joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ffa0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42022b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
cmp dword [0x0061bf04], 0
nop
je 0x420219
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rcx, rcx
jne 0x41fffd
nop
call fcn.00463620
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x10], rcx
mov rdx, qword [0x0061c440]
mov rsi, rcx
sub rcx, rdx
cmp rcx, 0x989680
jle 0x420036
lea rax, [0x0061c400]
mov rbx, rsi
call fcn.0041b360
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x10]
test rbx, rbx
je 0x420063
mov rdx, qword [rbx + 0x1240]
test rdx, rdx
je 0x420063
cmp qword [rdx + 0x10], 0
jne 0x42005c
mov rdx, qword [rbx + 0x1248]
cmp qword [rdx + 0x10], 0
je 0x420063
mov ecx, 1
jmp 0x42008d
mov rdx, qword [0x005c8480]
test rdx, rdx
jne 0x420088
mov edx, dword [0x005c8508]
cmp dword [0x005c850c], edx
jbe 0x420084
mov ecx, 1
jmp 0x42008d
xor ecx, ecx
jmp 0x42008d
mov ecx, 1
test cl, cl
je 0x420094
nop
jmp 0x4200a6
xor eax, eax
mov rbx, rsi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov rdx, qword [0x0061bff8]
test rdx, rdx
je 0x4200de
mov rdi, rdx
sar rdx, 0x13
shl rdx, 3
nop
mov r8, qword [rdx]
mov rcx, rax
mov rax, rdi
lea r9, [0x0061bff8]
lock cmpxchg qword [r9], r8
sete dil
test dil, dil
je 0x4200a3
jmp 0x4200ea
mov rcx, rax
lea r9, [0x0061bff8]
xor edx, edx
test rdx, rdx
je 0x4200f3
test byte [rcx], al
jmp 0x420102
xor eax, eax
mov rbx, rsi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rcx + 0x108]
test rax, rax
jle 0x420131
mov qword [rsp + 0x18], rax
lea rdi, [rax - 1]
lock cmpxchg qword [rcx + 0x108], rdi
sete dil
test dil, dil
je 0x420102
mov rdi, qword [rsp + 0x18]
test rdi, rdi
jg 0x4201c6
movsd xmm0, qword [rcx + 0x128]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x42014a
jnp 0x4201aa
mov rdi, qword [rcx + 0x100]
mov r8, rsi
sub rsi, rdi
test rsi, rsi
jle 0x42019b
test byte [rbx], al
mov rdi, qword [rbx + 0x1220]
xorps xmm1, xmm1
cvtsi2sd xmm1, rdi
xorps xmm2, xmm2
cvtsi2sd xmm2, rsi
divsd xmm1, xmm2
ucomisd xmm1, xmm0
jbe 0x42019b
mov rax, r9
mov rbx, rdx
call fcn.0040aba0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test byte [rbx], al
mov qword [rbx + 0x1230], 2
jmp 0x4201d3
mov rax, r9
mov rbx, rdx
call fcn.0040aba0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test byte [rbx], al
mov qword [rbx + 0x1230], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rax
mov ebx, 4
mov ecx, 1
call fcn.0043a220
cmp byte [0x005ce0b0], 0
je 0x420205
mov rax, qword [rsp + 0x20]
xor ebx, ebx
nop dword [rax + rax]
call fcn.004551e0
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00500e6a]
mov ebx, 0x36
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0041ffa0
Function at 0x4205a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420710
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
nop dword [rax]
call fcn.00420460
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0xb8]
cmp rax, rdx
jbe 0x420652
cmp rbx, rdx
cmovb rbx, rdx
mov rsi, rax
sub rax, rdx
shr rax, 6
lea rdi, [rax + rax*4]
lea rdi, [rdi + rdi*8]
add rdi, rdx
cmp rbx, rdi
cmovb rbx, rdi
imul rdi, rax, 0x3d
add rdx, rdi
cmp rsi, 0x400000
jbe 0x420618
lea rdi, [rsi - 0x400000]
cmp rdi, rdx
jbe 0x420618
mov rdx, rdi
nop
mov rcx, qword [rcx + 0x18]
mov rax, rsi
sub rax, rcx
cmp rsi, rcx
cmovb rax, rbx
cmp rdx, rbx
cmovb rdx, rbx
cmp rax, rbx
cmovb rax, rbx
cmp rdx, rax
cmovb rax, rdx
nop
cmp rsi, rax
jb 0x42065f
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbx, rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rbx
call fcn.00437640
lea rax, [0x004f60ee]
mov ebx, 8
call fcn.00437f40
mov rax, qword [rsp + 0x10]
call fcn.00437c40
lea rax, [0x004f6472]
mov ebx, 0xa
nop
call fcn.00437f40
mov rax, qword [rsp + 0x28]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
call fcn.00437640
lea rax, [0x004f6ba9]
mov ebx, 0xb
call fcn.00437f40
mov rax, qword [rsp + 0x18]
call fcn.00437c40
lea rax, [0x004f6cae]
mov ebx, 0xc
call fcn.00437f40
mov rax, qword [rsp + 0x20]
call fcn.00437c40
call fcn.004378a0
call fcn.004376c0
lea rax, [0x004fff20]
mov ebx, 0x2d
call fcn.00435d80
nop
mov qword [rsp + 8], rax
call fcn.0045f600
mov rax, qword [rsp + 8]
nop
jmp fcn.004205a0

Function at 0x4208c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420977
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x004f65da]
mov ebx, 0xa
call fcn.00407ae0
test rbx, rbx
je 0x420902
cmp rbx, 3
jne 0x420916
cmp word [rax], 0x666f
jne 0x420916
cmp byte [rax + 2], 0x66
nop
jne 0x420916
movabs rax, 0x7fffffffffffffff
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x10], rbx
call fcn.0044e2c0
test bl, bl
je 0x420933
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00437640
lea rax, [0x004f694c]
mov ebx, 0xb
call fcn.00437f40
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.00437f40
call fcn.004378a0
nop dword [rax]
call fcn.004376c0
lea rax, [0x005015ce]
mov ebx, 0x3f
call fcn.00435d80
nop
call fcn.0045f600
nop dword [rax]
jmp fcn.004208c0
Function at 0x421a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x421b21
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x421a60
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x421b11
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.00422580
nop dword [rax]
test rax, rax
je 0x421b11
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00421b60]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045f4c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x421aff
xor eax, eax
jmp 0x421b09
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x421a52
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00421a20
Function at 0x422b60
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422cba
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x422bc5
call fcn.004250e0
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x422c48
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
nop
cmp rdi, 0x3f
jae 0x422cac
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
nop dword [rax + rax]
cmp r9d, ebx
ja 0x422c9b
cmp rsi, 0x3f
jne 0x422c4b
mov qword [rsp + 0x10], rdx
call fcn.004250e0
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x422c4b
mov r8, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x422c8e
lea rsi, [rbx + 1]
mov qword [rdx + 0x10], rsi
shl rbx, 5
mov rsi, qword [rax + 0x100]
sub r8, rsi
mov dword [rdx + rbx + 0x20], r8d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00461ce0
lea rax, [0x004ff639]
mov ebx, 0x29
call fcn.00435d80
mov rax, rdi
mov ecx, 0x3f
call fcn.00461ce0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00422b60
Function at 0x422fe0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423166
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
cmp dword [0x005ee2d8], ebx
je 0x423010
jmp 0x42314f
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x42313e
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42300d
nop
cmp edx, 0x80000000
jne 0x423134
cmp dword [0x0061c3b0], 0
jle 0x42312a
mov rax, qword [0x005ee300]
mov qword [rsp + 0x10], rax
mov rcx, qword [0x0061c8c8]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x005ee310]
mov qword [rsp + 0x20], rdx
movsd xmm0, qword [0x005ee318]
movsd qword [rsp + 0x18], xmm0
call fcn.00437640
lea rax, [0x004fd50e]
mov ebx, 0x1f
nop dword [rax]
call fcn.00437f40
mov rax, qword [rsp + 0x28]
shr rax, 0x14
call fcn.00437c40
lea rax, [0x004f775f]
mov ebx, 0xe
nop
call fcn.00437f40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rax, rcx
shr rax, 0x14
call fcn.00437c40
lea rax, [0x004fa8d3]
mov ebx, 0x17
call fcn.00437f40
mov rax, qword [rsp + 0x10]
call fcn.00437c40
lea rax, [0x004f647c]
mov ebx, 0xa
call fcn.00437f40
movsd xmm0, qword [rsp + 0x18]
call fcn.00437940
lea rax, [0x004f6cd2]
mov ebx, 0xc
nop
call fcn.00437f40
call fcn.004376c0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x004fe32a]
mov ebx, 0x23
call fcn.00435d80
lea rax, [0x005009c8]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.0045f600
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.00422fe0
Function at 0x423520
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423777
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
nop
mov eax, dword [0x005c805c]
mov ecx, eax
and eax, 0x80000000
test eax, eax
jne 0x42357c
lea edx, [rcx + 1]
mov ebx, eax
mov eax, ecx
lea rsi, [0x005c805c]
lock cmpxchg dword [rsi], edx
sete cl
test cl, cl
je 0x423547
mov ecx, dword [0x005ee2d8]
test ebx, ebx
jmp 0x423589
mov ecx, dword [0x005ee2d8]
lea rsi, [0x005c805c]
mov dword [rsp + 0x20], ecx
sete byte [rsp + 0x24]
je 0x4235b4
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
dec dword [rcx + 0xd8]
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x005de1a0]
nop dword [rax + rax]
call fcn.00422e20
test rax, rax
je 0x423635
mov cl, byte [rax + 0x63]
cmp cl, 1
je 0x4235e9
mov edx, dword [rax + 0x58]
mov ebx, dword [rsp + 0x20]
cmp ebx, edx
je 0x4235b4
lea esi, [rbx + 3]
cmp edx, esi
je 0x4235b4
jmp 0x4236f4
mov rbx, rax
lea rax, [rsp + 0x20]
call fcn.00423420
mov qword [rsp + 0x28], rax
test bl, bl
je 0x4235b4
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x28]
xor ebx, ebx
call fcn.00423900
test al, al
je 0x42362f
nop
mov rcx, qword [rsp + 0x30]
lea rdx, [0x005ee328]
mov rsi, rcx
lock xadd qword [rdx], rcx
jmp 0x423631
xor esi, esi
xor edx, edx
jmp 0x423670
nop
mov eax, dword [0x005c805c]
mov edx, eax
and eax, 0x80000000
test eax, eax
jne 0x423666
mov esi, edx
bts edx, 0x1f
mov ecx, eax
mov eax, esi
lea rdi, [0x005c805c]
lock cmpxchg dword [rdi], edx
sete dl
nop
test dl, dl
je 0x423635
test ecx, ecx
sete dl
mov rsi, 0xffffffffffffffff
mov byte [rsp + 0x16], dl
mov qword [rsp + 0x30], rsi
mov ebx, dword [rsp + 0x20]
movzx ecx, byte [rsp + 0x24]
lea rax, [0x005c805c]
call fcn.00422fe0
movzx edx, byte [rsp + 0x16]
test dl, dl
je 0x4236d6
cmp dword [0x0061c3c8], 0
nop
jle 0x4236c6
lea rax, [0x00502210]
mov qword [rsp], rax
call fcn.0045f4c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
nop
nop
mov ecx, 1
lea rdx, [0x005c8260]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
dec dword [rcx + 0xd8]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov byte [rsp + 0x17], cl
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], ebx
call fcn.00437640
lea rax, [0x004fbee3]
mov ebx, 0x1a
call fcn.00437f40
movzx eax, byte [rsp + 0x17]
movzx eax, al
nop
call fcn.00437c40
lea rax, [0x004f6cf6]
mov ebx, 0xc
call fcn.00437f40
mov eax, dword [rsp + 0x1c]
call fcn.00437c40
lea rax, [0x004f64cc]
mov ebx, 0xa
call fcn.00437f40
mov eax, dword [rsp + 0x18]
call fcn.00437c40
call fcn.004378a0
nop
call fcn.004376c0
lea rax, [0x004fd4ef]
mov ebx, 0x1f
call fcn.00435d80
nop
call fcn.0045f600
nop dword [rax]
jmp fcn.00423520
Function at 0x4237a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4238e9
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x4237da
cmp dword [rcx + 0xc0], 0
jne 0x4237da
mov rdx, r14
cmp qword [rcx], rdx
jne 0x4238d7
jmp 0x4237df
mov rax, rbx
nop
mov ecx, dword [0x005c805c]
mov edx, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x423816
lea esi, [rdx + 1]
mov rbx, rax
mov eax, edx
lea rdi, [0x005c805c]
lock cmpxchg dword [rdi], esi
sete dl
test dl, dl
je 0x4237dc
mov edx, dword [0x005ee2d8]
test ecx, ecx
jmp 0x42381f
mov edx, dword [0x005ee2d8]
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
sete byte [rsp + 0x14]
jne 0x4238bb
lea rax, [rsp + 0x10]
call fcn.00423420
mov qword [rsp + 0x18], rax
test bl, bl
jne 0x423862
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x005c805c]
call fcn.00422fe0
mov rbx, qword [rsp + 0x20]
jmp 0x4238bb
lea rax, [rsp + 0x18]
xor ebx, ebx
call fcn.00423900
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x005c805c]
nop
call fcn.00422fe0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00502218]
mov qword [rsp], rax
call fcn.0045f4c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbx, rax
mov eax, dword [rbx + 0x58]
mov ecx, dword [rsp + 0x10]
cmp eax, ecx
je 0x4238cd
add ecx, 3
cmp eax, ecx
jne 0x42388f
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x004fe034]
mov ebx, 0x22
call fcn.00435d80
nop
mov qword [rsp + 8], rax
call fcn.0045f600
mov rax, qword [rsp + 8]
jmp fcn.004237a0
Function at 0x425580
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42566c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x005c84d0]
call fcn.0040ae00
cmp qword [0x005c8480], 0
jne 0x42565a
mov qword [0x005c8488], 0
mov rcx, qword [0x005c84e8]
test rcx, rcx
jne 0x4255f0
nop
nop
lea rax, [0x005c84d0]
call fcn.0040b020
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rdx, [0x005c84d8]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x4255e2
mov rcx, qword [0x005c84d8]
nop dword [rax]
test rcx, rcx
je 0x425631
mov rdx, qword [0x005c84f0]
mov qword [rdx], rcx
mov rcx, qword [0x005c84d8]
mov rdx, qword [0x005c84f0]
mov qword [rcx + 8], rdx
mov rcx, qword [0x005c84e8]
mov qword [0x005c84d8], rcx
jmp 0x42564d
mov rcx, qword [0x005c84f0]
mov rdx, qword [0x005c84e8]
mov qword [0x005c84d8], rdx
mov qword [0x005c84e0], rcx
movups xmmword [0x005c84e8], xmm15
jmp 0x4255ca
lea rax, [0x004ff2e8]
mov ebx, 0x28
call fcn.00435d80
nop
call fcn.0045f600
jmp fcn.00425580

Function at 0x426420
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42645b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x426449
xor edi, edi
call fcn.00426800
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x005013a9]
mov ebx, 0x3c
call fcn.00435d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00463d60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00426420

Function at 0x426580
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42669a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
xor edx, edx
jmp 0x4265b3
sub r12, rbx
lea rbx, [r12 + r9]
shr r12, 0xd
sub r11, r12
mov rax, rcx
mov rcx, r11
mov edx, r10d
test rcx, rcx
jbe 0x426639
test byte [rax], al
nop
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
cmp rdi, 0x40
jae 0x42668c
mov rdi, qword [rax + rdi*8 + 0x10190]
test byte [rdi], al
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x210c8]
mov r9, rbx
and ebx, 0x3fffff
cmp r8, rbx
seta r10b
mov r11, rcx
shl rcx, 0xd
lea r12, [rcx + rbx]
or r10d, edx
nop
cmp r12, 0x400000
jbe 0x42664b
mov r12d, 0x400000
jmp 0x42664b
mov rcx, rax
jmp 0x42659c
mov eax, edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rcx
mov r8, rdx
cmp r12, r8
jbe 0x426631
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x210c8], r12
sete dl
test dl, dl
jne 0x42659c
mov rdx, qword [rdi + 0x210c8]
cmp rdx, r12
ja 0x426645
cmp rdx, rbx
jbe 0x426645
lea rax, [0x00500b59]
mov ebx, 0x33
call fcn.00435d80
mov rax, rdi
mov ecx, 0x40
call fcn.00461d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00426580
Function at 0x427060
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4272fa
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
test byte [rax], al
add rbx, 0x1ff
and rbx, 0xfffffffffffffe00
shl rbx, 0xd
mov rdx, qword [rax + 0x10420]
lea rsi, [rbx + rdx]
mov rdi, qword [0x0061c058]
lea r8, [rdi + rsi]
lea r8, [r8 - 1]
neg rdi
and rdi, r8
cmp qword [rax + 0x10428], rdi
jb 0x4270c9
nop word [rax + rax]
cmp rdx, rsi
jbe 0x427263
mov qword [rsp + 0x50], rbx
call fcn.0040baa0
test rax, rax
je 0x4271cb
mov rdx, rax
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsi + 0x10428]
cmp rax, rdi
jne 0x427105
lea rdx, [rax + rbx]
mov qword [rsi + 0x10428], rdx
xor eax, eax
nop dword [rax]
jmp 0x4271a2
mov rax, qword [rsi + 0x10420]
sub rdi, rax
test rdi, rdi
jne 0x427118
xor eax, eax
jmp 0x42718d
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rdi
mov rbx, rdi
lea rcx, [0x0061c978]
call fcn.004166a0
lea rax, [0x0061dc40]
nop dword [rax]
call fcn.0042ed00
mov rdx, qword [rsp + 0x40]
lock xadd qword [rax + 8], rdx
lea rax, [0x0061dc40]
call fcn.0042ede0
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 0x10]
mov rbx, qword [rax + 0x10420]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
call fcn.00428a00
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov rdi, rdx
mov qword [rsi + 0x10420], rdx
lea rdx, [rdi + rbx]
mov qword [rsi + 0x10428], rdx
mov rdi, qword [0x0061c058]
mov rdx, qword [rsi + 0x10420]
mov r8, qword [rsp + 0x50]
add rdx, r8
lea rdx, [rdi + rdx]
lea rdx, [rdx - 1]
neg rdi
and rdi, rdx
jmp 0x427268
mov rax, qword [0x0061c980]
mov qword [rsp + 0x28], rax
mov rcx, qword [0x0061c978]
mov qword [rsp + 0x20], rcx
mov rdx, qword [0x0061c970]
mov qword [rsp + 0x18], rdx
call fcn.00437640
lea rax, [0x004ff450]
mov ebx, 0x28
call fcn.00437f40
mov rax, qword [rsp + 0x50]
call fcn.00437c40
lea rax, [0x004f7252]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00437f40
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
add rax, rcx
mov rcx, qword [rsp + 0x18]
add rax, rcx
call fcn.00437c40
lea rax, [0x004f6133]
mov ebx, 9
call fcn.00437f40
call fcn.004376c0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rdx, qword [rsi + 0x10420]
mov qword [rsp + 0x30], rdx
mov qword [rsi + 0x10420], rdi
mov r8, rdx
sub rdi, r8
mov qword [rsp + 0x50], rdi
mov rbx, rdi
lea rcx, [0x0061c978]
mov rax, rdx
call fcn.004166a0
lea rax, [0x0061dc40]
call fcn.0042ed00
mov rdx, qword [rsp + 0x50]
lock xadd qword [rax + 8], rdx
lea rax, [0x0061dc40]
nop dword [rax + rax]
call fcn.0042ede0
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.00428a00
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + rdx]
mov ebx, 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00427060