Function at 0x638a80
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x638d3a
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x28], rcx
lea rax, [0x006b5ba0]
mov rbx, rcx
mov rcx, rdi
call fcn.0040b1e0
nop dword [rax]
test rax, rax
jne 0x638d2f
mov rax, qword [rsp + 0x28]
cmp qword [0x0096bfc0], rax
jne 0x638af0
mov rcx, qword [0x0096bfc8]
mov rbx, qword [rsp + 0x60]
call fcn.00404a60
test al, al
jne 0x638d27
mov rax, qword [rsp + 0x30]
call fcn.00640800
nop word [rax + rax]
test al, al
je 0x638d1f
mov rax, qword [rsp + 0x28]
lea rdx, [0x0078a120]
cmp rax, rdx
jne 0x638b88
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0x40]
test rax, rax
je 0x638b4e
lea rsi, [0x0078aca0]
cmp rax, rsi
je 0x638b37
xor eax, eax
jmp 0x638b53
mov rbx, qword [rdx + 0x48]
lea rcx, [0x009d90e0]
call fcn.00404a60
mov rdx, qword [rsp + 0x50]
jmp 0x638b53
mov eax, 1
test al, al
je 0x638b5b
xor ecx, ecx
jmp 0x638b6c
mov rcx, qword [rdx + 0x58]
nop
test rcx, rcx
jne 0x638b6c
mov rcx, 0xffffffffffffffff
test rcx, rcx
jne 0x638b78
mov ecx, 1
jmp 0x638b80
cmp qword [rdx + 0x50], 0
setne cl
mov eax, ecx
add rsp, 0x38
pop rbp
ret
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rdx + 0x40]
test rsi, rsi
je 0x638bca
lea r8, [0x0078aca0]
nop dword [rax]
cmp rsi, r8
je 0x638ba9
xor ecx, ecx
jmp 0x638bcf
mov rbx, qword [rdx + 0x48]
mov rax, rsi
lea rcx, [0x009d90e0]
call fcn.00404a60
mov rdx, qword [rsp + 0x50]
mov ecx, eax
mov rax, qword [rsp + 0x28]
jmp 0x638bcf
mov ecx, 1
test cl, cl
jne 0x638bde
cmp qword [rdx + 0x50], 0
je 0x638cc7
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x638bec
mov r8, qword [rdx]
jmp 0x638bf8
mov esi, 3
lea r8, [0x00704511]
cmp rsi, 4
jg 0x638c28
nop
cmp rsi, 3
jne 0x638c17
cmp word [r8], 0x4547
jne 0x638c69
cmp byte [r8 + 2], 0x54
je 0x638c62
jmp 0x638c69
cmp rsi, 4
jne 0x638c69
cmp dword [r8], 0x44414548
je 0x638c62
jmp 0x638c69
cmp rsi, 5
jne 0x638c42
cmp dword [r8], 0x43415254
jne 0x638c69
cmp byte [r8 + 4], 0x45
je 0x638c62
nop
jmp 0x638c69
cmp rsi, 7
jne 0x638c69
cmp dword [r8], 0x4954504f
jne 0x638c69
cmp word [r8 + 4], 0x4e4f
jne 0x638c69
cmp byte [r8 + 6], 0x53
nop
jne 0x638c69
mov ecx, 1
jmp 0x638cc9
mov rbx, qword [rdx + 0x38]
lea rax, [0x006ef660]
lea rcx, [0x00709bf6]
mov edi, 0xf
call fcn.00412920
test bl, bl
je 0x638c90
mov ebx, 1
jmp 0x638cb1
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006ef660]
lea rcx, [0x0070adb7]
mov edi, 0x11
call fcn.00412920
test bl, bl
je 0x638cc2
mov rax, qword [rsp + 0x28]
mov ecx, 1
nop
jmp 0x638cc9
mov rax, qword [rsp + 0x28]
xor ecx, ecx
test cl, cl
je 0x638d17
lea rdx, [0x0078a140]
cmp rax, rdx
jne 0x638ce4
mov eax, 1
add rsp, 0x38
pop rbp
ret
cmp qword [0x0096c090], rax
jne 0x638d04
mov rcx, qword [0x0096c098]
mov rbx, qword [rsp + 0x60]
call fcn.00404a60
nop
test al, al
jne 0x638d0c
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov eax, 1
add rsp, 0x38
pop rbp
ret
xor eax, eax
add rsp, 0x38
pop rbp
ret
xor eax, eax
add rsp, 0x38
pop rbp
ret
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00638a80