joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1d20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d1f52
push rbp
mov rbp, rsp
sub rsp, 0x60
cmp word [rax + 0x48], 0x304
jne 0x5d1f47
mov qword [rsp + 0x70], rax
xor ebx, ebx
xor ecx, ecx
call fcn.005d0760
test rcx, rcx
jne 0x5d1f3b
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x350]
inc rdx
mov qword [rcx + 0x350], rdx
cmp rdx, 0x10
jg 0x5d1e18
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rbx
nop
test rax, rax
je 0x5d1dcd
mov edx, dword [rax + 0x10]
cmp edx, 0x657fdec6
jne 0x5d1dab
lea rdx, [0x006bbb80]
cmp rax, rdx
jne 0x5d1dcd
mov rax, rcx
nop
call fcn.005d1f80
add rsp, 0x60
pop rbp
ret
cmp edx, 0x82cd91e9
jne 0x5d1dcd
lea rdx, [0x006bbc00]
cmp rax, rdx
jne 0x5d1dcd
mov rax, rcx
call fcn.005de5e0
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov ebx, 0xa
call fcn.005cf280
movups xmmword [rsp + 0x50], xmm15
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rax, [0x0071bf27]
mov ebx, 0x35
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov ebx, 0xa
call fcn.005cf280
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rsp + 0x40], rax
mov qword [rax + 8], 0x23
lea rcx, [0x00715aed]
mov qword [rax], rcx
lea rbx, [0x00789ac0]
mov rcx, rax
lea rax, [0x006c2fe0]
call fcn.0040b1e0
nop
test rax, rax
jne 0x5d1eaa
lea rcx, [0x00789ac0]
mov rdx, qword [rsp + 0x70]
mov qword [rdx + 0x180], rcx
cmp dword [0x009d9570], 0
nop
jne 0x5d1e89
mov rcx, qword [rsp + 0x40]
jmp 0x5d1ea1
call fcn.004673c0
mov rcx, qword [rsp + 0x40]
mov qword [r11], rcx
mov rsi, qword [rdx + 0x188]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x188], rcx
jmp 0x5d1f27
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rax
lea rax, [0x006c2660]
nop dword [rax + rax]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
cmp dword [0x009d9570], 0
jne 0x5d1ee0
mov rcx, qword [rsp + 0x38]
jmp 0x5d1eed
call fcn.004673a0
mov rcx, qword [rsp + 0x38]
mov qword [r11], rcx
mov qword [rax + 8], rcx
lea rcx, [0x0078a640]
mov rdx, qword [rsp + 0x70]
mov qword [rdx + 0x180], rcx
cmp dword [0x009d9570], 0
je 0x5d1f20
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [rdx + 0x188]
mov qword [r11 + 8], rcx
mov qword [rdx + 0x188], rax
mov rax, qword [rdx + 0x180]
mov rbx, qword [rdx + 0x188]
add rsp, 0x60
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x60
pop rbp
ret
call fcn.005d1940
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.005d1d20
Function at 0x5d6380
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d645d
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
movzx edx, word [rbx + 0xa0]
movzx r8d, word [rbx + 0x18]
mov word [rsp + 0x2e], 0
test dx, dx
cmovne r8w, dx
mov word [rsp + 0x2c], r8w
mov word [rsp + 0x2e], r8w
mov rdx, qword [rax + 0x50]
mov ebx, 1
lea rcx, [rsp + 0x2e]
mov edi, 1
mov rsi, rdi
mov rax, rdx
call fcn.005c9a60
nop dword [rax]
test bl, bl
je 0x5d6409
mov rcx, qword [rsp + 0x50]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 1
mov word [rcx + 0x190], ax
mov word [rcx + 0x228], ax
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, qword [rsp + 0x50]
mov ebx, 0x46
call fcn.005cf280
movups xmmword [rsp + 0x30], xmm15
movzx eax, word [rsp + 0x2c]
call fcn.0040ae20
lea rcx, [0x006a5fe0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x0071bc47]
mov ebx, 0x34
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005d6380

Function at 0x5d70c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d719e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x50]
mov rcx, qword [rcx + 0x58]
movzx edx, word [rdx + 0x50]
xor ebx, ebx
jmp 0x5d70ed
inc rbx
cmp rbx, rcx
jge 0x5d710e
movzx edi, word [rsi + rbx*2]
cmp di, dx
jne 0x5d70ea
nop
mov rcx, qword [0x0096d560]
mov rdx, qword [0x0096d568]
xor ebx, ebx
jmp 0x5d7184
xor ecx, ecx
cmp dword [0x009d9570], 0
je 0x5d7129
call fcn.004673c0
mov qword [r11], rcx
mov rdx, qword [rax + 0x28]
mov qword [r11 + 8], rdx
mov qword [rax + 0x28], rcx
test rcx, rcx
je 0x5d7146
mov rdx, qword [rax]
movzx ecx, word [rcx]
mov word [rdx + 0x62], cx
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
mov rax, qword [rax]
mov ebx, 0x28
call fcn.005cf280
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x2e
lea rcx, [0x0071a205]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x10
pop rbp
ret
inc rbx
cmp rbx, rdx
jge 0x5d7194
mov rsi, qword [rcx + rbx*8]
cmp word [rsi], di
jne 0x5d7181
jmp 0x5d7196
xor esi, esi
mov rcx, rsi
jmp 0x5d7110
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.005d70c0
Function at 0x5e48e0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5e4b06
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rax + 0x1e8]
cmp rcx, rdx
jne 0x5e491a
mov rsi, qword [rax + 0x1e0]
xor r8d, r8d
jmp 0x5e494e
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x2f
lea rcx, [0x0071a837]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x88
pop rbp
ret
inc r8
cmp r8, rdx
jge 0x5e4997
lea r9, [r8 + r8*2]
mov r10, qword [rbx + r9*8 + 8]
mov r9, qword [rsi + r9*8 + 8]
cmp r9, r10
je 0x5e494b
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x2f
lea rcx, [0x0071a837]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x88
pop rbp
ret
mov qword [rax + 0x1e8], rcx
mov qword [rax + 0x1f0], rdi
cmp dword [0x009d9570], 0
je 0x5e49c1
call fcn.004673c0
mov qword [r11], rbx
mov rcx, qword [rax + 0x1e0]
mov qword [r11 + 8], rcx
mov qword [rax + 0x1e0], rbx
cmp qword [rax], 0
je 0x5e4ada
mov qword [rsp + 0x98], rax
call fcn.005e4840
nop
test rdi, rdi
jne 0x5e4ae7
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsi + 0x10]
cmp rbx, rdx
ja 0x5e4afb
mov r8, qword [rsi]
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a90
mov rbp, qword [rbp]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x58], 1
movups xmmword [rsp + 0x20], xmm15
lea rdx, [0x005e4b40]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov ebx, 2
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.0058c3e0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x5e4a82
xor ecx, ecx
jmp 0x5e4a96
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
ja 0x5e4af6
sub rcx, rax
xor edx, edx
test rdx, rdx
jne 0x5e4aa9
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], rcx
je 0x5e4ada
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x2d
lea rcx, [0x00719c1f]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x88
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x88
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x88
pop rbp
ret
call fcn.00467820
mov rcx, rbx
nop
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005e48e0
Function at 0x5ec600
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5ec81e
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov rdx, qword [rax]
nop dword [rax]
test rdx, rdx
jne 0x5ec7ed
movups xmmword [rsp + 0x48], xmm15
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a90
mov rbp, qword [rbp]
nop
cmp qword [rsp + 0x78], 0
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x18
jne 0x5ec80a
mov qword [rsp + 0xb0], rax
cmp byte [rsp + 0x70], 0
je 0x5ec6c2
mov rdx, qword [rsp + 0x60]
inc rdx
cmp qword [rsp + 0x68], rdx
jge 0x5ec6c2
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c2b7]
mov qword [rax], rcx
lea rcx, [0x00789ac0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
nop
jmp 0x5ec721
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
lea rdx, [rbx + 1]
mov r8, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x5ec709
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 1
lea rsi, [0x006a5ea0]
call fcn.0044bd00
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x2f]
mov byte [r8 + rbx], sil
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], r8
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x005ec840]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x38]
lea rax, [rsp + 0x48]
call fcn.0058c3e0
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x5ec767
mov r8, qword [rsp + 0x50]
xor r11d, r11d
xor ecx, ecx
xor r9d, r9d
jmp 0x5ec7a2
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x80]
cmp rax, rcx
ja 0x5ec805
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
sub r10, rax
mov r11, r10
neg r10
sar r10, 0x3f
and r10, rax
sub rcx, rax
add r9, r10
xor edx, edx
xor r8d, r8d
mov r10, qword [rsp + 0xb0]
mov qword [r10 + 8], rcx
mov qword [r10 + 0x10], r11
cmp dword [0x009d9570], 0
je 0x5ec7d2
mov rax, r11
nop
call fcn.004673c0
mov qword [r11], r9
mov r12, qword [r10]
mov qword [r11 + 8], r12
mov r11, rax
mov qword [r10], r9
mov rax, r9
mov rbx, rcx
mov rcx, r11
mov rdi, rdx
mov rsi, r8
add rsp, 0xa0
pop rbp
ret
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
call fcn.00467820
lea rax, [0x006a5b60]
lea rbx, [0x00789210]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.005ec600
Function at 0x606460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6065fb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x606481
inc rcx
cmp rbx, rcx
jle 0x6065f1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x60647e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0051d040
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x0096b8c0]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.006027a0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x6065e5
test rdx, rdx
je 0x6065da
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6065a9
xor eax, eax
lea rbx, [0x00786740]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x007043d3]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044fc00
jmp 0x6065d0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007865f0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044fb40
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00606460
Function at 0x6123a0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x612614
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xd8], rbx
xor edx, edx
jmp 0x612416
mov rdx, qword [rsp + 0x50]
inc rdx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xe8]
cmp rsi, rdx
jle 0x612549
mov qword [rsp + 0x50], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
test al, al
jne 0x6123e6
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xe8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x006a5ea0]
mov qword [rsp + 0x70], rsi
lea rdi, [0x0092f8a0]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
call fcn.0040af80
lea rcx, [0x006a5b60]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movups xmmword [rsp + 0xb0], xmm15
lea rcx, [0x00612660]
mov qword [rsp + 0x90], rcx
lea rcx, [0x0071c3fc]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], 0x37
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], 2
mov qword [rsp + 0xb8], 2
mov rax, qword [0x00983a10]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x90]
nop dword [rax]
call fcn.004fb6e0
lea rax, [0x006a5ea0]
xor ebx, ebx
mov rcx, qword [rsp + 0xf0]
call fcn.0044bc20
xor ecx, ecx
mov rdx, qword [rsp + 0xf0]
xor ebx, ebx
jmp 0x612566
mov rax, rdi
mov rbx, rsi
add rsp, 0xc0
pop rbp
ret
mov rsi, qword [rsp + 0x48]
inc rsi
mov rdx, rcx
mov rcx, rsi
mov rsi, qword [rsp + 0xf0]
cmp rsi, rcx
jle 0x6125fe
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rcx
mov rbx, qword [rsp + 0xe8]
movzx eax, byte [rbx + rcx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xe0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x6125ea
mov rbx, qword [rsp + 0x58]
inc rbx
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
jb 0x6125c5
mov rax, qword [rsp + 0x68]
jmp 0x6125db
mov rax, qword [rsp + 0x68]
mov edi, 1
lea rsi, [0x006a5ea0]
call fcn.0044bd00
movzx esi, byte [rsp + 0x47]
mov byte [rbx + rax - 1], sil
jmp 0x612558
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
jmp 0x612558
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044fe20
add rsp, 0xc0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.006123a0
Function at 0x6204c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x620754
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x38]
lea rbx, [0x007059d1]
mov ecx, 7
mov rax, rdx
call fcn.0052cbe0
test rbx, rbx
jne 0x6205fd
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006ef660]
lea rcx, [0x0070ad40]
mov edi, 0x11
call fcn.00412560
mov rbx, qword [rax + 8]
nop dword [rax]
test rbx, rbx
je 0x62059d
mov rdx, qword [rax]
cmp rbx, 1
jg 0x620556
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x62059d
cmp rsi, 7
jne 0x620556
mov rsi, qword [rdx]
cmp dword [rsi], 0x6e756863
jne 0x620556
cmp word [rsi + 4], 0x656b
jne 0x620556
cmp byte [rsi + 6], 0x64
je 0x62059d
mov rcx, qword [rax + 0x10]
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
call fcn.0040b020
lea rdx, [0x006a3e60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x0071b7a9]
mov ebx, 0x33
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x38
pop rbp
ret
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006ef660]
lea rcx, [0x007072ae]
mov edi, 0xa
call fcn.00412560
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x62066d
mov rdx, qword [rax]
cmp rbx, 1
jg 0x620677
mov rsi, qword [rdx + 8]
nop dword [rax]
test rsi, rsi
je 0x62066d
mov rdi, qword [rdx]
cmp rsi, 5
jne 0x6206f9
xor ecx, ecx
jmp 0x6206c1
movups xmmword [rsp + 0x28], xmm15
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x006ef660]
lea rcx, [0x007059d1]
mov edi, 7
nop
call fcn.00412560
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.0040b020
lea rdx, [0x006a3e60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x007184ae]
mov ebx, 0x29
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rax + 0x10]
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
call fcn.0040b020
lea rdx, [0x006a3e60]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x007193f9]
mov ebx, 0x2c
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x38
pop rbp
ret
inc rcx
cmp rcx, 5
jge 0x62066d
movzx r8d, byte [rcx + rdi]
lea r9d, [r8 - 0x41]
cmp r9b, 0x19
ja 0x6206da
add r8d, 0x20
lea r9, [0x00704bfb]
movzx r9d, byte [r9 + rcx]
lea r10d, [r9 - 0x41]
cmp r10b, 0x19
ja 0x6206f4
add r9d, 0x20
cmp r8b, r9b
je 0x6206be
nop dword [rax]
cmp rsi, 0xa
jne 0x620677
xor ecx, ecx
jmp 0x620711
inc rcx
cmp rcx, 0xa
jge 0x62066d
movzx esi, byte [rcx + rdi]
lea r8d, [rsi - 0x41]
cmp r8b, 0x19
ja 0x62072c
add esi, 0x20
lea r8, [0x007072e0]
movzx r8d, byte [r8 + rcx]
lea r9d, [r8 - 0x41]
nop dword [rax]
cmp r9b, 0x19
ja 0x62074a
add r8d, 0x20
cmp sil, r8b
je 0x62070e
jmp 0x620677
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.006204c0
Function at 0x6286e0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x62895f
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rsp + 0x78], rax
mov rcx, qword [0x0096bf80]
mov rdi, qword [0x0096bf88]
lea rdx, [rax + 0x30]
mov qword [rsp + 0x50], rdx
lea rbx, [rax + 0x98]
mov r8, qword [rax]
mov qword [rsp + 0x68], r8
xor esi, esi
mov rax, rdx
call fcn.0061b9e0
mov rbx, qword [0x0096bf80]
mov rcx, qword [0x0096bf88]
mov rax, qword [rsp + 0x78]
call fcn.0061c9a0
mov rax, qword [rsp + 0x50]
call fcn.0061b260
test rax, rax
jle 0x62888e
mov rdx, qword [rsp + 0x68]
lea rsi, [rdx + 0x58]
mov rcx, rax
xor eax, eax
mov edi, 1
lock cmpxchg dword [rdx + 0x58], edi
sete r8b
test r8b, r8b
jne 0x6287a1
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x60], rsi
mov rax, rsi
call fcn.00472260
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov edi, 1
movsxd r8, dword [rdx + 0x7c]
add r8, rcx
movsxd r9, dword [rdx + 0x78]
add r9, r8
cmp r9, 0x7fffffff
jg 0x62894b
mov dword [rdx + 0x7c], r8d
cmp r8d, 0x1000
jge 0x6287d4
cmp dword [rdx + 0x78], r8d
jle 0x6287d4
xor r8d, r8d
jmp 0x6287df
add dword [rdx + 0x78], r8d
mov dword [rdx + 0x7c], 0
mov dword [rsp + 0x34], r8d
nop
mov ebx, 0xffffffff
lock xadd dword [rdx + 0x58], ebx
dec ebx
test ebx, ebx
je 0x62880c
mov rax, rsi
call fcn.00472540
mov rdx, qword [rsp + 0x68]
mov edi, 1
mov r8d, dword [rsp + 0x34]
lea rsi, [rdx + 0x120]
mov qword [rsp + 0x58], rsi
xor eax, eax
lock cmpxchg dword [rdx + 0x120], edi
sete dil
test dil, dil
jne 0x628842
mov rax, rsi
call fcn.00472260
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x34]
test r8d, r8d
jle 0x62885d
mov rax, qword [rdx + 0x130]
xor ebx, ebx
mov ecx, r8d
call fcn.00617ba0
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0x128]
call fcn.004843a0
nop
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x68]
lock xadd dword [rcx + 0x120], ebx
dec ebx
nop
test ebx, ebx
je 0x62888e
mov rax, qword [rsp + 0x58]
call fcn.00472540
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 0xe8]
mov qword [rsp + 0x70], rdx
mov rax, qword [rcx + 0x10]
mov rbx, qword [rcx + 8]
mov rbx, qword [rbx + 0x20]
call rbx
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x18]
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x80], rcx
lea rax, [rsp + 0x80]
lea rbx, [rsp + 0x44]
xor ecx, ecx
xor edi, edi
mov esi, 3
mov r8d, 1
call fcn.004487a0
test rax, rax
je 0x628934
cmp rax, 1
jne 0x628927
xor eax, eax
xor ebx, ebx
add rsp, 0xb0
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0xb0
pop rbp
ret
mov rax, qword [0x0096bf40]
mov rbx, qword [0x0096bf48]
add rsp, 0xb0
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007888c0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.006286e0
Function at 0x638860
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x638a58
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov rsi, qword [rax + 0x40]
nop dword [rax + rax]
test rsi, rsi
je 0x6388b1
lea rdi, [0x0078aca0]
cmp rsi, rdi
je 0x638895
xor ecx, ecx
jmp 0x6388b6
mov rbx, qword [rax + 0x48]
lea rcx, [0x009d90e0]
mov rax, rsi
call fcn.00404a60
mov ecx, eax
mov rax, qword [rsp + 0x40]
jmp 0x6388b6
mov ecx, 1
test cl, cl
jne 0x638a37
mov rsi, qword [rax + 0x40]
lea rdi, [0x0078acc8]
cmp rsi, rdi
jne 0x638a41
mov r8, qword [rax + 0x48]
cmp byte [r8 + 0x10], 0
jne 0x6388e8
cmp byte [r8 + 0x11], 0
je 0x638a37
cmp byte [r8 + 0x11], 0
jne 0x63890a
nop
test rsi, rsi
je 0x63890a
mov rcx, qword [rsi + 0x18]
mov rax, r8
call rcx
mov rax, qword [rsp + 0x40]
lea rdi, [0x0078acc8]
mov rdx, qword [rax + 0x50]
test rdx, rdx
je 0x638a21
mov rax, qword [rdx]
call rax
nop dword [rax]
test rcx, rcx
jne 0x638a13
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rax
lea rax, [0x006fb3a0]
call fcn.0040d7c0
mov qword [rsp + 0x28], rax
cmp dword [0x009d9570], 0
je 0x63896a
mov rbx, rax
mov rcx, qword [rsp + 0x40]
lea rax, [0x006fb3a0]
nop dword [rax]
call fcn.004139c0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsi]
mov qword [rax], rcx
add rsi, 8
lea rdi, [rax + 8]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d6e
mov rbp, qword [rbp]
lea rax, [0x006d3ae0]
call fcn.0040d7c0
mov byte [rax + 0x10], 0
mov byte [rax + 0x11], 0
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
cmp dword [0x009d9570], 0
jne 0x6389c0
mov rdx, qword [rsp + 0x18]
jmp 0x6389d5
call fcn.004673c0
mov rdx, qword [rsp + 0x18]
mov qword [r11], rdx
mov rsi, qword [rax + 8]
mov qword [r11 + 8], rsi
mov qword [rax + 8], rdx
lea rdx, [0x0078acc8]
mov rsi, qword [rsp + 0x28]
mov qword [rsi + 0x40], rdx
cmp dword [0x009d9570], 0
je 0x638a02
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [rsi + 0x48]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x48], rax
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x30
pop rbp
ret
xor eax, eax
mov rbx, rcx
mov rcx, rdi
add rsp, 0x30
pop rbp
ret
mov rbx, qword [0x0096c000]
mov rcx, qword [0x0096c008]
xor eax, eax
add rsp, 0x30
pop rbp
ret
xor ebx, ebx
xor ecx, ecx
add rsp, 0x30
pop rbp
ret
mov rbx, qword [0x0078acd0]
mov rax, rsi
lea rcx, [0x006beb20]
call fcn.0040ac60
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00638860