joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496b40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496bd9
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
nop dword [rax]
test rbx, rbx
je 0x496bc5
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx + 0x98]
mov rax, rcx
nop
call rdx
cmp rax, 0x14
jne 0x496bad
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x100]
mov rax, qword [rsp + 0x30]
call rcx
mov rbx, qword [rsp + 0x20]
test byte [rbx], al
call fcn.00496cc0
add rsp, 0x10
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788df0]
nop dword [rax + rax]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00788de0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00496b40
Function at 0x4994c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499686
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
nop
cmp rcx, 0x11
jne 0x499581
movzx esi, byte [rax + 0x17]
and esi, 0x1f
cmp rsi, 0x12
ja 0x499518
nop word [rax + rax]
cmp rsi, 0x11
jne 0x49950c
mov rsi, qword [rax + 0x30]
jmp 0x49953e
cmp rsi, 0x12
jne 0x49953c
mov rsi, qword [rax + 0x30]
jmp 0x49953e
cmp rsi, 0x15
jne 0x499524
mov rsi, qword [rax + 0x38]
jmp 0x49953e
cmp rsi, 0x16
jne 0x499530
mov rsi, qword [rax + 0x30]
jmp 0x49953e
cmp rsi, 0x17
jne 0x49953c
mov rsi, qword [rax + 0x30]
jmp 0x49953e
xor esi, esi
movzx esi, byte [rsi + 0x17]
and esi, 0x1f
cmp rsi, 8
jne 0x499670
bt edx, 8
jae 0x49965d
mov rcx, qword [rax + 0x40]
nop dword [rax]
test rcx, rcx
jl 0x499658
mov rax, rbx
neg rbx
cmp rcx, rbx
ja 0x499649
mov rbx, rcx
add rsp, 0x18
pop rbp
ret
cmp rcx, 0x17
jne 0x49960e
movzx edx, byte [rax + 0x17]
and edx, 0x1f
cmp rdx, 0x12
ja 0x4995b0
cmp rdx, 0x11
jne 0x4995a4
mov rdx, qword [rax + 0x30]
jmp 0x4995da
cmp rdx, 0x12
jne 0x4995d8
mov rdx, qword [rax + 0x30]
jmp 0x4995da
cmp rdx, 0x15
jne 0x4995c0
mov rdx, qword [rax + 0x38]
jmp 0x4995da
cmp rdx, 0x16
jne 0x4995cc
mov rdx, qword [rax + 0x30]
jmp 0x4995da
cmp rdx, 0x17
jne 0x4995d8
mov rdx, qword [rax + 0x30]
jmp 0x4995da
xor edx, edx
movzx edx, byte [rdx + 0x17]
and edx, 0x1f
cmp rdx, 8
jne 0x4995fb
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
mov rbx, rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788e40]
call fcn.00436ea0
mov qword [rsp + 0x10], rcx
lea rax, [0x006cc740]
call fcn.0040d7c0
mov qword [rax + 8], 0x13
lea rcx, [0x0070c5b2]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006b31a0]
call fcn.00436ea0
test rax, rax
je 0x499653
call fcn.0045daa0
call fcn.0045db40
call fcn.0045daa0
lea rax, [0x006a5b60]
lea rbx, [0x00788e60]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00788e50]
nop
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004994c0
Function at 0x49d2a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d4ec
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x18], rcx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x49d2f0
bt edx, 8
nop dword [rax + rax]
jae 0x49d4d8
mov rcx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
jmp 0x49d304
cmp rcx, 0x17
jne 0x49d3f5
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov rbx, r8
test rdi, rdi
jl 0x49d4c5
cmp rsi, rdi
jl 0x49d4c5
cmp rsi, rcx
jg 0x49d4c5
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rcx
lea rax, [0x006a39e0]
call fcn.0040d7c0
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rdx
mov qword [rax + 0x10], rcx
nop
test rcx, rcx
jle 0x49d39a
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsi + 0x30]
mov rdi, qword [rdi]
imul rdx, rdi
mov rdi, qword [rsp + 0x28]
add rdx, rdi
cmp dword [0x009d9570], 0
je 0x49d395
call fcn.004673c0
mov qword [r11], rdx
mov rdi, qword [rax]
mov qword [r11 + 8], rdi
mov qword [rax], rdx
jmp 0x49d3c6
cmp dword [0x009d9570], 0
jne 0x49d3aa
mov rdx, qword [rsp + 0x28]
jmp 0x49d3be
call fcn.004673c0
mov rdx, qword [rsp + 0x28]
mov qword [r11], rdx
mov rsi, qword [rax]
mov qword [r11 + 8], rsi
mov qword [rax], rdx
mov rsi, qword [rsp + 0x20]
test byte [rsi], al
mov rdx, qword [rsp + 0x18]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
or rcx, 0x97
mov rbx, rax
mov rax, rsi
add rsp, 0x40
pop rbp
ret
cmp rcx, 0x18
jne 0x49d485
nop
test rdi, rdi
jl 0x49d470
cmp rsi, rdi
jl 0x49d470
cmp qword [rbx + 8], rsi
jl 0x49d470
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x006ce4a0]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
cmp qword [rdx + 8], rcx
jle 0x49d45d
mov rdx, qword [rdx]
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
nop
mov qword [rax + 8], rsi
add rdx, rcx
cmp dword [0x009d9570], 0
je 0x49d45a
call fcn.004673a0
mov qword [r11], rdx
mov qword [rax], rdx
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788ff0]
nop
call fcn.00436ea0
mov qword [rsp + 0x18], rcx
lea rax, [0x006cc740]
call fcn.0040d7c0
mov qword [rax + 8], 0x13
lea rcx, [0x0070c5eb]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x006b31a0]
nop dword [rax + rax]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00789000]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00788fe0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0049d2a0
Function at 0x49d680
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d794
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
test rcx, rcx
je 0x49d75e
bt ecx, 9
jae 0x49d728
movzx edx, byte [rax + 0x17]
and edx, 0x1f
sar rcx, 0xa
nop word [rax + rax]
cmp rdx, 0x14
jne 0x49d6ea
cmp qword [rax + 0x40], rcx
jbe 0x49d74b
mov rdx, qword [rax + 0x38]
mov ebx, dword [rdx + rcx*8 + 4]
nop
call fcn.00462780
mov rbx, rax
lea rax, [0x0078ef68]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00401140
mov rcx, qword [rsp + 0x10]
nop
cmp rbx, rcx
jbe 0x49d738
shl rcx, 4
mov ebx, dword [rax + rcx + 4]
nop
mov rax, qword [rsp + 0x18]
call fcn.00462780
mov rbx, rax
lea rax, [0x0078ef68]
add rsp, 0x20
pop rbp
ret
mov rbx, rax
lea rax, [0x0078ef68]
add rsp, 0x20
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x00788e90]
call fcn.00436ea0
lea rax, [0x006a5b60]
lea rbx, [0x00788e90]
call fcn.00436ea0
lea rax, [0x006cc740]
call fcn.0040d7c0
mov qword [rax + 8], 0x12
lea rcx, [0x0070ba5e]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x006b31a0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0049d680

Function at 0x4a6720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a67ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4a67cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x006a5fe0]
xor ebx, ebx
mov rcx, rdx
call fcn.0044bc20
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004a8020
inc rbx
cmp rcx, rbx
jae 0x4a67be
mov edi, 1
lea rsi, [0x006a5fe0]
call fcn.0044bd00
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00789b80]
lea rsi, [0x007882d0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a6720

Function at 0x4a6900
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6949
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
call fcn.004a6720
test rdi, rdi
jne 0x4a6935
nop dword [rax]
test rbx, rbx
jbe 0x4a692b
add rsp, 0x10
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.00467760
lea rax, [0x006a5b60]
lea rbx, [0x00788cd0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a6900
Function at 0x4c8ba0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c8db5
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
test rdi, rdi
je 0x4c8d66
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
cmp qword [0x0096bc10], rdi
je 0x4c8bf0
xor edx, edx
jmp 0x4c8c20
mov rcx, qword [0x0096bc18]
mov rax, rdi
mov rbx, rsi
nop dword [rax]
call fcn.00404a60
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov edx, eax
mov rax, qword [rsp + 0x48]
test dl, dl
jne 0x4c8d66
cmp qword [0x0096c660], rdi
jne 0x4c8c72
mov rcx, qword [0x0096c668]
mov rax, rdi
mov rbx, rsi
nop
call fcn.00404a60
test al, al
je 0x4c8c59
mov rdi, qword [0x00984050]
mov rsi, qword [0x00984058]
jmp 0x4c8cb8
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
cmp byte [0x009d90e8], 0
je 0x4c8cb8
mov rcx, qword [0x0096c660]
mov rdx, qword [0x0096c668]
mov rax, rdi
mov rbx, rsi
mov rdi, rdx
call fcn.00470500
test al, al
jne 0x4c8d72
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
lea rax, [0x006d4e60]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x58]
mov qword [rax + 8], rcx
cmp dword [0x009d9570], 0
nop
jne 0x4c8ce9
mov rcx, qword [rsp + 0x50]
jmp 0x4c8cf6
call fcn.004673a0
mov rcx, qword [rsp + 0x50]
mov qword [r11], rcx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x230]
mov rcx, qword [rcx + 0x228]
mov qword [rax + 0x18], rdx
cmp dword [0x009d9570], 0
je 0x4c8d28
nop dword [rax]
call fcn.004673a0
mov qword [r11], rcx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
cmp dword [0x009d9570], 0
jne 0x4c8d45
mov rcx, qword [rsp + 0x30]
jmp 0x4c8d52
call fcn.004673a0
mov rcx, qword [rsp + 0x30]
mov qword [r11], rcx
mov qword [rax + 0x28], rcx
mov rbx, rax
lea rax, [0x00789b60]
add rsp, 0x38
pop rbp
ret
mov rax, rdi
mov rbx, rsi
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x68]
call rcx
mov ecx, 0x2f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x0071a42d]
call fcn.0044faa0
nop dword [rax + rax]
call fcn.0040af80
mov rbx, rax
lea rax, [0x006a5b60]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004c8ba0
Function at 0x4d6f20
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7151
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
cmp qword [rax], 2
nop dword [rax + rax]
jl 0x4d6ff6
cmp qword [rax + 0xa0070], 0
jne 0x4d713d
cmp qword [rax + 0xa0090], 0
nop dword [rax]
jne 0x4d713d
cmp rcx, 0x8000
jle 0x4d6f92
sub rdi, rcx
lea r9, [rdi + 0x8000]
neg r9
sar r9, 0x3f
lea r10, [rcx - 0x8000]
and r9, r10
add rbx, r9
mov ecx, 0x8000
mov qword [rsp + 0x68], rax
mov r9, qword [rax + 0xa0078]
mov r10, qword [rax + 0xa0080]
cmp rcx, r10
cmovl r10, rcx
mov qword [rsp + 0x30], r10
cmp rbx, r9
je 0x4d6fcf
mov rax, r9
mov rcx, r10
nop dword [rax]
call fcn.00468160
mov rax, qword [rsp + 0x68]
mov r10, qword [rsp + 0x30]
lea r9, [r10 + 0xfc]
sar r9, 0x3f
shr r9, 0x38
lea r9, [r10 + r9]
lea r9, [r9 + 0xfc]
sar r9, 8
mov qword [rsp + 0x38], r9
xor ecx, ecx
jmp 0x4d7000
add rsp, 0x58
pop rbp
ret
inc rcx
nop
cmp rcx, r9
jge 0x4d70c6
mov rsi, rcx
shl rsi, 8
lea rbx, [rsi + 0x103]
mov rdx, qword [rax + 0xa0088]
cmp r10, rbx
cmovl rbx, r10
cmp rdx, rbx
jb 0x4d7135
cmp rbx, rsi
jb 0x4d712a
mov r11, qword [rax + 0xa0078]
sub rbx, rsi
sub rdx, rsi
mov r12, rdx
neg rdx
sar rdx, 0x3f
and rdx, rsi
lea r13, [rbx - 3]
add r11, rdx
test r13, r13
jle 0x4d6ffc
nop dword [rax]
cmp r13, 0x101
ja 0x4d711d
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r13
lea rdi, [rax + 0xa00e8]
mov rdx, qword [rax + 0x38]
mov r9, qword [rdx]
mov rcx, r12
mov rsi, r13
mov r8d, 0x101
mov rax, r11
call r9
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x68]
mov r9, qword [rsp + 0x50]
xor eax, eax
jmp 0x4d7116
mov rax, rdi
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
jmp 0x4d6ffc
mov qword [rax + 0xa0090], r10
mov qword [rax + 0xa0070], r10
add rsp, 0x58
pop rbp
ret
mov r10d, dword [rdi + rax*4 + 0xa00e8]
lea r11, [rax + r9]
and r10d, 0x1ffff
mov r12, r11
and r11d, 0x7fff
mov r13d, dword [rdi + r10*4 + 0x68]
mov dword [rdi + r11*4 + 0x80068], r13d
mov r11, qword [rdi + 0xa0068]
add r11, r12
mov dword [rdi + r10*4 + 0x68], r11d
inc rax
cmp rax, rsi
jl 0x4d70da
jmp 0x4d70af
mov rcx, r13
mov edx, 0x101
call fcn.004677a0
mov rax, rsi
mov rcx, rbx
call fcn.00467820
mov rcx, rbx
call fcn.004677e0
lea rax, [0x006a5b60]
lea rbx, [0x00788a30]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.004d6f20
Function at 0x4e09c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4e0a95
movdqa xmm0, xmmword [0x007885c0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4e0a01
movdqa xmm0, xmmword [0x007885d0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4e0b17
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4e0aeb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00788298]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007885e0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x4e4600
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4752
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + 0x20]
cmp rdx, 1
je 0x4e4694
cmp rdx, 2
jne 0x4e4660
test rdi, rdi
je 0x4e464b
call fcn.004e5480
nop
test rax, rax
je 0x4e4650
add rsp, 0x60
pop rbp
ret
call fcn.004e4220
mov rax, qword [rsp + 0x70]
call fcn.004e42e0
jmp 0x4e4721
cmp rdx, 6
jne 0x4e473e
test rdi, rdi
je 0x4e467f
call fcn.004e4d40
test rax, rax
je 0x4e4685
add rsp, 0x60
pop rbp
ret
nop
call fcn.004e4220
mov rax, qword [rsp + 0x70]
call fcn.004e42e0
jmp 0x4e4721
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
call fcn.004e4480
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x4e4721
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
lea r11, [rcx - 1]
cmp rdx, r11
jb 0x4e4736
mov r12, qword [rsp + 0x40]
lea r13, [r12 - 1]
nop dword [rax]
cmp r11, r13
jb 0x4e472b
mov r11, qword [rax]
sub rcx, r12
sub rdx, r12
lea rdi, [rdx + 1]
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and r13, rdx
lea rbx, [r11 + r13]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor r10d, r10d
call fcn.004e7080
test rax, rax
je 0x4e4721
add rsp, 0x60
pop rbp
nop
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x60
pop rbp
ret
mov rax, r13
mov rcx, r11
call fcn.00467820
mov rcx, r11
call fcn.004677e0
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.004e4600

Function at 0x4e47a0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4835
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rcx, qword [rax + 0x20]
cmp rcx, 1
je 0x4e47e7
nop dword [rax]
cmp rcx, 2
je 0x4e47cc
cmp rcx, 6
jne 0x4e4821
mov qword [rsp + 0x20], rax
call fcn.004e4220
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.004e42e0
jmp 0x4e4806
call fcn.004e9780
test rax, rax
je 0x4e481a
cmp dword [rax + 0x10], 0x778cdb8
jne 0x4e4806
lea rcx, [0x006a5b60]
cmp rax, rcx
je 0x4e481a
lea rax, [0x006b77a0]
lea rbx, [0x009d90e0]
add rsp, 0x10
pop rbp
ret
add rsp, 0x10
pop rbp
nop
ret
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004e47a0
Function at 0x4e92e0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9375
push rbp
mov rbp, rsp
sub rsp, 0x28
mov rcx, qword [rax + 0x20]
cmp rcx, 1
je 0x4e9356
mov qword [rsp + 0x38], rax
cmp rcx, 2
je 0x4e9334
cmp rcx, 6
jne 0x4e9361
call fcn.004e93a0
call fcn.0040b020
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x38]
call fcn.004e42e0
lea rax, [0x006a3fa0]
mov rbx, qword [rsp + 0x20]
jmp 0x4e935b
call fcn.004e9540
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.004e42e0
lea rax, [0x006b5120]
mov rbx, qword [rsp + 0x18]
jmp 0x4e935b
call fcn.004e9780
add rsp, 0x28
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.004e92e0

Function at 0x4e93a0
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4e950f
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x90], rax
xor ecx, ecx
lea rdx, [0x009d90e0]
xor ebx, ebx
jmp 0x4e93d5
mov rbx, rcx
mov rcx, rdx
mov rdx, rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x48], rcx
mov ebx, 9
call fcn.004e4380
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 8
nop dword [rax + rax]
je 0x4e94dd
call fcn.004e92e0
mov rcx, qword [rsp + 0x40]
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rdx, rcx
jb 0x4e9424
mov rsi, qword [rsp + 0x60]
jmp 0x4e945d
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov rbx, rcx
mov rcx, rdx
mov edi, 1
lea rsi, [0x006b0220]
call fcn.0044bd00
mov rsi, rax
mov rdx, rcx
mov rax, qword [rsp + 0x70]
mov rcx, rbx
mov rbx, qword [rsp + 0x78]
lea rdi, [rcx - 1]
shl rdi, 4
mov qword [rsi + rdi], rax
cmp dword [0x009d9570], 0
je 0x4e9483
call fcn.004673c0
mov qword [r11], rbx
mov r8, qword [rsi + rdi + 8]
mov qword [r11 + 8], r8
mov qword [rsi + rdi + 8], rbx
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 9
jne 0x4e94c7
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov ebx, 9
call fcn.004e4380
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rax + 0x20]
cmp rdi, 8
je 0x4e94ec
cmp rdi, 7
je 0x4e93cc
jmp 0x4e94fb
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rax, rsi
mov rbx, rcx
mov rcx, rdx
sub rsp, 0xffffffffffffff80
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007887b0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
nop
jmp fcn.004e93a0