0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00570580
Function at 0x5706a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5708bf
push rbp
mov rbp, rsp
sub rsp, 0x48
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071df18]
mov ecx, 0x44
mov edi, 0xa
call fcn.00534880
test bl, bl
je 0x5708ab
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071df5c]
mov ecx, 0x44
mov edi, 0xa
nop
call fcn.00534880
test bl, bl
je 0x570898
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071c8f8]
mov ecx, 0x38
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570885
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071c930]
mov ecx, 0x38
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570870
mov qword [rsp + 0x28], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071c968]
mov ecx, 0x38
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x57085d
mov qword [rsp + 0x20], rax
lea rax, [0x006ec760]
call fcn.0040d7c0
mov qword [rax + 0x38], 5
lea rcx, [0x00704e17]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
cmp dword [0x009d9570], 0
jne 0x5707ed
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x57081e
call fcn.00467420
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x0096ba58]
test byte [rcx], al
cmp dword [0x009d9570], 0
je 0x570853
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
nop
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
nop
nop
call fcn.004654a0
jmp fcn.005706a0
Function at 0x5708e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x570aff
push rbp
mov rbp, rsp
sub rsp, 0x48
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071e810]
mov ecx, 0x4e
mov edi, 0xa
call fcn.00534880
test bl, bl
je 0x570aeb
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071e85e]
mov ecx, 0x4e
mov edi, 0xa
nop
call fcn.00534880
test bl, bl
je 0x570ad8
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071d8aa]
mov ecx, 0x40
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570ac5
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071d8ea]
mov ecx, 0x40
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570ab0
mov qword [rsp + 0x28], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071d92a]
mov ecx, 0x40
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570a9d
mov qword [rsp + 0x20], rax
lea rax, [0x006ec760]
call fcn.0040d7c0
mov qword [rax + 0x38], 5
lea rcx, [0x00704e1c]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x100
cmp dword [0x009d9570], 0
jne 0x570a2d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x570a5e
call fcn.00467420
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x0096ba60]
test byte [rcx], al
cmp dword [0x009d9570], 0
je 0x570a93
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
nop
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
nop
nop
call fcn.004654a0
jmp fcn.005708e0