joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e9540
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9766
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
call fcn.0040e240
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov ebx, 9
call fcn.004e4380
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 5
je 0x4e96f6
cmp rcx, 1
jne 0x4e974d
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rcx
nop
call fcn.004e4480
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
lea rsi, [rbx - 1]
cmp rdx, rsi
jb 0x4e9745
mov rax, qword [rsp + 0x30]
lea rdi, [rax - 1]
cmp rsi, rdi
jb 0x4e973a
mov rsi, qword [rcx]
sub rdx, rax
sub rbx, rax
inc rdx
mov r8, rdx
neg rdx
sar rdx, 0x3f
and rdi, rdx
lea rax, [rsi + rdi]
nop
mov rcx, r8
call fcn.004e9a20
mov byte [rsp + 0x27], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044fe20
movzx edx, byte [rsp + 0x27]
test dl, dl
je 0x4e9727
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x68]
cmp qword [rcx + 0x20], 9
jne 0x4e9648
mov rax, rcx
mov ebx, 9
call fcn.004e4380
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x28]
cmp qword [rcx + 0x20], 3
jne 0x4e9714
mov rax, rcx
mov ebx, 9
nop dword [rax + rax]
call fcn.004e4380
mov rax, qword [rsp + 0x68]
call fcn.004e92e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
lea rax, [0x006b5120]
mov rbx, qword [rsp + 0x40]
call fcn.00412d00
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
cmp dword [0x009d9570], 0
jne 0x4e96ac
mov rcx, qword [rsp + 0x48]
jmp 0x4e96c1
call fcn.004673c0
mov rcx, qword [rsp + 0x48]
mov qword [r11], rcx
mov rdx, qword [rax + 8]
mov qword [r11 + 8], rdx
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x20], 9
jne 0x4e96e0
mov ebx, 9
call fcn.004e4380
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x4e96f6
cmp rcx, 4
je 0x4e9561
jmp 0x4e9701
mov rax, qword [rsp + 0x40]
add rsp, 0x58
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
mov rax, rdi
mov rcx, rsi
call fcn.00467820
mov rcx, rsi
call fcn.004677e0
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
nop dword [rax + rax]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004e9540
Function at 0x4e9780
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9979
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
call fcn.004e4480
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x10]
lea rsi, [rbx - 1]
nop word [rax + rax]
cmp rdx, rsi
jb 0x4e9970
mov rax, qword [rsp + 0x20]
lea rdi, [rax - 1]
cmp rsi, rdi
jb 0x4e9965
mov rsi, qword [rcx]
sub rbx, rax
sub rdx, rax
inc rdx
mov r8, rdx
neg rdx
sar rdx, 0x3f
and rdi, rdx
lea rax, [rsi + rdi]
nop dword [rax + rax]
test rbx, rbx
jbe 0x4e9958
movzx edx, byte [rsi + rdi]
cmp dl, 0x66
ja 0x4e9860
cmp dl, 0x22
je 0x4e981e
cmp dl, 0x66
je 0x4e986e
jmp 0x4e988f
nop
mov rcx, r8
call fcn.004e9a20
mov byte [rsp + 0x1f], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044fe20
movzx edx, byte [rsp + 0x1f]
nop
test dl, dl
je 0x4e9945
call fcn.0040af80
mov rbx, rax
lea rax, [0x006a5b60]
add rsp, 0x38
pop rbp
ret
cmp dl, 0x6e
je 0x4e9926
cmp dl, 0x74
jne 0x4e988f
cmp dl, 0x74
sete cl
movzx ecx, cl
lea rdx, [0x0092f8a0]
lea rbx, [rdx + rcx*8]
lea rax, [0x006a5ba0]
add rsp, 0x38
pop rbp
ret
cmp dl, 0x2d
je 0x4e98a9
add edx, 0xffffffd0
nop word [rax + rax]
cmp dl, 9
ja 0x4e9930
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044fe20
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
call fcn.004e6ee0
test rcx, rcx
je 0x4e9920
nop
mov rdx, qword [rsp + 0x48]
cmp qword [rdx + 0x70], 0
jne 0x4e9920
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rax, rdx
mov rbx, rcx
mov rcx, rdi
call fcn.004e40e0
mov rdx, qword [rsp + 0x48]
mov qword [rdx + 0x70], rax
cmp dword [0x009d9570], 0
je 0x4e9912
call fcn.004673c0
mov qword [r11], rbx
mov rcx, qword [rdx + 0x78]
mov qword [r11 + 8], rcx
mov qword [rdx + 0x78], rbx
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
add rsp, 0x38
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x38
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
nop
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00467760
mov rax, rdi
mov rcx, rsi
call fcn.00467820
mov rcx, rsi
call fcn.004677e0
nop
mov qword [rsp + 8], rax
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004e9780
Function at 0x4fe1e0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4fe1f7
inc rax
cmp rax, 4
jge 0x4fe20f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4fe1f4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4fe220
inc rax
cmp rax, 4
jge 0x4fe22e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4fe257
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4fe23b
jmp 0x4fe21d
Function at 0x507780
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x507a01
push rbp
mov rbp, rsp
sub rsp, 0x138
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a54
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
jne 0x5079c2
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x5077f8
mov rdx, qword [0x0096cd70]
mov r8, qword [0x0096cd78]
jmp 0x507876
jae 0x50780a
mov rdx, qword [0x0096cd80]
mov r8, qword [0x0096cd88]
jmp 0x507876
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x50782b
cmp bl, 2
jne 0x507820
movzx edx, word [rax + 0x1c]
jmp 0x507844
cmp bl, 3
jne 0x507842
movzx edx, word [rax + 0x1e]
jmp 0x507844
cmp bl, 4
jne 0x507836
movzx edx, word [rax + 0x20]
jmp 0x507844
cmp bl, 5
jne 0x507842
movzx edx, word [rax + 0x22]
nop
jmp 0x507844
xor edx, edx
movzx edx, dx
cmp qword [rax + 0x30], rdx
jne 0x507871
mov qword [rax + 0x30], 0
movzx r9d, byte [rax + 0x24]
inc r9d
mov byte [rax + 0x24], r9b
mov rdx, qword [0x0096cd80]
mov r8, qword [0x0096cd88]
jmp 0x507876
xor edx, edx
xor r8d, r8d
test rdx, rdx
jne 0x507981
mov qword [rsp + 0x258], rax
movups xmmword [rsp + 0x2c], xmm15
lea rdi, [rsp + 0x38]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a54
mov rbp, qword [rbp]
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rsi, qword [rax + 0x28]
lea rax, [rsp + 0x2c]
call fcn.005093a0
test rbx, rbx
je 0x507904
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a54
mov rbp, qword [rbp]
mov rax, rbx
mov rbx, rcx
add rsp, 0x138
pop rbp
ret
mov rdi, qword [rsp + 0x258]
mov byte [rdi + 0x38], 1
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rdi + 0x3c], xmm0
lea rcx, [rdi + 0x48]
lea rsi, [rsp + 0x38]
mov rdx, rdi
mov rdi, rcx
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
mov qword [rdx + 0x28], rax
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x148], xmm0
lea rdi, [rsp + 0x154]
lea rsi, [rsp + 0x38]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
nop
ret
movups xmmword [rsp + 0x148], xmm15
lea rdi, [rsp + 0x154]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a54
mov rbp, qword [rbp]
mov rax, rdx
mov rbx, r8
add rsp, 0x138
pop rbp
ret
movups xmm0, xmmword [rax + 0x3c]
movups xmmword [rsp + 0x148], xmm0
lea rsi, [rax + 0x48]
lea rdi, [rsp + 0x154]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x138
pop rbp
nop
ret
mov qword [rsp + 0x118], rax
mov byte [rsp + 0x120], bl
call fcn.004654a0
mov rax, qword [rsp + 0x118]
movzx ebx, byte [rsp + 0x120]
jmp fcn.00507780
Function at 0x507a40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507c36
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x58], bl
cmp byte [rax + 0x38], 0
je 0x507a97
movzx ecx, word [rax + 0x144]
add rcx, qword [rax + 0x28]
cmp qword [rax + 8], rcx
jge 0x507a81
mov rax, qword [0x0096cdf0]
mov rbx, qword [0x0096cdf8]
add rsp, 0x40
pop rbp
ret
mov qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
movzx edx, byte [rax + 0x24]
cmp bl, dl
jbe 0x507aaf
mov rdx, qword [0x0096cd70]
mov rsi, qword [0x0096cd78]
jmp 0x507b2e
jae 0x507ac2
mov rdx, qword [0x0096cd80]
mov rsi, qword [0x0096cd88]
nop
jmp 0x507b2e
mov byte [rax + 0x38], 0
cmp bl, 3
ja 0x507ae2
cmp bl, 2
jne 0x507ad6
movzx edx, word [rax + 0x1c]
jmp 0x507afa
cmp bl, 3
jne 0x507af8
movzx edx, word [rax + 0x1e]
nop
jmp 0x507afa
cmp bl, 4
jne 0x507aed
movzx edx, word [rax + 0x20]
jmp 0x507afa
cmp bl, 5
jne 0x507af8
movzx edx, word [rax + 0x22]
jmp 0x507afa
xor edx, edx
movzx edx, dx
nop dword [rax]
cmp qword [rax + 0x30], rdx
jne 0x507b2a
mov qword [rax + 0x30], 0
movzx r8d, byte [rax + 0x24]
inc r8d
mov byte [rax + 0x24], r8b
mov rdx, qword [0x0096cd80]
mov rsi, qword [0x0096cd88]
jmp 0x507b2e
xor edx, edx
xor esi, esi
test rdx, rdx
jne 0x507c2a
mov qword [rsp + 0x50], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call fcn.00509820
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0x28], rax
nop dword [rax]
test rbx, rbx
je 0x507c1c
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rax, [0x006ceae0]
call fcn.0040d7c0
mov qword [rsp + 0x38], rax
mov rbx, qword [0x00983e98]
lea rcx, [rsp + 0x58]
lea rax, [0x006b7280]
call fcn.0040e6e0
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
xor eax, eax
lea rbx, [0x00707858]
mov ecx, 0xa
call fcn.0044faa0
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], rbx
cmp dword [0x009d9570], 0
je 0x507bd7
call fcn.004673c0
mov qword [r11], rax
mov rdx, qword [rcx]
mov qword [r11 + 8], rdx
mov qword [rcx], rax
mov rdx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rdx
cmp dword [0x009d9570], 0
jne 0x507bf3
mov rdx, qword [rsp + 0x30]
jmp 0x507c08
call fcn.004673c0
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov rsi, qword [rcx + 0x18]
mov qword [r11 + 8], rsi
mov qword [rcx + 0x18], rdx
lea rax, [0x0078aae0]
mov rbx, rcx
add rsp, 0x40
pop rbp
ret
inc qword [rdx + 0x30]
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, rdx
mov rbx, rsi
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00507a40
Function at 0x5083c0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x2a8]
cmp r12, qword [r14 + 0x10]
jbe 0x508501
push rbp
mov rbp, rsp
sub rsp, 0x320
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a54
mov rbp, qword [rbp]
cmp byte [rax + 0x38], 0
nop dword [rax]
je 0x5084ea
cmp word [rax + 0x13c], 5
jne 0x5084ea
mov qword [rsp + 0x430], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax + 0x28]
mov rax, rdx
call fcn.0050a740
lea rdi, [rsp + 0x220]
mov rsi, rsp
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
lea rdi, [rsp + 0x120]
lea rsi, [rsp + 0x220]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
test rax, rax
je 0x50849f
lea rdi, [rsp + 0x330]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467a54
mov rbp, qword [rbp]
add rsp, 0x320
pop rbp
ret
mov rcx, qword [rsp + 0x430]
movzx edx, word [rcx + 0x144]
add qword [rcx + 0x28], rdx
mov byte [rcx + 0x38], 0
inc qword [rcx + 0x30]
lea rdi, [rsp + 0x330]
lea rsi, [rsp + 0x120]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
xor eax, eax
xor ebx, ebx
add rsp, 0x320
pop rbp
ret
mov rax, qword [0x0096cd70]
mov rbx, qword [0x0096cd78]
add rsp, 0x320
pop rbp
ret
mov qword [rsp + 0x108], rax
call fcn.004654a0
mov rax, qword [rsp + 0x108]
jmp fcn.005083c0

Function at 0x508520
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rsp + 0x30], 0
cmp byte [rax + 0x38], 0
je 0x508621
cmp word [rax + 0x13c], 1
jne 0x508621
mov rcx, qword [rax + 0x28]
lea rsi, [rcx + 4]
mov rdx, qword [rax + 0x10]
mov rdi, qword [rax]
cmp qword [rax + 8], rsi
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x1c], 0
jge 0x508580
mov rcx, qword [0x0096cd90]
mov rdx, qword [0x0096cd98]
jmp 0x5085b8
cmp rdx, rsi
jb 0x508645
cmp rcx, rsi
ja 0x508635
mov rsi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdi + rsi]
lea rdx, [rsp + 0x1c]
cmp rdx, rcx
je 0x5085b4
mov ecx, dword [rdi + rsi]
mov dword [rsp + 0x1c], ecx
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x5085c7
mov dword [rsp + 0x14], 0
jmp 0x5085db
mov dword [rsp + 0x14], 0
mov esi, dword [rsp + 0x1c]
mov dword [rsp + 0x14], esi
xor ecx, ecx
xor edx, edx
mov esi, dword [rsp + 0x14]
mov dword [rsp + 0x18], esi
test rcx, rcx
je 0x5085fc
mov dword [rsp + 0x30], 0
mov rax, rcx
mov rbx, rdx
add rsp, 0x20
pop rbp
ret
movzx ecx, word [rax + 0x144]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
mov ecx, dword [rsp + 0x18]
mov dword [rsp + 0x30], ecx
xor eax, eax
xor ebx, ebx
add rsp, 0x20
pop rbp
ret
mov rax, qword [0x0096cd70]
mov rbx, qword [0x0096cd78]
add rsp, 0x20
pop rbp
ret
mov rax, rcx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00467820
mov rcx, rsi
call fcn.004677e0
nop
int3
Function at 0x508660
Capabilities:
Run powershell expression

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
movups xmmword [rsp + 0x50], xmm15
cmp byte [rax + 0x38], 0
je 0x508762
cmp word [rax + 0x13c], 0x1c
jne 0x508762
mov rcx, qword [rax + 0x28]
lea rsi, [rcx + 0x10]
mov rdx, qword [rax + 0x10]
mov rdi, qword [rax]
cmp qword [rax + 8], rsi
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x30], xmm15
jge 0x5086c0
mov rcx, qword [0x0096cd90]
mov rdx, qword [0x0096cd98]
jmp 0x5086f9
cmp rdx, rsi
jb 0x508785
cmp rcx, rsi
ja 0x508776
mov rsi, rcx
sub rcx, rdx
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rdi + rsi]
lea rdx, [rsp + 0x30]
cmp rdx, rcx
je 0x5086f5
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm0
xor ecx, ecx
xor edx, edx
test rcx, rcx
je 0x508706
movups xmmword [rsp + 0x10], xmm15
jmp 0x50871a
movups xmmword [rsp + 0x10], xmm15
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x10], xmm0
xor ecx, ecx
xor edx, edx
movups xmm0, xmmword [rsp + 0x10]
movups xmmword [rsp + 0x20], xmm0
test rcx, rcx
je 0x50873b
movups xmmword [rsp + 0x50], xmm15
mov rax, rcx
mov rbx, rdx
add rsp, 0x40
pop rbp
ret
movzx ecx, word [rax + 0x144]
add qword [rax + 0x28], rcx
mov byte [rax + 0x38], 0
inc qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
mov rax, qword [0x0096cd70]
mov rbx, qword [0x0096cd78]
add rsp, 0x40
pop rbp
ret
mov rax, rcx
mov rcx, rsi
nop dword [rax]
call fcn.00467820
mov rcx, rsi
call fcn.004677e0
nop
int3
Function at 0x508a00
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508b6a
push rbp
mov rbp, rsp
sub rsp, 0x30
movzx edx, byte [rax + 0x18]
cmp dl, 2
jb 0x508b56
nop
ja 0x508b42
mov qword [rsp + 0x148], rax
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
mov r8, qword [rax + 0x28]
lea rax, [rsp + 0x40]
call fcn.0050a5a0
test rdi, rdi
jne 0x508b36
mov rdx, qword [rsp + 0x148]
movzx esi, byte [rdx + 0x18]
cmp sil, 3
ja 0x508aa0
cmp sil, 2
jne 0x508a82
lea rsi, [rdx + 0x1e]
mov rdi, qword [0x0096ce40]
mov r8, qword [0x0096ce48]
nop
jmp 0x508ae1
cmp sil, 3
jne 0x508ada
lea rsi, [rdx + 0x20]
mov rdi, qword [0x0096ce50]
mov r8, qword [0x0096ce58]
jmp 0x508ae1
cmp sil, 4
jne 0x508ac0
lea rsi, [rdx + 0x22]
mov rdi, qword [0x0096ce60]
mov r8, qword [0x0096ce68]
jmp 0x508ae1
cmp sil, 5
jne 0x508ada
lea rsi, [rdx + 0x24]
mov rdi, qword [0x0096ce70]
mov r8, qword [0x0096ce78]
jmp 0x508ae1
xor esi, esi
xor edi, edi
xor r8d, r8d
movzx r9d, word [rsi]
cmp r9w, 0xffff
je 0x508af8
inc r9d
mov word [rsi], r9w
xor edi, edi
xor r8d, r8d
test rdi, rdi
jne 0x508b2a
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rcx
cmp dword [0x009d9570], 0
je 0x508b1d
call fcn.004673c0
mov qword [r11], rax
mov rcx, qword [rdx]
mov qword [r11 + 8], rcx
mov qword [rdx], rax
xor eax, eax
xor ebx, ebx
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov rbx, r8
add rsp, 0x30
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x0096cd80]
mov rbx, qword [0x0096cd88]
add rsp, 0x30
pop rbp
ret
mov rax, qword [0x0096cd70]
mov rbx, qword [0x0096cd78]
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x110], rax
call fcn.004654a0
mov rax, qword [rsp + 0x110]
nop
jmp fcn.00508a00
Function at 0x5090c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50914e
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp byte [rax + 0x18], 0
je 0x50912d
mov byte [rax + 0x18], 6
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x28]
cmp rdx, rcx
jb 0x509148
mov qword [rsp + 0x30], rax
lea rsi, [rax + 0x1a]
mov r8, qword [rax]
sub rdx, rcx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and rcx, rdx
lea rbx, [r8 + rcx]
xor ecx, ecx
mov rax, rsi
call fcn.00506d80
mov rdx, qword [rsp + 0x30]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
xor edi, edi
xor esi, esi
add rsp, 0x20
pop rbp
ret
mov rdi, qword [0x0096cd70]
mov rsi, qword [0x0096cd78]
xor eax, eax
xor ebx, ebx
mov rcx, rbx
add rsp, 0x20
pop rbp
ret
call fcn.004677e0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.005090c0
Function at 0x50dbc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50dd0e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0096b868]
call fcn.004fe460
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0050dd20]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x50dcd2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x50dd08
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x50dcfd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00467820
call fcn.004677a0
nop
call fcn.004654a0
jmp fcn.0050dbc0
Function at 0x513420
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x1c8]
cmp r12, qword [r14 + 0x10]
jbe 0x5135c3
push rbp
mov rbp, rsp
sub rsp, 0x240
cmp word [rsp + 0x25c], 3
je 0x5135ac
nop
mov ebx, 3
call fcn.00507780
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x12c], xmm0
lea rdi, [rsp + 0x138]
lea rsi, [rsp + 0xc]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
test rax, rax
je 0x5134fc
nop dword [rax + rax]
cmp qword [0x0096cd80], rax
je 0x5134b0
mov ecx, 1
jmp 0x5134e1
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x238], rbx
mov rcx, qword [0x0096cd88]
call fcn.00404a60
xor eax, 1
mov rbx, qword [rsp + 0x238]
mov ecx, eax
mov rax, qword [rsp + 0x120]
test cl, cl
je 0x5134fc
mov rax, qword [0x0096c7d0]
mov rbx, qword [0x0096c7d8]
add rsp, 0x240
pop rbp
ret
cmp word [rsp + 0x25c], 0
jne 0x513554
cmp byte [rsp + 0x256], 0
jne 0x513554
cmp byte [rsp + 0x259], 0
jne 0x513554
nop dword [rax + rax]
cmp qword [0x0096cd80], rax
je 0x51352d
xor eax, eax
jmp 0x513539
mov rcx, qword [0x0096cd88]
call fcn.00404a60
test al, al
je 0x513554
mov rax, qword [0x0096c7c0]
mov rbx, qword [0x0096c7c8]
add rsp, 0x240
pop rbp
ret
movzx ecx, word [rsp + 0x25c]
nop dword [rax]
test cx, cx
je 0x51359f
cmp cx, 3
je 0x51359f
cmp cx, 2
jne 0x513588
mov rax, qword [0x0096c820]
mov rbx, qword [0x0096c828]
add rsp, 0x240
pop rbp
ret
mov rax, qword [0x0096c7f0]
mov rbx, qword [0x0096c7f8]
add rsp, 0x240
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x240
pop rbp
ret
mov rax, qword [0x0096c870]
mov rbx, qword [0x0096c878]
add rsp, 0x240
pop rbp
ret
mov qword [rsp + 0x18], rax
call fcn.004654a0
mov rax, qword [rsp + 0x18]
jmp fcn.00513420
Function at 0x5135e0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x2d0]
cmp r12, qword [r14 + 0x10]
jbe 0x513744
push rbp
mov rbp, rsp
sub rsp, 0x348
mov word [rsp + 0x360], bx
mov qword [rsp + 0x340], rax
jmp 0x513617
mov rax, qword [rsp + 0x340]
mov ebx, 3
nop dword [rax]
call fcn.00507780
movups xmm0, xmmword [rsp]
movups xmmword [rsp + 0x22c], xmm0
lea rdi, [rsp + 0x238]
lea rsi, [rsp + 0xc]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
movups xmm0, xmmword [rsp + 0x22c]
movups xmmword [rsp + 0x120], xmm0
lea rdi, [rsp + 0x12c]
lea rsi, [rsp + 0x238]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467d60
mov rbp, qword [rbp]
cmp qword [0x0096cd80], rax
jne 0x5136c0
mov qword [rsp + 0x338], rax
mov rcx, qword [0x0096cd88]
call fcn.00404a60
test al, al
jne 0x51372d
mov rax, qword [rsp + 0x338]
nop dword [rax]
test rax, rax
jne 0x513716
movzx ecx, word [rsp + 0x360]
cmp word [rsp + 0x220], cx
je 0x513709
mov rax, qword [rsp + 0x340]
mov ebx, 3
call fcn.00507a40
test rax, rax
je 0x51360f
mov rax, qword [0x0096c7d0]
mov rbx, qword [0x0096c7d8]
add rsp, 0x348
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x348
pop rbp
ret
mov rax, qword [0x0096c7d0]
mov rbx, qword [0x0096c7d8]
add rsp, 0x348
pop rbp
ret
mov rax, qword [0x0096c870]
mov rbx, qword [0x0096c878]
add rsp, 0x348
pop rbp
ret
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.004654a0
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
nop dword [rax]
jmp fcn.005135e0