joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f2e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x43f54c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x005ce0b0], 0
je 0x43f317
mov eax, 0x14
xor ebx, ebx
call fcn.00455160
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x43f425
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x43f35e
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.0044fea0
test rax, rax
je 0x43f40f
movzx edx, byte [rax + 0x25]
test dl, 2
jne 0x43f3b4
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043a640
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax]
call fcn.00439d80
call fcn.0043e8e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00450620
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.00437640
lea rax, [0x004fe9c9]
mov ebx, 0x25
call fcn.00437f40
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00437f40
lea rax, [0x004f8894]
mov ebx, 0x12
call fcn.00437f40
call fcn.004376c0
lea rax, [0x004f7dd9]
mov ebx, 0xf
call fcn.00435d80
lea rax, [0x004f9fcd]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00435d80
nop
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00437640
lea rax, [0x004f838c]
mov ebx, 0x10
call fcn.00437f40
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00437ec0
lea rax, [0x004f5bc5]
mov ebx, 7
call fcn.00437f40
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00437d40
lea rax, [0x004f8e13]
mov ebx, 0x13
call fcn.00437f40
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00437640
lea rax, [0x004f835c]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x28]
call fcn.00437ec0
lea rax, [0x004f5bc5]
mov ebx, 7
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x18]
call fcn.00437d40
lea rax, [0x004f8e00]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00437f40
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004f6fa2]
mov ebx, 0xc
call fcn.00435d80
nop
mov qword [rsp + 8], rax
call fcn.00463d60
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0043f2e0
Function at 0x43f9e0
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x43fa29
nop word [rax + rax]
cmp qword [rcx + 0x50], rdx
je 0x43fa29
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
movups xmmword [rdx + 0x58], xmm15
cmp qword [rdx + 0x50], 0
je 0x43fa1f
call fcn.00439180
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x004fc89e]
mov ebx, 0x1c
call fcn.00435d80
nop
int3
Function at 0x442a40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x442d30
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x0061becd], 0
nop
jne 0x442c0e
cmp byte [0x0061becb], 0
jne 0x442c0e
cmp dword [0x0061bf2c], 0
nop word [rax + rax]
ja 0x442c04
cmp byte [0x0061becc], 0
jne 0x442a98
cmp byte [0x0061bec4], 0
jne 0x442a9c
xor ecx, ecx
jmp 0x442abe
mov eax, 1
call fcn.0043bea0
nop
cmp dword [0x0061bef0], 0
lea rcx, [0x0061bfc8]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x005c8a48]
mov rbx, qword [0x005c8a50]
sub rbx, qword [0x005c8a60]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x005c8a4c]
sub ebx, edi
mov r8d, dword [0x005c8a5c]
sub ebx, r8d
cmp ecx, ebx
jl 0x442bfa
test ebx, ebx
jl 0x442c88
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00442d40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.00439320
cmp qword [rsp + 0x20], 0
jne 0x442b4f
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
lea rax, [0x00500f0c]
mov ebx, 0x36
call fcn.00435e80
cmp qword [0x0061bfd0], 0
je 0x442b6d
call fcn.00453620
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jl 0x442b85
mov rcx, qword [0x005c7ea0]
mov rdx, qword [0x005c7ea8]
xor eax, eax
nop dword [rax]
jmp 0x442c40
mov qword [0x0061bfd0], rax
call fcn.00444540
test rax, rax
je 0x442c29
nop
mov rcx, qword [0x005c8a40]
test rcx, rcx
je 0x442bc3
mov rdx, qword [rcx + 0x128]
mov qword [0x005c8a40], rdx
dec dword [0x005c8a48]
nop dword [rax + rax]
test rcx, rcx
je 0x442c18
mov edx, 1
lea rbx, [0x005c8a7c]
lock xadd dword [rbx], edx
mov byte [rcx + 0xe4], 1
nop
mov qword [rcx + 0xa8], rax
lea rax, [rcx + 0x118]
call fcn.0040b100
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x004fb745]
mov ebx, 0x19
call fcn.00435d80
lea rax, [0x004fb75e]
mov ebx, 0x19
call fcn.00435d80
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x442c5f
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x2290], 0
je 0x442c3a
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
lea rax, [0x004fe857]
mov ebx, 0x25
call fcn.00435e80
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.00437640
lea rax, [0x004fc2c3]
mov ebx, 0x1b
call fcn.00437f40
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00437d40
lea rax, [0x004f75ad]
mov ebx, 0xe
call fcn.00437f40
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.00437d40
lea rax, [0x004f5e0e]
mov ebx, 8
call fcn.00437f40
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.00437d40
lea rax, [0x004f5b94]
mov ebx, 7
call fcn.00437f40
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.00437d40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fd00d]
mov ebx, 0x1e
call fcn.00435d80
nop
call fcn.0045f600
jmp fcn.00442a40
Function at 0x4443a0
Capabilities:
Encode data using base64
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44450f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4443b8
cmp edx, ecx
jne 0x4444fd
nop dword [rax]
test rsi, rsi
jne 0x4444fd
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444416
nop
call fcn.00463620
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004442a0
mov rcx, qword [0x005c7f28]
mov rdx, qword [0x005c7f20]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x4444f8
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4444ed
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x005c8a70]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x005c8a70], rbx
mov edx, 1
lea rsi, [0x005c8a78]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x4444dc
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004ff388]
mov ebx, 0x28
call fcn.00435d80
mov rcx, rax
mov rax, rsi
call fcn.00461ce0
call fcn.004341a0
lea rax, [0x004fe3b6]
mov ebx, 0x23
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004443a0
Function at 0x4447e0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x3b0]
cmp r12, qword [r14 + 0x10]
jbe 0x44498c
sub rsp, 0x430
mov qword [rsp + 0x428], rbp
lea rbp, [rsp + 0x428]
movups xmmword [rsp + 0x20], xmm15
mov edx, edi
lea rdi, [rsp + 0x28]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00461e60
mov rbp, qword [rbp]
sub edx, ecx
shr edx, 1
nop word [rax + rax]
cmp edx, 0x80
jne 0x44497a
xor edx, edx
jmp 0x444868
test byte [rax], al
lea esi, [rdx + rcx]
movzx esi, sil
mov rsi, qword [rax + rsi*8 + 0x198]
mov qword [rsp + rdx*8 + 0x20], rsi
inc edx
cmp edx, 0x80
jb 0x444850
lea edx, [rcx + 0x80]
mov rsi, rax
mov eax, ecx
lock cmpxchg dword [rsi + 0x190], edx
sete dl
test dl, dl
je 0x444896
mov qword [rsp + 0x420], rbx
xor eax, eax
jmp 0x4448b4
xor eax, eax
mov rbp, qword [rsp + 0x428]
add rsp, 0x430
ret
mov rbx, qword [rsp + rax*8 + 0x20]
mov qword [rdx + 0xa0], rbx
cmp eax, 0x80
jae 0x4448d1
mov rdx, qword [rsp + rax*8 + 0x20]
test byte [rdx], al
inc eax
cmp rax, 0x81
jb 0x4448a8
jmp 0x444970
movups xmmword [rsp + 0x10], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x420]
mov qword [rsp + 0x18], rcx
nop
nop
lea rax, [0x005c8a38]
call fcn.0040ae00
nop
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
test rcx, rcx
je 0x44493d
mov rbx, rcx
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x005c8a88]
test rcx, rcx
je 0x44492f
mov qword [rcx + 0xa0], rdx
jmp 0x444936
mov qword [0x005c8a80], rdx
mov qword [0x005c8a88], rbx
add dword [0x005c8a90], 0x81
movups xmmword [rsp + 0x10], xmm15
nop
nop
lea rax, [0x005c8a38]
call fcn.0040b020
mov eax, 1
mov rbp, qword [rsp + 0x428]
add rsp, 0x430
ret
mov ecx, 0x81
call fcn.00461ce0
lea rax, [0x004fd175]
mov ebx, 0x1e
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
nop
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.004447e0
Function at 0x448f00
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x0061bf2c], 0
je 0x448f3f
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.004318c0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov dword [0x0061bf2c], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.00437640
lea rax, [0x004f65a8]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x38]
call fcn.00437da0
call fcn.00437860
mov rax, qword [rsp + 0x30]
call fcn.00437da0
nop
call fcn.00437860
mov rax, qword [rsp + 0x28]
call fcn.00437da0
call fcn.00437860
mov rax, qword [rsp + 0x20]
call fcn.00437da0
nop
call fcn.004378a0
call fcn.004376c0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.00437640
lea rax, [0x004f552f]
mov ebx, 3
call fcn.00437f40
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437da0
call fcn.004378a0
call fcn.004376c0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x44908d
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x449092
cmp qword [rcx + 0x90], 0
je 0x449092
cmp byte [0x0061becc], 0
je 0x449080
nop
call fcn.00437640
lea rax, [0x00500283]
mov ebx, 0x2e
call fcn.00437f40
call fcn.004376c0
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x449095
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
call fcn.00437640
nop
call fcn.004378a0
call fcn.004376c0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 2
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x005aa3cc]
mov rdx, qword [r14 + 0x30]
movzx ebx, byte [rdx + 0xf9]
mov edx, dword [rdx + 0xc4]
test bl, bl
jne 0x4490fb
shr eax, 2
cmp edx, 2
mov edx, 2
cmovae eax, edx
mov ebx, eax
test ebx, ebx
jle 0x449130
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
call fcn.004580c0
mov rax, qword [rsp + 0x40]
call fcn.00459060
mov rax, qword [rsp + 0x68]
call fcn.004075a0
mov eax, 2
call fcn.004318c0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44a080
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44a1f3
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x44a1e5
lea rdi, [0x005ee330]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and esi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and eax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x20000]
test byte [rdx], al
test byte [rsi], al
mov dl, byte [r8 + 0x63]
cmp dl, 2
jne 0x44a1cf
mov qword [rsp + 0x18], r8
mov rdx, qword [r8 + 0x28]
nop
test rdx, rdx
jne 0x44a145
movzx eax, bl
cmp rax, 2
jae 0x44a1c5
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdi
shl rax, 6
lea rcx, [0x0061c560]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.004279a0
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x18]
mov rdx, rdi
mov rsi, qword [r8 + 0x28]
mov qword [rdi], rsi
mov qword [r8 + 0x28], rdx
movzx edx, word [r8 + 0x60]
lea esi, [rdx - 1]
mov word [r8 + 0x60], si
cmp dword [0x0061bf0c], 0
jne 0x44a1b1
cmp dx, 1
jne 0x44a1b1
movzx eax, bl
cmp rax, 2
jae 0x44a1bb
shl rax, 6
lea rcx, [0x0061c560]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00427820
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 0x28], 0
lea rax, [0x005de1a0]
mov ecx, 1
call fcn.00427420
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov ecx, 2
call fcn.00461ce0
mov ecx, 2
call fcn.00461ce0
lea rax, [0x004fdc4f]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435d80
mov rax, rdx
mov ecx, 0x40
call fcn.00461d00
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.0045f600
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0044a080
Function at 0x44c400
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44c589
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax], 0
nop dword [rax]
je 0x44c577
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x44c45e
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop dword [rax]
cmp rax, rdx
jne 0x44c566
mov rsi, r14
cmp rsi, rdx
je 0x44c566
cmp ecx, 2
jne 0x44c566
cmp qword [rax + 0x70], 0
jne 0x44c47f
cmp byte [rax + 0xb4], 0
je 0x44c472
xor ecx, ecx
jmp 0x44c481
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x44c481
xor ecx, ecx
test cl, cl
je 0x44c555
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x44c4a8
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x2b0], 0
jne 0x44c544
cmp dword [0x0061c3b4], 0
jg 0x44c53a
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x138]
mov rax, rcx
call fcn.0044fea0
test rax, rax
je 0x44c4de
cmp byte [rax + 0x24], 6
jne 0x44c4de
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rbx, rcx
mov rcx, rbx
shr rbx, 1
cmp rbx, 0x2000
jb 0x44c530
mov rsi, qword [rax + 0x38]
sub rdx, rsi
add rdx, 0x320
shr rcx, 2
cmp rcx, rdx
ja 0x44c521
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
call fcn.0044b360
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x004fbf31]
mov ebx, 0x1a
call fcn.00435d80
lea rax, [0x004fadad]
mov ebx, 0x17
call fcn.00435d80
lea rax, [0x004fb6fa]
mov ebx, 0x19
call fcn.00435d80
lea rax, [0x004fc76a]
mov ebx, 0x1c
call fcn.00435d80
nop
mov qword [rsp + 8], rax
call fcn.0045f600
mov rax, qword [rsp + 8]
jmp fcn.0044c400
Function at 0x44ce80
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44cfa6
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00461f6b
mov rbp, qword [rbp]
lea rcx, [0x004ea5e0]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44cf90
lea rdx, [0x0061c140]
lea rax, [0x005b09e0]
jmp 0x44cf12
mov rax, qword [rax + 0x220]
test rax, rax
je 0x44cf34
nop word [rax + rax]
cmp qword [rax + 0x130], rdx
ja 0x44cf0b
cmp qword [rax + 0x100], rdx
jbe 0x44cf0b
jmp 0x44cf36
xor eax, eax
test rax, rax
je 0x44cf7f
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x128]
mov dword [0x0061c140], ebx
mov dword [0x0061c144], edx
mov dword [0x0061c148], esi
mov dword [0x0061c14c], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x004ff9d3]
mov ebx, 0x2b
call fcn.00435d80
lea rax, [0x00501499]
mov ebx, 0x3d
nop dword [rax]
call fcn.00435d80
nop
call fcn.0045f600
jmp fcn.0044ce80
Function at 0x44d080
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d2d7
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
test rcx, rcx
je 0x44d0b7
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x44d288
xor edx, edx
xor esi, esi
xor edi, edi
nop dword [rax]
test rdx, rdx
je 0x44d185
cmp rdx, 1
jne 0x44d122
test rax, rax
je 0x44d0e0
mov rdx, rsi
mov esi, 1
jmp 0x44d127
cmp rcx, rsi
jbe 0x44d270
mov rdx, rsi
shl rsi, 4
mov r8, qword [rbx + rsi]
mov rsi, qword [rbx + rsi + 8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x58]
mov r8, qword [r14 + 8]
cmp qword [r14], rsi
ja 0x44d11a
cmp rsi, r8
setb sil
jmp 0x44d11c
xor esi, esi
xor esi, 1
nop
jmp 0x44d127
mov rdx, rsi
xor esi, esi
test sil, sil
jne 0x44d169
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov rbx, rdi
nop
call fcn.0044d7c0
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x44d19b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov r8, qword [rsp + 0x80]
xor r9d, r9d
jmp 0x44d1b5
cmp rcx, rdx
jbe 0x44d193
shl rdx, 4
mov rax, qword [rbx + rdx]
mov rbx, qword [rbx + rdx + 8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
call fcn.00461ce0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
add r8, 0x10
mov rcx, rsi
mov rsi, r9
mov r9, rdi
mov rdi, r11
mov r10, qword [r8 + 8]
cmp rdi, r10
mov r11, rdi
cmovg rdi, r10
mov r12, qword [r8]
cmp rcx, r12
jne 0x44d1d0
cmp r11, r10
jmp 0x44d235
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x18], r10
mov rax, rcx
mov rbx, r12
mov rcx, rdi
call fcn.00462680
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jb 0x44d265
lea rdi, [r9 + 1]
sub rsi, r10
sub r11, r10
mov r9, rsi
neg rsi
sar rsi, 0x3f
and r10, rsi
lea rsi, [rcx + r10]
cmp rdx, rdi
jg 0x44d1a5
nop dword [rax + rax]
jmp 0x44d19b
mov rax, r10
mov rcx, r11
call fcn.00461da0
mov rax, rsi
call fcn.00461ce0
add rbx, 0x10
mov r10, rsi
mov rsi, r9
mov r9, r8
mov r8, r10
mov r10, qword [rbx + 8]
test r10, r10
jne 0x44d29f
mov r10, r9
mov r9, rsi
mov rsi, r8
mov r8, r10
jmp 0x44d2ae
lea r8, [r9 + r10]
cmp r9, r8
jg 0x44d2c5
inc rdi
mov r9, rsi
inc r9
cmp rcx, r9
jg 0x44d278
mov rbx, rdx
mov rdx, rdi
mov rdi, r8
nop
jmp 0x44d0c0
lea rax, [0x004fcd5f]
mov ebx, 0x1d
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044d080
Function at 0x44fc80
Capabilities:
Run powershell expression

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov ecx, ebx
mov rdx, qword [rax + 0xb0]
lea rbx, [rdx + rcx]
mov rsi, qword [rax + 0x140]
mov rdi, qword [rax + 0x138]
cmp rsi, 1
jle 0x44fcb4
xor r8d, r8d
jmp 0x44fcc5
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
add rdi, 0x18
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi]
cmp r11, rcx
ja 0x44fcda
cmp r9, rcx
ja 0x44fcf4
lea r12, [rsi - 1]
nop
cmp r8, r12
jne 0x44fcea
cmp r9, rcx
je 0x44fcf4
inc r8
cmp rsi, r8
jg 0x44fcc1
jmp 0x44fcfb
lea rbx, [r10 + rcx]
sub rbx, r11
mov rcx, qword [rax + 0xb8]
cmp rbx, rcx
jbe 0x44fcb4
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rbx
call fcn.00437640
lea rax, [0x004f8d4a]
mov ebx, 0x12
call fcn.00437f40
mov rax, qword [rsp + 0x10]
call fcn.00437da0
lea rax, [0x004f75c9]
mov ebx, 0xe
call fcn.00437f40
mov rax, qword [rsp + 0x20]
call fcn.00437da0
lea rax, [0x004f5460]
mov ebx, 3
nop dword [rax]
call fcn.00437f40
mov rax, qword [rsp + 0x18]
call fcn.00437da0
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fde1d]
mov ebx, 0x21
call fcn.00435d80
nop
int3
Function at 0x450e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450fb8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x450e7c
test r8b, r8b
jne 0x450e7c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x450e8f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x450f78
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x450f66
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x450f5c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x450ee3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x450f26
mov eax, 1
cmp rax, rbx
ja 0x450f15
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00461da0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x450f54
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x450f1d
mov r8d, eax
mov eax, r10d
jmp 0x450ee8
mov rcx, rbx
call fcn.00461ce0
xor eax, eax
mov rcx, rax
call fcn.00461ce0
mov eax, r8d
mov rcx, rbx
call fcn.00461da0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x450fae
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x450f71
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x450e95
mov eax, edx
mov rcx, rbx
call fcn.00461ce0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00461ce0
nop
int3