Function at 0x5dd040
Capabilities:
Run powershell expression

Disassembly:
lea r12, [rsp - 0x180]
cmp r12, qword [r14 + 0x10]
jbe 0x5dd7c6
push rbp
mov rbp, rsp
sub rsp, 0x1f8
mov rcx, qword [rax]
mov qword [rsp + 0x110], rcx
cmp byte [rax + 0x70], 0
je 0x5dd142
mov rdx, qword [rcx + 0x50]
cmp qword [rdx + 0x58], 0
je 0x5dd0fa
mov rax, rcx
call fcn.005d3c00
lea rdi, [rsp + 0x148]
mov rsi, rsp
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467da6
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rcx + 0x50]
mov rdx, qword [rdx + 0x58]
mov rbx, qword [rdx]
mov rdi, rsp
lea rsi, [rsp + 0x148]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00467da6
mov rbp, qword [rbp]
call rbx
test rax, rax
jne 0x5dd107
xor eax, eax
xor ebx, ebx
add rsp, 0x1f8
pop rbp
ret
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x110]
mov ebx, 0x2a
call fcn.005cf280
mov rax, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xf8]
add rsp, 0x1f8
pop rbp
ret
mov qword [rsp + 0x208], rax
mov rbx, qword [rax + 0x80]
mov rcx, qword [rax + 0x88]
mov qword [rsp + 0x120], rcx
lea rax, [0x006bbd00]
call fcn.0040b0e0
mov rbx, rax
mov rcx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x110]
nop
call fcn.005d0760
test rcx, rcx
jne 0x5dd4f2
lea rdx, [0x006bbf00]
cmp rax, rdx
jne 0x5dd19f
mov rcx, rbx
jmp 0x5dd1a7
mov rcx, rbx
mov ebx, 0
jne 0x5dd234
cmp dword [0x009d9570], 0
jne 0x5dd1c2
mov rcx, qword [rsp + 0x208]
nop
jmp 0x5dd1da
call fcn.004673c0
mov qword [r11], rbx
mov rcx, qword [rsp + 0x208]
mov rdx, qword [rcx + 0x68]
mov qword [r11 + 8], rdx
mov qword [rcx + 0x68], rbx
mov rbx, qword [rcx + 0x80]
mov rdx, qword [rcx + 0x88]
mov qword [rsp + 0x120], rdx
lea rax, [0x006bbd00]
nop dword [rax + rax]
call fcn.0040b0e0
mov rbx, rax
mov rcx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x110]
call fcn.005d0760
nop dword [rax]
test rcx, rcx
je 0x5dd237
mov rax, rcx
mov rbx, rdi
add rsp, 0x1f8
pop rbp
ret
mov rbx, rcx
lea rdx, [0x006bbf80]
nop
cmp rax, rdx
jne 0x5dd24a
mov rcx, rbx
jmp 0x5dd252
mov rcx, rbx
mov ebx, 0
jne 0x5dd44d
cmp qword [rbx + 0x20], 0
nop dword [rax]
je 0x5dd40a
mov rdx, qword [rbx + 0x78]
mov rsi, qword [rbx + 0x80]
mov r8, qword [rbx + 0x70]
mov rax, qword [rsp + 0x110]
mov qword [rax + 0x88], rdx
mov qword [rax + 0x90], rsi
cmp dword [0x009d9570], 0
je 0x5dd2a7
call fcn.004673c0
mov qword [r11], r8
mov rdx, qword [rax + 0x80]
mov qword [r11 + 8], rdx
mov qword [rax + 0x80], r8
mov rdx, qword [rbx + 0x60]
mov rsi, qword [rbx + 0x68]
mov r8, qword [rbx + 0x58]
mov qword [rax + 0x70], rdx
mov qword [rax + 0x78], rsi
cmp dword [0x009d9570], 0
je 0x5dd2db
call fcn.004673c0
mov qword [r11], r8
mov rdx, qword [rax + 0x68]
mov qword [r11 + 8], rdx
mov qword [rax + 0x68], r8
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x20]
mov rdi, qword [rbx + 0x28]
mov rbx, rdx
call fcn.005d94e0
test rax, rax
jne 0x5dd401
mov rax, qword [rsp + 0x110]
xor ebx, ebx
xor ecx, ecx
call fcn.005d0760
test rcx, rcx
jne 0x5dd3f2
lea rcx, [0x006bbe00]
nop dword [rax]
cmp rax, rcx
jne 0x5dd32a
mov rdx, rbx
jmp 0x5dd332
mov rdx, rbx
mov ebx, 0
mov qword [rsp + 0x100], rbx
jne 0x5dd355
movzx eax, word [rbx + 0x1a]
mov rcx, qword [0x0096d640]
mov rdx, qword [0x0096d648]
xor esi, esi
jmp 0x5dd504
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x118], rdx
mov rax, qword [rsp + 0x110]
mov ebx, 0xa
call fcn.005cf280
movups xmmword [rsp + 0x128], xmm15
movups xmmword [rsp + 0x138], xmm15
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x128], rcx
mov rcx, qword [rsp + 0x118]
mov qword [rsp + 0x130], rcx
lea rcx, [0x006bbe00]
mov qword [rsp + 0x138], rcx
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x140], rcx
lea rax, [0x0071e48d]
mov ebx, 0x49
lea rcx, [rsp + 0x128]
mov edi, 2
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x1f8
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x1f8
pop rbp
ret
add rsp, 0x1f8
pop rbp
ret
mov rax, qword [rsp + 0x110]
mov ebx, 0x32
call fcn.005cf280
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x28
lea rcx, [0x00718188]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x1f8
pop rbp
ret
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x108], rbx
mov rax, qword [rsp + 0x110]
mov ebx, 0xa
call fcn.005cf280
movups xmmword [rsp + 0x128], xmm15
movups xmmword [rsp + 0x138], xmm15
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x128], rcx
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x130], rcx
lea rcx, [0x006bbf80]
mov qword [rsp + 0x138], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x140], rcx
lea rax, [0x0071e48d]
mov ebx, 0x49
lea rcx, [rsp + 0x128]
mov edi, 2
mov rsi, rdi
call fcn.004ccb40
add rsp, 0x1f8
pop rbp
ret
mov rax, rcx
mov rbx, rdi
add rsp, 0x1f8
pop rbp
ret
inc rsi
cmp rsi, rdx
jge 0x5dd76e
movzx edi, word [rcx + rsi*2]
cmp di, ax
jne 0x5dd501
call fcn.005c6fe0
nop dword [rax + rax]
test rcx, rcx
jne 0x5dd74e
cmp al, 0xe1
je 0x5dd533
cmp rbx, 3
jne 0x5dd576
mov rax, qword [rsp + 0x110]
mov ebx, 0x2f
call fcn.005cf280
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c281]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x1f8
pop rbp
ret
mov byte [rsp + 0xbf], al
mov qword [rsp + 0xc8], rbx
mov rdx, qword [rsp + 0x208]
mov rdi, qword [rdx + 0x80]
mov rsi, qword [rdx + 0x88]
mov rax, rbx
lea rbx, [0x00715407]
mov ecx, 0x22
call fcn.005c6e00
mov rdx, qword [rsp + 0x110]
cmp qword [rdx + 0xa0], 0
nop
jbe 0x5dd7b6
mov r10, qword [rdx + 0x98]
mov r10, qword [r10]
mov r11, qword [r10 + 0xa0]
mov r10, qword [r10 + 0xa8]
mov r12, qword [rsp + 0x100]
mov r13, qword [r12 + 0x20]
mov r15, qword [r12 + 0x28]
mov rsi, qword [r12 + 0x30]
mov qword [rsp], r13
mov qword [rsp + 8], r15
mov qword [rsp + 0x10], rsi
mov rdi, qword [rsp + 0xc8]
mov rsi, rax
mov r8, rbx
mov r9, rcx
movzx eax, byte [rsp + 0xbf]
mov rbx, r11
mov rcx, r10
call fcn.005c6a20
test rax, rax
je 0x5dd6ea
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x110]
mov ebx, 0x33
call fcn.005cf280
mov rcx, qword [rsp + 0xd8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0xf0]
call rcx
mov ecx, 0x32
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x0071b582]
nop dword [rax]
call fcn.0044faa0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xe8], rax
lea rax, [0x006c0560]
nop dword [rax]
call fcn.0040d7c0
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 8], rcx
cmp dword [0x009d9570], 0
jne 0x5dd6c4
mov rcx, qword [rsp + 0xe8]
jmp 0x5dd6d4
call fcn.004673a0
mov rcx, qword [rsp + 0xe8]
mov qword [r11], rcx
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x1f8
pop rbp
ret
mov rcx, qword [rsp + 0x208]
mov rbx, qword [rcx + 0x80]
mov rcx, qword [rcx + 0x88]
mov qword [rsp + 0x120], rcx
lea rax, [0x006bbd00]
call fcn.0040b0e0
mov rbx, qword [rsp + 0x100]
mov rcx, rax
mov rdi, qword [rsp + 0x120]
lea rax, [0x0078b3f8]
call fcn.005f3900
test rax, rax
je 0x5dd741
add rsp, 0x1f8
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x1f8
pop rbp
ret
mov rax, qword [rsp + 0x110]
mov ebx, 0x50
nop dword [rax + rax]
call fcn.005cf280
add rsp, 0x1f8
pop rbp
ret
mov rax, qword [rsp + 0x110]
mov ebx, 0x2f
nop dword [rax + rax]
call fcn.005cf280
lea rax, [0x006c0560]
call fcn.0040d7c0
mov qword [rax + 8], 0x36
lea rcx, [0x0071c281]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00789ac0]
add rsp, 0x1f8
pop rbp
ret
xor eax, eax
mov rcx, rax
nop dword [rax + rax]
call fcn.00467760
nop
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.005dd040