joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570b20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x570d3f
push rbp
mov rbp, rsp
sub rsp, 0x48
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f420]
mov ecx, 0x74
mov edi, 0xa
call fcn.00534880
test bl, bl
je 0x570d2b
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f494]
mov ecx, 0x74
mov edi, 0xa
nop
call fcn.00534880
test bl, bl
je 0x570d18
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f036]
mov ecx, 0x60
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570d05
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f096]
mov ecx, 0x60
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570cf0
mov qword [rsp + 0x28], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f0f6]
mov ecx, 0x60
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570cdd
mov qword [rsp + 0x20], rax
lea rax, [0x006ec760]
call fcn.0040d7c0
mov qword [rax + 0x38], 5
lea rcx, [0x00704e21]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x180
cmp dword [0x009d9570], 0
jne 0x570c6d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x570c9e
call fcn.00467420
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x0096ba68]
test byte [rcx], al
cmp dword [0x009d9570], 0
je 0x570cd3
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
nop
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
nop
nop
call fcn.004654a0
jmp fcn.00570b20
Function at 0x570d60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x570f7f
push rbp
mov rbp, rsp
sub rsp, 0x48
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f694]
mov ecx, 0x9d
mov edi, 0xa
call fcn.00534880
test bl, bl
je 0x570f6b
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f731]
mov ecx, 0x9d
mov edi, 0xa
nop
call fcn.00534880
test bl, bl
je 0x570f58
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f508]
mov ecx, 0x84
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570f45
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f58c]
mov ecx, 0x84
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570f30
mov qword [rsp + 0x28], rax
nop
lea rax, [0x006ce540]
call fcn.0040d7c0
lea rbx, [0x0071f610]
mov ecx, 0x84
mov edi, 0x10
call fcn.00534880
test bl, bl
je 0x570f1d
mov qword [rsp + 0x20], rax
lea rax, [0x006ec760]
call fcn.0040d7c0
mov qword [rax + 0x38], 5
lea rcx, [0x00704e26]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0x209
cmp dword [0x009d9570], 0
jne 0x570ead
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x570ede
call fcn.00467420
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rdx, qword [rsp + 0x38]
mov qword [r11 + 8], rdx
mov rbx, qword [rsp + 0x30]
mov qword [r11 + 0x10], rbx
mov rsi, qword [rsp + 0x28]
mov qword [r11 + 0x18], rsi
mov rdi, qword [rsp + 0x20]
mov qword [r11 + 0x20], rdi
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rcx, qword [0x0096ba70]
test byte [rcx], al
cmp dword [0x009d9570], 0
je 0x570f13
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [rcx + 8]
mov qword [r11 + 8], rdx
mov qword [rcx + 8], rax
add rsp, 0x48
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
nop
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893d0]
call fcn.00436ea0
nop
nop
call fcn.004654a0
jmp fcn.00570d60
Function at 0x573940
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5739e6
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rbx + 0x50]
mov rbx, rdx
call fcn.00573b80
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx]
mov r9, qword [r8]
mov rdx, r8
call r9
mov rdx, qword [rsp + 0x58]
lea r8, [rdx + 0x28]
mov r9, qword [rdx + 0x28]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rdx, r8
call r9
test rbx, rbx
jne 0x5739d0
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x50]
mov rcx, rax
mov rax, qword [rsp + 0x50]
call fcn.00573e60
add rsp, 0x40
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893e0]
nop
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00573940

Function at 0x573a40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x573b1c
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x78], r9
mov rdx, qword [rbx + 0x48]
mov rbx, rdx
call fcn.005740a0
nop word [rax + rax]
test rbx, rbx
jne 0x573b08
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x48]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
call fcn.00573b80
mov rdx, qword [rsp + 0x50]
lea r8, [rdx + 0x20]
mov r9, qword [rdx + 0x20]
mov rdi, rbx
mov rsi, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, rbx
mov rdx, r8
call r9
test rbx, rbx
jne 0x573af5
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 0x48]
mov rcx, rax
mov rax, qword [rsp + 0x30]
call fcn.00573e60
add rsp, 0x38
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007893e0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007893f0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00573a40
Function at 0x573d40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x573dfe
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov rdx, qword [rbx + 0x38]
mov rbx, rdx
call fcn.005740a0
test rbx, rbx
jne 0x573dea
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x38]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call fcn.005740a0
test rbx, rbx
jne 0x573dd7
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx + 0x10]
mov rdi, qword [rdx + 0x10]
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rax, rbx
mov rdx, rsi
call rdi
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsi + 0x38]
mov rcx, rax
mov rax, qword [rsp + 0x28]
call fcn.00573e60
add rsp, 0x40
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789400]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00789400]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00573d40
Function at 0x579680
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x579705
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x579866
cmp rcx, 0xe
jne 0x579780
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x579866
cmp rcx, 0xf
jne 0x5797f7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x579866
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x57fd40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57fe25
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
cmp rsi, 8
je 0x57fdd8
test rbx, rbx
je 0x57fdd8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
cmp rsi, 8
sbb edx, edx
mov byte [rsp + 0x1f], dl
lea rax, [0x006a5ea0]
mov rcx, rbx
call fcn.0044bc20
mov rdx, qword [rsp + 0x38]
movzx esi, byte [rdx]
mov rcx, qword [rsp + 0x28]
shr sil, cl
movzx edi, byte [rsp + 0x1f]
and esi, edi
mov byte [rax], sil
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8d, 1
jmp 0x57fe17
add rsp, 0x40
pop rbp
ret
movzx r9d, byte [r8 + rdx - 1]
mov r10, rcx
mov rcx, rsi
shl r9d, cl
lea r11, [r8 + 1]
cmp rcx, 0x20
sbb r12d, r12d
and r9d, r12d
mov byte [rax + r8], r9b
movzx r12d, byte [rdx + r8]
mov rcx, r10
shr r12b, cl
and r12d, edi
or r9d, r12d
mov byte [rax + r8], r9b
mov r8, r11
cmp rbx, r8
jg 0x57fdde
mov rcx, rbx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0057fd40
Function at 0x58bb00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58bc86
push rbp
mov rbp, rsp
sub rsp, 0x38
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], bl
cmp qword [rax], 0
nop
jne 0x58bc67
cmp qword [rax + 0x30], 0
jne 0x58bc6d
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
inc rdx
nop dword [rax]
test rdx, rdx
jg 0x58bb97
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x1b
lea rcx, [0x007116d9]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
je 0x58bb90
nop dword [rax + rax]
call fcn.004673c0
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
cmp byte [rax + 0x28], 0
je 0x58bbf8
mov rdx, qword [rax + 0x18]
inc rdx
cmp qword [rax + 0x20], rdx
jge 0x58bbf8
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c2b7]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
nop
je 0x58bbf2
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x58bc67
mov rcx, qword [rax + 0x20]
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 1]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x58bc39
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x006a5ea0]
call fcn.0044bd00
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x009d9570], 0
je 0x58bc63
call fcn.004673c0
mov qword [r11], r8
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789210]
nop dword [rax + rax]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
nop
jmp fcn.0058bb00
Function at 0x58bcc0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58be46
push rbp
mov rbp, rsp
sub rsp, 0x38
mov word [rsp + 0x2e], 0
rol bx, 8
mov word [rsp + 0x2e], bx
cmp qword [rax], 0
jne 0x58be29
cmp qword [rax + 0x30], 0
jne 0x58be2f
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
add rdx, 2
cmp rdx, 2
jge 0x58bd59
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x1b
lea rcx, [0x007116d9]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
nop
je 0x58bd52
call fcn.004673c0
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
cmp byte [rax + 0x28], 0
je 0x58bdb9
mov rdx, qword [rax + 0x18]
add rdx, 2
cmp qword [rax + 0x20], rdx
jge 0x58bdb9
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c2b7]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
je 0x58bdb3
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x58be29
mov rcx, qword [rax + 0x20]
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 2]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x58bdfa
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 2
lea rsi, [0x006a5ea0]
call fcn.0044bd00
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
movzx esi, word [rsp + 0x2e]
mov word [r8 + rbx], si
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x009d9570], 0
je 0x58be25
call fcn.004673c0
mov qword [r11], r8
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789210]
nop dword [rax]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop
jmp fcn.0058bcc0
Function at 0x58be80
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58c000
push rbp
mov rbp, rsp
sub rsp, 0x38
mov dword [rsp + 0x2c], 0
bswap ebx
mov dword [rsp + 0x2c], ebx
cmp qword [rax], 0
jne 0x58bfe6
cmp qword [rax + 0x30], 0
jne 0x58bfec
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp rdx, 4
jge 0x58bf17
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x1b
lea rcx, [0x007116d9]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
je 0x58bf10
nop
call fcn.004673c0
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
cmp byte [rax + 0x28], 0
je 0x58bf78
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp qword [rax + 0x20], rdx
jge 0x58bf78
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c2b7]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x48]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
nop
je 0x58bf72
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x58bfe6
mov rcx, qword [rax + 0x20]
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 4]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x58bfb9
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 4
lea rsi, [0x006a5ea0]
call fcn.0044bd00
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x2c]
mov dword [r8 + rbx], esi
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x009d9570], 0
je 0x58bfe2
call fcn.004673c0
mov qword [r11], r8
mov rcx, qword [rax + 0x10]
mov qword [r11 + 8], rcx
mov qword [rax + 0x10], r8
add rsp, 0x38
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789210]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0058be80
Function at 0x58c020
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58c1e6
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
cmp qword [rax], 0
nop dword [rax + rax]
jne 0x58c1ca
cmp qword [rax + 0x30], 0
jne 0x58c1d0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov rdx, qword [rax + 0x18]
add rdx, rcx
cmp rcx, rdx
jle 0x58c0c3
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x1b
lea rcx, [0x007116d9]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
je 0x58c0b2
call fcn.004673c0
mov qword [r11], rax
mov r8, qword [rdx + 8]
mov qword [r11 + 8], r8
mov qword [rdx + 8], rax
mov rax, rdx
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
cmp byte [rax + 0x28], 0
je 0x58c128
mov rdx, qword [rax + 0x18]
add rdx, rcx
cmp qword [rax + 0x20], rdx
jge 0x58c128
lea rax, [0x006c0560]
nop dword [rax]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c2b7]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rcx
cmp dword [0x009d9570], 0
je 0x58c11f
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [rdx + 8]
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rax
jmp 0x58c1ca
mov rdx, qword [rax + 0x20]
mov r8, qword [rax + 0x18]
lea r9, [rcx + r8]
mov r10, qword [rax + 0x10]
cmp rdx, r9
jae 0x58c172
mov qword [rsp + 0x30], r8
mov rax, r10
mov rbx, r9
mov rdi, rcx
lea rsi, [0x006a5ea0]
mov rcx, rdx
call fcn.0044bd00
mov r8, qword [rsp + 0x30]
mov r10, rax
mov rdx, rcx
mov r9, rbx
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x38], r10
lea rax, [r10 + r8]
call fcn.00468160
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov qword [rsi + 0x18], rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsi + 0x20], rdx
cmp dword [0x009d9570], 0
jne 0x58c1b1
mov rax, qword [rsp + 0x38]
jmp 0x58c1c6
call fcn.004673c0
mov rax, qword [rsp + 0x38]
mov qword [r11], rax
mov rcx, qword [rsi + 0x10]
mov qword [r11 + 8], rcx
mov qword [rsi + 0x10], rax
add rsp, 0x40
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789210]
nop
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0058c020
Function at 0x58efe0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58f157
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x68], rdi
mov rdx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rdx + 0x30]
call rdx
cmp qword [rax + 0x38], 5
jne 0x58f085
mov rdx, qword [rax + 0x30]
cmp dword [rdx], 0x35322d50
jne 0x58f085
cmp byte [rdx + 4], 0x36
jne 0x58f085
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x18]
mov rdi, qword [rsi]
mov rdi, qword [rdi + 8]
shl rdi, 6
sub rdi, qword [rsi + 8]
lea rsi, [rdi + 7]
sar rsi, 0x3f
shr rsi, 0x3d
lea rcx, [rsi + rdi]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x30], rcx
nop
lea rax, [0x006a5ea0]
mov rbx, rcx
call fcn.0044bc20
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
mov rdi, qword [rdx + 8]
mov r8, qword [rsp + 0x30]
mov rcx, r8
xor ebx, ebx
jmp 0x58f0b5
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x20]
mov rdi, qword [rdx + 0x28]
mov rsi, qword [rdx + 0x30]
mov r8, qword [rdx + 0x18]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
call fcn.00577120
add rsp, 0x40
pop rbp
ret
inc rbx
mov r8, r11
cmp rbx, rdi
jge 0x58f0cf
mov r9, qword [rsi + rbx*8]
xor r10d, r10d
jmp 0x58f125
test r9, r9
je 0x58f0af
jmp 0x58f13b
mov r11, r8
jmp 0x58f0af
mov rbx, rcx
call fcn.00560c20
test rdi, rdi
jne 0x58f085
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x18]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x38]
call fcn.00575340
test rbx, rbx
jne 0x58f103
add rsp, 0x40
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789390]
call fcn.00436ea0
mov byte [r8 + rax - 1], r9b
inc r10
shr r9, 8
mov r8, r11
cmp r10, 8
jge 0x58f0ca
lea r11, [r8 - 1]
test r11, r11
jl 0x58f0c3
cmp rcx, r11
ja 0x58f116
jmp 0x58f14e
lea rax, [0x006a5b60]
lea rbx, [0x00789380]
call fcn.00436ea0
mov rax, r11
call fcn.00467760
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0058efe0