joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416700
Capabilities:
Access peb ldr_data
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4168ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x005aa2a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41676e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416781
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4167a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4167b9
cmp rbx, 0x1000
jae 0x416778
nop
jmp 0x416829
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4167cd
xor edx, edx
jmp 0x416820
mov rcx, qword [0x005aa2a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4167af
jmp 0x416795
call fcn.004631c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437640
lea rax, [0x004fb29e]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x38]
call fcn.00437c40
lea rax, [0x004fb376]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x30]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fdd99]
mov ebx, 0x21
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416700
Function at 0x4168e0
Capabilities:
Access peb ldr_data
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416b0a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x005aa2b0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432f60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41695b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41696e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416990
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4169a4
cmp rbx, 0x1000
jae 0x416965
jmp 0x416a2e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4169b6
xor esi, esi
jmp 0x416a20
mov rax, qword [0x005aa2b0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432f60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41699a
jmp 0x416982
call fcn.004631c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416aa9
call fcn.00437640
lea rax, [0x004fb8ee]
mov ebx, 0x19
call fcn.00437f40
mov rax, qword [rsp + 0x68]
call fcn.00437c40
lea rax, [0x004fb376]
mov ebx, 0x19
nop
call fcn.00437f40
mov eax, dword [rsp + 0x34]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004f7503]
mov ebx, 0xd
call fcn.00435d80
cmp eax, 0x5af
je 0x416a53
call fcn.00437640
lea rax, [0x004fb8ee]
mov ebx, 0x19
call fcn.00437f40
mov rax, qword [rsp + 0x38]
call fcn.00437c40
lea rax, [0x004fb376]
mov ebx, 0x19
nop dword [rax]
call fcn.00437f40
mov eax, dword [rsp + 0x34]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fd5a9]
mov ebx, 0x1f
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004168e0
Function at 0x416b40
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x30], rbx
mov rcx, qword [0x005aa2a8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x416ba1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
call fcn.004631c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.00437640
lea rax, [0x004fb29e]
mov ebx, 0x18
call fcn.00437f40
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00437c40
lea rax, [0x004fb376]
mov ebx, 0x19
call fcn.00437f40
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fd8a4]
mov ebx, 0x20
nop dword [rax + rax]
call fcn.00435d80
nop
int3

Function at 0x417c80
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417d57
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop dword [rax + rax]
cmp rbx, 0x4000
ja 0x417d45
cmp rbx, 8
mov edx, 8
cmovb rbx, rdx
mov qword [rax], rbx
cmp dword [0x0061c170], 0
jne 0x417cd0
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
jmp 0x417ce8
lea rdx, [rax + 8]
mov r8, rdi
mov rdi, rdx
call fcn.00461940
lea rdi, [rax + 0x10]
call fcn.004619c0
movups xmmword [rax + 0x18], xmm15
mov dword [rax + 0x28], 0
test rbx, rbx
je 0x417d3b
mov rcx, rax
mov eax, 0x4000
xor edx, edx
div rbx
imul rax, rbx
mov dword [rcx + 0x2c], eax
mov qword [rcx + 0x30], 0
cmp dword [0x0061c170], 0
jne 0x417d24
mov qword [rcx + 0x38], rsi
jmp 0x417d2d
lea rdi, [rcx + 0x38]
call fcn.004619a0
mov byte [rcx + 0x40], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
nop dword [rax + rax]
call fcn.00434200
lea rax, [0x004fd8c4]
mov ebx, 0x20
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00417c80
Function at 0x417da0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417eae
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x417e81
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x417e08
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x417dfb
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00462380
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x417e38
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040d260
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x417e60
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00437640
lea rax, [0x00500cf7]
mov ebx, 0x34
call fcn.00437f40
call fcn.004376c0
lea rax, [0x004fad0c]
mov ebx, 0x17
call fcn.00435d80
nop
mov qword [rsp + 8], rax
call fcn.0045f600
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00417da0
Function at 0x41afe0
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
cmp rdi, 0x989680
jb 0x41b01f
mov rdx, rax
movabs rax, 0x8637bd05af6c69b6
mov rsi, rdx
mul rdi
shr rdx, 0x13
lea rdi, [rbx - 1]
mov rax, rdi
jmp 0x41b157
shr rdi, 1
mov rdx, rax
movabs rax, 0x83126e978d4fdf3c
mov rsi, rdx
mul rdi
shr rdx, 8
test rdx, rdx
je 0x41b045
mov eax, 3
jmp 0x41b093
test rbx, rbx
jbe 0x41b071
mov byte [rsi], 0x30
cmp rcx, 1
jb 0x41b065
mov rax, rsi
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 1
xor edx, edx
call fcn.00461d60
xor eax, eax
mov rcx, rax
call fcn.00461ce0
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdi - 1]
cmp rdx, 0x64
jae 0x41b07b
lea rdi, [rbx - 1]
mov r8, rbx
sub rbx, rax
lea r9, [rbx - 1]
jmp 0x41b0ac
mov rdi, rax
cmp rdx, 0xa
jae 0x41b0b7
cmp rdi, r9
jl 0x41b100
movabs rax, 0xcccccccccccccccd
mov rbx, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub rbx, r10
cmp r8, rdi
jbe 0x41b146
lea r10, [rbx + 0x30]
mov byte [rsi + rdi], r10b
lea rax, [rdi - 1]
cmp rax, r9
jne 0x41b0a9
cmp r8, rax
jbe 0x41b13e
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41b0a9
cmp r8, rdi
jbe 0x41b133
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
lea rax, [rcx + rsi]
sub r8, rdi
mov rbx, r8
mov rcx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdi
mov rcx, r8
call fcn.00461ce0
mov rcx, r8
call fcn.00461ce0
mov rax, rdi
mov rcx, r8
call fcn.00461ce0
mov rdi, rax
mov rax, r8
cmp rdx, 0xa
jae 0x41b165
nop dword [rax]
cmp rdi, rax
jl 0x41b1b0
mov r8, rax
movabs rax, 0xcccccccccccccccd
mov r9, rdx
mul rdx
shr rdx, 3
lea r10, [rdx + rdx*4]
shl r10, 1
sub r9, r10
cmp rbx, rdi
jbe 0x41b1f4
add r9, 0x30
mov byte [rsi + rdi], r9b
lea rax, [rdi - 1]
cmp rax, r8
jne 0x41b151
nop dword [rax]
cmp rbx, rax
jbe 0x41b1ec
mov byte [rdi + rsi - 1], 0x2e
lea rax, [rdi - 2]
jmp 0x41b151
cmp rbx, rdi
jbe 0x41b1e1
add rdx, 0x30
mov byte [rsi + rdi], dl
sub rcx, rdi
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
lea rax, [rsi + rcx]
sub rbx, rdi
mov rcx, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
mov rax, rdi
mov rcx, rbx
call fcn.00461ce0
mov rcx, rbx
call fcn.00461ce0
mov rax, rdi
mov rcx, rbx
call fcn.00461ce0
nop
Function at 0x41b200
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b286
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41b274
cmp byte [rdx + 0x20], bl
je 0x41b263
mov qword [rsp + 0x10], rdx
mov byte [rsp + 0x30], bl
mov rax, rdx
mov rbx, rcx
call fcn.0041b400
movzx ecx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x10]
mov byte [rdx + 0x20], cl
mov byte [rdx + 0x21], 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00500001]
mov ebx, 0x2d
call fcn.00435d80
lea rax, [0x00500425]
mov ebx, 0x2f
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041b200

Function at 0x41b2c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b339
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp byte [rax + 0x21], 0
je 0x41b327
mov rdx, qword [rax + 0x40]
nop
cmp rdx, rbx
jg 0x41b30f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rcx, rbx
sub rcx, rdx
movsxd rdx, dword [rax + 0x4c]
imul rcx, rdx
xor ebx, ebx
nop
call fcn.0041b600
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
nop
xchg qword [rax + 0x40], rbx
mov byte [rax + 0x21], 0
call fcn.0041b6a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00500454]
mov ebx, 0x2f
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041b2c0
Function at 0x41b400
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b5da
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rdx, qword [rax + 0x40]
nop dword [rax]
cmp rdx, rbx
jg 0x41b4bc
movsxd rsi, dword [rax + 0x4c]
nop
mov rdi, rbx
xchg qword [rax + 0x40], rbx
nop
mov r8, qword [rax + 0x28]
mov rbx, rdi
sub rbx, rdx
imul rbx, rsi
test r8, r8
je 0x41b457
mov rdx, r8
neg r8
lock xadd qword [rax + 0x28], r8
jmp 0x41b45a
mov rdx, r8
nop
mov rsi, qword [rax + 0x38]
nop
test rsi, rsi
je 0x41b473
mov r8, rsi
neg rsi
lock xadd qword [rax + 0x38], rsi
jmp 0x41b476
mov r8, rsi
cmp byte [rax + 0x50], 0
jne 0x41b4c6
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rdi
mov r9, qword [r14 + 0x30]
nop
inc dword [r9 + 0xd8]
mov r9, qword [0x005c7ea0]
mov qword [rsp + 0x50], r9
mov r10, qword [0x005c7ea8]
mov qword [rsp + 0x38], r10
mov r11, qword [r14 + 0x30]
mov qword [rsp + 0x48], r11
xor ecx, ecx
jmp 0x41b527
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
cmp byte [rax + 0x20], 0
je 0x41b4e8
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
movsd xmm1, qword [0x00527660]
mulsd xmm0, xmm1
cvttsd2si rsi, xmm0
add rdx, rsi
sub rbx, r8
sub rbx, rdx
mov rcx, rdx
call fcn.0041b600
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
mov rcx, qword [rsp + 0x30]
inc rcx
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x40]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x48]
cmp rcx, r10
jge 0x41b592
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
mov rax, qword [r9 + rcx*8]
test byte [rax], al
add rax, 0x1228
mov rbx, rdi
call fcn.0041b7e0
cmp al, 1
ja 0x41b563
test al, al
jne 0x41b57f
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
jmp 0x41b501
cmp al, 2
je 0x41b56b
cmp al, 3
jne 0x41b57b
mov rsi, qword [rsp + 0x28]
lea rdx, [rsi + rbx]
mov r8, qword [rsp + 0x20]
jmp 0x41b501
cmp al, 4
jne 0x41b5c8
mov rsi, qword [rsp + 0x20]
lea r8, [rsi + rbx]
mov rdx, qword [rsp + 0x28]
jmp 0x41b501
nop
mov esi, dword [r11 + 0xd8]
lea edi, [rsi - 1]
mov dword [r11 + 0xd8], edi
cmp esi, 1
jne 0x41b4c6
cmp byte [r14 + 0xb1], 0
je 0x41b4c6
mov qword [r14 + 0x10], 0xfffffffffffffade
jmp 0x41b4c6
lea rax, [0x004fd7c4]
mov ebx, 0x20
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041b400
Function at 0x41b700
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b7b3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx], esi
sete sil
test sil, sil
je 0x41b7a1
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x10], rdx
mov rax, rdx
nop dword [rax + rax]
call fcn.0041b400
mov ecx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x4c], ecx
movsxd rcx, ecx
imul rcx, rcx, 0x3b9aca00
mov qword [rax + 0x10], rcx
mov rdx, qword [rax + 8]
cmp rdx, rcx
jbe 0x41b786
mov qword [rax + 8], rcx
nop
nop
lea rcx, [rax + 4]
mov edx, 1
xchg byte [rcx], dl
mov ecx, dword [0x0061fa58]
inc ecx
xchg dword [rax + 0x48], ecx
jmp 0x41b792
jae 0x41b792
nop
nop
lea rcx, [rax + 4]
xor edx, edx
xchg byte [rcx], dl
call fcn.0041b6a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004ff338]
mov ebx, 0x28
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.0041b700

Function at 0x41b880
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b9c6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
jmp 0x41b89d
mov rax, rdx
mov rdx, qword [rax]
mov rsi, rdx
shr rdx, 0x3d
cmp bl, dl
jne 0x41b95a
mov rdx, rax
mov rax, rsi
xor edi, edi
lock cmpxchg qword [rdx], rdi
sete r8b
test r8b, r8b
je 0x41b89a
movabs rdx, 0xe000000000000000
and rdx, rcx
movabs rdi, 0x1fffffffffffffff
and rdi, rsi
or rdx, rdi
mov rsi, rcx
sub rcx, rdx
cmp rsi, rdx
mov edx, 0
cmovl rcx, rdx
test rcx, rcx
je 0x41b93f
cmp bl, 2
ja 0x41b90c
nop
cmp bl, 1
je 0x41b927
cmp bl, 2
je 0x41b911
jmp 0x41b949
cmp bl, 3
jne 0x41b922
nop
lea rax, [0x0061c428]
lock xadd qword [rax], rcx
nop
jmp 0x41b935
cmp bl, 4
jne 0x41b949
nop
nop
lea rax, [0x0061c438]
lock xadd qword [rax], rcx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00500b26]
mov ebx, 0x33
call fcn.00435d80
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x10], rdx
call fcn.00437640
lea rax, [0x004f7957]
mov ebx, 0xe
call fcn.00437f40
movzx eax, byte [rsp + 0x30]
movzx eax, al
call fcn.00437c40
lea rax, [0x004f5779]
mov ebx, 5
call fcn.00437f40
mov rax, qword [rsp + 0x10]
nop dword [rax]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x00501514]
mov ebx, 0x3e
nop dword [rax + rax]
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041b880
Function at 0x41c5a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41c830
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov edx, dword [0x005ee2d8]
mov rcx, qword [0x005ee5b0]
mov rsi, qword [0x005ee5a8]
cmp rbx, rcx
jae 0x41c827
mov rbx, qword [rsi + rbx*8]
mov rsi, rbx
shr rbx, 0x14
cmp rbx, 0x40
jae 0x41c81a
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x68], rax
lea rdi, [0x005ee330]
mov rbx, qword [rdi + rbx*8]
test byte [rbx], al
and esi, 0xfffff
mov rbx, qword [rbx + rsi*8]
mov qword [rsp + 0x50], rbx
test byte [rbx], al
xor ecx, ecx
jmp 0x41c618
inc rcx
cmp rcx, 0x40
jge 0x41c63f
lea rsi, [rbx + rcx]
lea rsi, [rsi + 0x21080]
mov sil, byte [rsi]
test sil, sil
je 0x41c615
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2e], sil
xor edi, edi
jmp 0x41c650
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41c615
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41c649
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41c80d
mov r9, qword [rbx + r9*8 + 0x20000]
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41c7c9
mov qword [rsp + 0x58], rcx
cmp byte [0x0061bed2], 0
jne 0x41c6b5
mov r10d, dword [r9 + 0x58]
cmp r10d, edx
je 0x41c6b5
lea r11d, [rdx + 3]
cmp r10d, r11d
jne 0x41c77a
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x60], rax
nop
call fcn.0040ae00
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x80]
jmp 0x41c70d
nop
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.0040b020
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rsp + 0x2e]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41c649
mov rdx, qword [rdx]
test rdx, rdx
je 0x41c6d7
cmp byte [rdx + 0xa], 1
jne 0x41c70a
movzx eax, word [rdx + 8]
mov rsi, qword [rcx + 0x68]
mov rdi, qword [rcx + 0x18]
test rsi, rsi
je 0x41c775
mov qword [rsp + 0x38], rdx
xor edx, edx
div rsi
imul rax, rsi
add rax, rdi
mov rbx, qword [rsp + 0x68]
nop
call fcn.0041e460
mov rax, qword [rsp + 0x38]
lea rcx, [rax + 0x10]
mov ebx, 8
mov rdi, qword [rsp + 0x68]
xor esi, esi
mov rax, rcx
lea rcx, [0x005aa3c0]
call fcn.0041e2c0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41c70a
call fcn.00434200
mov dword [rsp + 0x34], r10d
nop
call fcn.00437640
lea rax, [0x004f5b32]
mov ebx, 6
call fcn.00437f40
mov eax, dword [rsp + 0x34]
call fcn.00437c40
nop
call fcn.00437860
mov eax, dword [rsp + 0x30]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004f825c]
mov ebx, 0x10
call fcn.00435d80
mov byte [rsp + 0x2f], r10b
call fcn.00437640
lea rax, [0x004f676a]
mov ebx, 0xa
nop
call fcn.00437f40
movzx eax, byte [rsp + 0x2f]
movzx eax, al
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004ffa54]
mov ebx, 0x2b
call fcn.00435d80
mov rax, r9
mov ecx, 0x200
call fcn.00461d00
mov rax, rbx
mov ecx, 0x40
call fcn.00461d00
mov rax, rbx
call fcn.00461ce0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041c5a0
Function at 0x41f1e0
Capabilities:
Hash data using murmur3
Run powershell expression

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x0061bed2], 0
jne 0x41f2cf
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41f2c5
lea rbx, [0x005ee330]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41f2a7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00461d00
lea rax, [0x004ffc86]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00435d80
nop
int3