Function at 0x43bac0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43be4b
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x4c], ecx
mov qword [rsp + 0x40], rax
lea edx, [rbx - 0x1001]
cmp edx, 3
jbe 0x43baf6
cmp ebx, 0x1009
jne 0x43bcaa
mov edx, ebx
btr ebx, 0xc
nop dword [rax]
cmp ecx, ebx
jne 0x43bb21
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x90], ecx
sete sil
test sil, sil
je 0x43bb21
add rsp, 0x30
pop rbp
nop
ret
call fcn.00438fc0
lea rax, [0x007178e1]
mov ebx, 0x27
call fcn.00439840
mov rax, qword [rsp + 0x40]
nop dword [rax]
call fcn.004397c0
lea rax, [0x00706e5f]
mov ebx, 9
call fcn.00439840
mov eax, dword [rsp + 0x48]
mov eax, eax
nop dword [rax]
call fcn.004396c0
lea rax, [0x00706e68]
mov ebx, 9
call fcn.00439840
mov eax, dword [rsp + 0x4c]
mov eax, eax
nop dword [rax]
call fcn.004396c0
call fcn.00439200
call fcn.00439020
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x10], rdx
call fcn.00438fc0
lea rax, [0x0070b830]
mov ebx, 0x12
call fcn.00439840
mov rax, qword [rsp + 0x40]
call fcn.004397c0
lea rax, [0x00705ae9]
mov ebx, 7
nop
call fcn.00439840
mov rax, qword [rsp + 0x10]
call fcn.00439580
lea rax, [0x0070c2ba]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x18]
call fcn.00439580
call fcn.00439200
call fcn.00439020
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x10], rdx
call fcn.00438fc0
lea rax, [0x0070b842]
mov ebx, 0x12
call fcn.00439840
mov rax, qword [rsp + 0x20]
call fcn.004397c0
lea rax, [0x00705ae9]
mov ebx, 7
call fcn.00439840
mov rax, qword [rsp + 0x10]
call fcn.00439580
lea rax, [0x0070c3c4]
mov ebx, 0x13
nop
call fcn.00439840
mov rax, qword [rsp + 0x18]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x0071bc13]
mov ebx, 0x34
call fcn.00437620
call fcn.00438fc0
lea rax, [0x00719147]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x40]
call fcn.004397c0
lea rax, [0x00706e5f]
mov ebx, 9
nop dword [rax + rax]
call fcn.00439840
mov eax, dword [rsp + 0x48]
mov eax, eax
call fcn.004396c0
lea rax, [0x00706e68]
mov ebx, 9
nop dword [rax]
call fcn.00439840
mov eax, dword [rsp + 0x4c]
mov eax, eax
call fcn.004396c0
call fcn.00439200
call fcn.00439020
mov qword [rsp + 0x28], r14
nop
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x10], rdx
nop
call fcn.00438fc0
lea rax, [0x0070b830]
mov ebx, 0x12
call fcn.00439840
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.004397c0
lea rax, [0x00705ae9]
mov ebx, 7
call fcn.00439840
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00439580
lea rax, [0x0070c2ba]
mov ebx, 0x13
call fcn.00439840
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00439580
call fcn.00439200
call fcn.00439020
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov ecx, ecx
mov qword [rsp + 0x18], rcx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x10], rdx
call fcn.00438fc0
lea rax, [0x0070b842]
mov ebx, 0x12
nop
call fcn.00439840
mov rax, qword [rsp + 0x28]
call fcn.004397c0
lea rax, [0x00705ae9]
mov ebx, 7
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x10]
call fcn.00439580
lea rax, [0x0070c3c4]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00439840
mov rax, qword [rsp + 0x18]
call fcn.00439580
call fcn.00439200
call fcn.00439020
lea rax, [0x0071c4a1]
mov ebx, 0x37
call fcn.00437620
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
jmp fcn.0043bac0