joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63b2a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63b3bf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], r8
mov rdx, qword [rax + 0x80]
test rdx, rdx
jne 0x63b35a
mov rdx, qword [rax + 0x88]
test rdx, rdx
je 0x63b348
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x63b342
nop
test rcx, rcx
jne 0x63b342
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x31
lea rcx, [0x0071adff]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x48]
lea rcx, [0x00789ac0]
mov rdi, rax
mov rax, qword [rsp + 0x38]
add rsp, 0x58
pop rbp
ret
lea rax, [0x00984f40]
call fcn.0050f4a0
add rsp, 0x58
pop rbp
ret
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
test rax, rax
jne 0x63b3b9
test rcx, rcx
jne 0x63b3b9
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rax
nop
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x38
lea rcx, [0x0071c7e0]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x50]
lea rcx, [0x00789ac0]
mov rdi, rax
mov rax, qword [rsp + 0x40]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0063b2a0
Function at 0x63b420
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63b5b0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
movq qword [rsp + 0x40], xmm15
mov byte [rsp + 0x17], 0
mov byte [rsp + 0x16], 0
lea rsi, [rax + 0x90]
mov rdx, rax
xor eax, eax
mov r8d, 1
lock cmpxchg dword [rdx + 0x90], r8d
sete r8b
test r8b, r8b
jne 0x63b4ab
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rcx
mov rax, rsi
call fcn.00472260
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x70]
movups xmmword [rsp + 0x30], xmm15
lea r8, [0x0063b600]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rsi
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x17], 1
cmp qword [rdx + 0x98], 0
jne 0x63b4e5
cmp qword [rdx + 0xa0], 0
je 0x63b504
mov byte [rsp + 0x16], 0
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx]
call rax
movzx eax, byte [rsp + 0x16]
add rsp, 0x48
pop rbp
ret
cmp dword [0x009d9570], 0
je 0x63b520
call fcn.004673c0
mov qword [r11], rbx
mov rsi, qword [rdx + 0x98]
mov qword [r11 + 8], rsi
mov qword [rdx + 0x98], rbx
mov qword [rdx + 0xa0], rcx
cmp dword [0x009d9570], 0
je 0x63b54a
call fcn.004673c0
mov qword [r11], rdi
mov rcx, qword [rdx + 0xa8]
mov qword [r11 + 8], rcx
mov qword [rdx + 0xa8], rdi
test rbx, rbx
jne 0x63b562
cmp qword [rdx + 0xa0], 0
nop
je 0x63b58a
mov rax, qword [rdx + 0x78]
call fcn.00406180
mov byte [rsp + 0x16], 1
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x16]
add rsp, 0x48
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788980]
call fcn.00436ea0
nop
nop
call fcn.00436380
movzx eax, byte [rsp + 0x16]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0063b420
Function at 0x640e40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6410ba
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rsi
test rdi, rdi
je 0x6410b0
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x88], rdi
mov rcx, qword [rax + 0xb0]
xor ebx, ebx
mov rax, rcx
call fcn.00406600
mov rax, qword [rsp + 0x70]
call fcn.006406a0
test rax, rax
jne 0x6410aa
mov rdx, qword [rsp + 0x78]
lea rsi, [rdx + 0x20]
xor eax, eax
mov edi, 1
lock cmpxchg dword [rdx + 0x20], edi
sete dil
test dil, dil
jne 0x640ee6
mov qword [rsp + 0x38], rsi
mov rax, rsi
call fcn.00472260
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x38]
mov rax, qword [rdx + 0x28]
mov rbx, qword [rdx + 0x30]
nop
mov edi, 0xffffffff
lock xadd dword [rdx + 0x20], edi
lea edx, [rdi - 1]
nop dword [rax]
test edx, edx
je 0x640f22
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov rax, rsi
mov ebx, edx
call fcn.00472540
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x6410a4
mov rax, qword [rsp + 0x88]
cmp qword [0x0096c090], rax
jne 0x640f60
mov rcx, qword [0x0096c098]
mov rbx, qword [rsp + 0x90]
call fcn.00404a60
test al, al
jne 0x64108e
mov rax, qword [rsp + 0x88]
lea rcx, [0x0078a140]
cmp rax, rcx
jne 0x640fc6
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx + 0x78], rcx
jne 0x640fb8
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rcx
lea rax, [0x006cfb00]
lea rbx, [rsp + 0x50]
call fcn.0040ad20
mov rbx, rax
lea rax, [0x0078a120]
add rsp, 0x60
pop rbp
ret
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x70]
call fcn.006405e0
test al, al
je 0x641078
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x70]
cmp qword [r8 + 0x78], rdx
je 0x64103d
movups xmmword [rsp + 0x40], xmm15
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x641004
mov rdi, qword [rdx + 8]
jmp 0x641007
mov rdi, rdx
mov qword [rsp + 0x40], rdi
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x48], rdx
lea rax, [0x0071b424]
mov ebx, 0x32
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rcx
lea rax, [0x006cfb00]
lea rbx, [rsp + 0x50]
call fcn.0040ad20
mov rbx, rax
lea rax, [0x0078a120]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rbp
ret
add rsp, 0x60
pop rbp
ret
add rsp, 0x60
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00640e40
Function at 0x644520
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6446b3
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
test rbx, rbx
je 0x64469f
mov byte [rax + 0x108], 1
cmp qword [rax + 0xe8], 0
je 0x644565
mov rdx, rax
nop
jmp 0x644676
mov qword [rsp + 0x90], rbx
mov qword [rax + 0xe8], rbx
cmp dword [0x009d9570], 0
je 0x644593
nop dword [rax]
call fcn.004673c0
mov qword [r11], rcx
mov rdx, qword [rax + 0xf0]
mov qword [r11 + 8], rdx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
mov qword [rax + 0xf0], rcx
mov rdx, qword [rax + 0x10]
mov r11, qword [rax + 0x18]
mov qword [rsp + 0x40], r11
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rsp + 0x68], xmm0
mov rbx, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
movzx r10d, byte [rsp + 0x70]
mov rax, rdx
mov rcx, r11
nop dword [rax]
call fcn.0063cd40
mov rdx, qword [rsp + 0x88]
cmp qword [rdx], 0
jne 0x644676
mov rax, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [0x0096c0a0], rax
jne 0x64464c
mov rcx, qword [0x0096c0a8]
mov rbx, qword [rsp + 0x98]
call fcn.00404a60
nop dword [rax]
test al, al
jne 0x64465a
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rdx + 0x50]
mov rax, qword [rdx + 0x58]
mov rcx, qword [rcx + 0x18]
call rcx
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx + 0x90]
call fcn.00406180
mov rdx, qword [rsp + 0x88]
cmp dword [0x009d9570], 0
je 0x64468e
mov rax, qword [rdx + 0x110]
call fcn.004673a0
mov qword [r11], rax
mov qword [rdx + 0x110], 0
add rsp, 0x78
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007889a0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00644520
Function at 0x644740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x644842
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.005a0e00
test rdi, rdi
jne 0x644793
mov rbx, qword [0x00983ae8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x006b5180]
call fcn.00412560
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x78]
call fcn.006446e0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x644815
xor eax, eax
lea rbx, [0x00786740]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x007043d3]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.0044fc00
jmp 0x64483c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007865f0]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.0044fb40
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00644740
Function at 0x66a7a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x66a7d8
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
nop
call fcn.004a6720
test rdi, rdi
jne 0x66a7c4
add rsp, 0x10
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007892c0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0066a7a0
Function at 0x673120
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x67336f
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rcx
test rax, rax
je 0x6731b0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x6731a7
movzx r9d, byte [rdx + 0x17]
mov r10d, r9d
and r9d, 0x1f
mov r11, r9
bts r9, 7
nop
test r10b, 0x20
cmove r11, r9
jmp 0x6731b7
xor r11d, r11d
xor edx, edx
xor ebx, ebx
jmp 0x6731b7
xor r11d, r11d
xor edx, edx
xor ebx, ebx
mov rax, rdx
mov rcx, r11
nop dword [rax]
call fcn.0049ab40
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x673222
mov qword [rsp + 0x68], rdx
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x70], rdx
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x673217
movzx edi, byte [rsi + 0x17]
mov r9d, edi
and edi, 0x1f
mov r10, rdi
bts rdi, 7
nop
test r9b, 0x20
cmove r10, rdi
jmp 0x673229
xor r10d, r10d
xor esi, esi
xor edx, edx
nop
jmp 0x673229
xor r10d, r10d
xor esi, esi
xor edx, edx
mov rax, rsi
mov rbx, rdx
mov rcx, r10
call fcn.0049ab40
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rdx
nop
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x673336
mov rdx, qword [rsp + 0x38]
bt edx, 8
nop dword [rax]
jae 0x673323
cmp byte [0x00984540], 0
je 0x6732ae
lea rdx, [0x006a5f20]
mov qword [0x00984548], rdx
cmp dword [0x009d9570], 0
jne 0x67328d
mov rdx, qword [rsp + 0x58]
jmp 0x6732a5
call fcn.004673c0
mov rdx, qword [rsp + 0x58]
mov qword [r11], rdx
mov rsi, qword [0x00984550]
mov qword [r11 + 8], rsi
mov qword [0x00984550], rdx
jmp 0x6732b3
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
call fcn.00499380
nop dword [rax]
call fcn.0049c020
mov rdi, qword [rsp + 0x60]
mov ebx, 3
mov rcx, qword [rsp + 0x28]
mov rsi, rax
mov rax, qword [rsp + 0x40]
nop dword [rax]
call fcn.00463d00
test rax, rax
jne 0x6732f0
xor eax, eax
xor ecx, ecx
jmp 0x673317
mov qword [rsp + 0x30], rax
nop
lea rax, [0x006d8220]
nop dword [rax]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rcx, rax
lea rax, [0x0078a8e0]
mov rbx, rcx
add rsp, 0x88
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00789010]
call fcn.00436ea0
lea rax, [0x006cc740]
nop dword [rax]
call fcn.0040d7c0
mov qword [rax + 8], 0x18
lea rcx, [0x0070f83b]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006b31a0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00673120
Function at 0x675040
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x675142
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
lea rax, [0x006ee920]
nop
call fcn.0040d7c0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
lea rax, [0x006a9020]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
mov rcx, qword [0x0096baf0]
mov rbx, rax
mov edi, 2
mov rax, rcx
mov rcx, rdi
call fcn.0066a220
test rax, rax
je 0x6750f1
mov r10, qword [0x0096aef8]
mov rdx, qword [rsp + 0x60]
movzx eax, word [rdx]
movzx ebx, word [rdx + 2]
movzx ecx, word [rdx + 6]
movzx edi, word [rdx + 8]
movzx esi, word [rdx + 0xa]
movzx r8d, word [rdx + 0xc]
movzx edx, word [rdx + 0xe]
imul rdx, rdx, 0x10625
shr rdx, 0x1a
movzx r9d, dx
call fcn.004baf00
xor edi, edi
xor esi, esi
add rsp, 0x68
pop rbp
ret
call fcn.004ba360
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rcx
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x30
lea rcx, [0x0071ad9e]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00789ac0]
mov rsi, rax
mov rax, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.00675040

Function at 0x67b8a0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x67ba12
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
lea rax, [0x006e9640]
mov ebx, 0x808
mov rcx, rbx
call fcn.0044bc20
mov qword [rsp + 0x40], rax
lea rax, [0x006a5e60]
call fcn.0040d7c0
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rax
lea rax, [0x006aa7c0]
call fcn.0040d7c0
mov qword [rax], 8
mov rdx, qword [rsp + 0x50]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], 0x18180
mov rdx, qword [rsp + 0x48]
mov qword [rax + 0x18], rdx
mov rdx, qword [0x0096b908]
mov rbx, rax
mov ecx, 4
mov rdi, rcx
mov rax, rdx
call fcn.0066a220
test rax, rax
jne 0x67b975
mov r8, qword [rsp + 0x58]
mov ecx, dword [r8]
mov ebx, 0xaaaaaaab
imul rcx, rbx
shr rcx, 0x25
cmp rcx, 0x808
ja 0x67ba07
mov rax, qword [rsp + 0x40]
mov rbx, rcx
mov ecx, 0x808
xor edi, edi
xor esi, esi
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x18]
mov rax, rdi
call rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rax, qword [rsp + 0x28]
nop
call fcn.0040af00
lea rcx, [0x006a5e20]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
call fcn.0040af80
lea rcx, [0x006a5b60]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x0071be53]
mov ebx, 0x35
lea rcx, [rsp + 0x60]
mov edi, 2
mov rsi, rdi
call fcn.004ccb40
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov edx, 0x808
call fcn.004677e0
nop
call fcn.004654a0
jmp fcn.0067b8a0
Function at 0x685a20
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x685b58
push rbp
mov rbp, rsp
sub rsp, 0x98
mov rax, qword [0x009839e0]
movups xmmword [rsp + 0x28], xmm15
lea rdx, [0x006a5b60]
mov qword [rsp + 0x28], rdx
lea rdx, [0x007886f0]
mov qword [rsp + 0x30], rdx
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x00685be0]
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 1
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x48]
nop
call fcn.004fb6e0
lea rax, [0x0071c690]
mov ebx, 0x38
call fcn.00683ec0
mov rdx, qword [0x009839e0]
mov qword [rsp + 0x20], rdx
movups xmmword [rsp + 0x38], xmm15
call fcn.0040b020
lea rdx, [0x006a3660]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
lea rdx, [0x00685b80]
mov qword [rsp + 0x68], rdx
lea rdx, [0x007043a1]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], 2
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 1
mov rax, qword [rsp + 0x20]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0x68]
call fcn.004fb6e0
add rsp, 0x98
pop rbp
ret
call fcn.004654a0
nop dword [rax]
jmp fcn.00685a20
Function at 0x1400036a0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140082080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
lea rdx, [rsp + 0x38]
xor eax, eax
mov rcx, rsi
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [rsp + 0x38]
lea rax, [rsp + 0x34]
movsx edi, word [rsp + 0x3a]
mov dl, reloc.WLDAP32.dll_Ordinal_32
mov r9d, dword [rsp + 0x30]
imul edi, ecx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x34]
movzx edx, word [rsp + 0x40]
mov r8d, edi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400652b0
mov rsi, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140007610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140007644
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140007630
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400065d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140007669
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012890
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400076e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400076de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006555c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400076f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140007724
mov eax, esi
lea ecx, [rax - 0x3d]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140007710
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400065d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140007749
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012890
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400077c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006555c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret