joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52a2a0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x52a43b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
xor edx, edx
jmp 0x52a2d9
inc rdx
cmp rdx, rax
jge 0x52a3f1
movzx ebx, byte [rcx + rdx]
lea esi, [rbx - 0x61]
cmp sil, 0x19
ja 0x52a356
mov ebx, 1
test bl, bl
jne 0x52a2d6
mov qword [rsp + 0x28], 0
lea rax, [0x008b631c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2a
lea rax, [0x008f9bc0]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040d870
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea esi, [rbx - 0x41]
cmp sil, 0x19
ja 0x52a366
mov ebx, 1
jmp 0x52a2f4
lea esi, [rbx - 0x30]
cmp sil, 9
ja 0x52a379
mov ebx, 1
jmp 0x52a2f4
lea esi, [rbx - 0x27]
cmp sil, 2
ja 0x52a38c
mov ebx, 1
jmp 0x52a2f4
lea esi, [rbx - 0x2b]
cmp sil, 4
ja 0x52a39f
mov ebx, 1
jmp 0x52a2f4
cmp bl, 0x20
jne 0x52a3ae
mov ebx, 1
jmp 0x52a2f4
cmp bl, 0x3a
jne 0x52a3bd
mov ebx, 1
jmp 0x52a2f4
cmp bl, 0x3d
jne 0x52a3cc
mov ebx, 1
jmp 0x52a2f4
cmp bl, 0x3f
jne 0x52a3db
mov ebx, 1
jmp 0x52a2f4
cmp bl, 0x2a
jne 0x52a3ea
mov ebx, 1
jmp 0x52a2f4
xor ebx, ebx
jmp 0x52a2f4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x008fc2a0]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040dac0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00451b80
jmp fcn.0052a2a0

Function at 0x52a450
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x52a53f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
xor edx, edx
jmp 0x52a489
inc rdx
cmp rdx, rax
jge 0x52a4f5
movzx ebx, byte [rcx + rdx]
cmp bl, 0x7f
jbe 0x52a486
mov qword [rsp + 0x38], 0
lea rax, [0x008b34e2]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x24
lea rax, [0x008f9bc0]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040d870
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea rax, [0x008fc2a0]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040dac0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00451b80
jmp fcn.0052a450
Function at 0x52a550
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x52a654
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
xor edx, edx
jmp 0x52a589
inc rdx
cmp rdx, rax
jge 0x52a60a
movzx ebx, byte [rcx + rdx]
lea esi, [rbx - 0x30]
cmp sil, 9
ja 0x52a602
mov ebx, 1
test bl, bl
jne 0x52a586
mov qword [rsp + 0x38], 0
lea rax, [0x008b535f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x28
lea rax, [0x008f9bc0]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040d870
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp bl, 0x20
sete bl
jmp 0x52a5a0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea rax, [0x008fc2a0]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040dac0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.00451b80
jmp fcn.0052a550
Function at 0x52adf0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x52af6a
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x10], rdx
call fcn.00488af0
mov rax, qword [rsp + 0x18]
cmp rax, 0x270f
jbe 0x52aec3
mov qword [rsp + 0x50], 0
lea rax, [0x008b5427]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x28
lea rax, [0x008f9bc0]
mov qword [rsp], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 8], rax
call fcn.0040d870
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x98], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, qword [rsp + 0x68]
mov qword [rsp], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x10], rax
call fcn.0052a660
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.0052af80
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00451b80
jmp fcn.0052adf0
Function at 0x5490f0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x18]
cmp rax, qword [rcx + 0x10]
jbe 0x549360
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x549342
mov rax, qword [rsp + 0xa0]
test byte [rax], al
lea rcx, [rax + 0x10]
mov qword [rsp + 0x20], rcx
mov qword [rsp], rcx
call fcn.0045ba90
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x28]
test rcx, rcx
jne 0x549324
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x28], rcx
mov edx, dword [0x01636820]
lea rdi, [rax + 0x30]
test edx, edx
jne 0x549304
mov rdx, qword [rsp + 0xb8]
mov qword [rax + 0x30], rdx
mov rbx, qword [rax + 0x18]
lea rdi, [rax + 0x18]
test rbx, rbx
jne 0x5492ee
mov rbx, qword [0x010ed380]
mov esi, dword [0x01636820]
test esi, esi
jne 0x5492db
mov qword [rax + 0x18], rbx
mov rcx, qword [rax + 0x20]
lea rdi, [rsp + 0x30]
xorps xmm0, xmm0
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004546b1
mov rbp, qword [rbp]
lea rdx, [0x007fd340]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x10], rcx
call fcn.00407c00
mov rax, qword [rsp + 0xa0]
lea rdi, [rax + 0x20]
mov qword [rsp + 0x28], rdi
jmp 0x54925c
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
mov rax, qword [rax + 0x20]
mov byte [rsp + 8], 0
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x10], rdx
mov rbx, qword [rsp + 0xb8]
mov qword [rsp + 0x18], rbx
mov qword [rsp], rcx
call rax
lea rax, [rsp + 0x30]
mov qword [rsp], rax
call fcn.00407f00
mov rax, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x549211
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x5492d2
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0045bd90
movzx eax, byte [rsp + 0xa8]
test al, al
jne 0x5492a2
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
lea rcx, [0x008fa8e0]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00548d80
jmp 0x549292
xor eax, eax
call fcn.004544a0
jmp 0x549278
mov rsi, rax
mov rax, rbx
call fcn.004544a0
mov rax, rsi
jmp 0x5491bc
mov qword [rsp], rbx
call fcn.00403930
mov rax, qword [rsp + 0xa0]
jmp 0x5491bc
mov rdx, rax
mov rax, qword [rsp + 0xb8]
call fcn.004544a0
mov rax, rdx
mov rdx, qword [rsp + 0xb8]
jmp 0x549192
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0045bd90
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7600]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.005490f0
Function at 0x55c070
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x55c221
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x3f], xmm0
movups xmmword [rsp + 0x48], xmm0
mov rax, qword [rsp + 0x70]
cmp rax, 0x19
jge 0x55c210
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x3f]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
call fcn.00454d00
mov rax, qword [rsp + 0x30]
cmp rax, 0x19
ja 0x55c21a
lea rcx, [rsp + 0x3f]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x19
call fcn.00560920
lea rax, [0x007fed20]
mov qword [rsp], rax
mov rax, qword [0x010ee468]
mov qword [rsp + 8], rax
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
call fcn.00409d30
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x28]
mov rax, qword [rax]
test cl, cl
je 0x55c155
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
je 0x55c1f6
lea rax, [0x008229a0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x1d
mov eax, dword [0x01636820]
test eax, eax
jne 0x55c1e8
lea rcx, [0x008af11e]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rdi + 0x18], rcx
mov ecx, dword [0x01636820]
lea rdx, [rdi + 0x10]
test ecx, ecx
jne 0x55c1d0
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x10], rax
mov qword [rsp + 0x78], 0
lea rax, [0x008f9500]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rdi
mov rdi, rdx
mov rcx, rax
mov rax, qword [rsp + 0x68]
call fcn.004544a0
mov rdi, rcx
jmp 0x55c1a6
lea rax, [0x008af11e]
call fcn.004544a0
jmp 0x55c186
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, 0x19
jmp 0x55c0b4
call fcn.00429340
ud2
call fcn.00451b80
jmp fcn.0055c070
Function at 0x562150
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x562268
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
test byte [rax], al
mov qword [rsp], rax
mov qword [rsp + 8], 0xffff
mov qword [rsp + 0x10], 8
movzx ecx, byte [rsp + 0x58]
movzx ecx, cl
mov qword [rsp + 0x18], rcx
call fcn.00496ee0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
lea rdx, [0x008fa280]
cmp rdx, rcx
jne 0x5621c7
test rcx, rcx
jne 0x5621db
xor eax, eax
mov rcx, rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rax, [0x00823c60]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0xa
mov eax, dword [0x01636820]
test eax, eax
jne 0x56225a
lea rcx, [0x008981d7]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x10], rcx
mov ecx, dword [0x01636820]
lea rdx, [rdi + 0x18]
test ecx, ecx
jne 0x562242
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x18], rax
mov rax, rdi
lea rcx, [0x008f97e0]
jmp 0x5621c7
mov rax, rdi
mov rdi, rdx
mov rcx, rax
mov rax, qword [rsp + 0x38]
call fcn.004544a0
mov rdi, rcx
jmp 0x562236
lea rax, [0x008981d7]
call fcn.004544a0
jmp 0x562216
call fcn.00451b80
jmp fcn.00562150

Function at 0x562340
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x562446
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffff
mov qword [rsp + 0x10], 4
mov qword [rsp + 0x18], 1
call fcn.00470a90
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
test rax, rax
jne 0x5623b9
xor eax, eax
mov rcx, rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
lea rax, [0x00823c60]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0xa
mov eax, dword [0x01636820]
test eax, eax
jne 0x562438
lea rcx, [0x008981d7]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x10], rcx
mov ecx, dword [0x01636820]
lea rdx, [rdi + 0x18]
test ecx, ecx
jne 0x562420
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x18], rax
mov rax, rdi
lea rcx, [0x008f97e0]
jmp 0x5623a5
mov rax, rdi
mov rdi, rdx
mov rcx, rax
mov rax, qword [rsp + 0x38]
call fcn.004544a0
mov rdi, rcx
jmp 0x562414
lea rax, [0x008981d7]
call fcn.004544a0
jmp 0x5623f4
call fcn.00451b80
jmp fcn.00562340
Function at 0x564510
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x564628
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x50]
test byte [rax], al
mov qword [rsp], rax
mov qword [rsp + 8], 6
mov qword [rsp + 0x10], 1
movzx ecx, byte [rsp + 0x58]
movzx ecx, cl
mov qword [rsp + 0x18], rcx
call fcn.00496ee0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
lea rdx, [0x008fa280]
cmp rdx, rcx
jne 0x564587
test rcx, rcx
jne 0x56459b
xor eax, eax
mov rcx, rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rax, [0x00823c60]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0xa
mov eax, dword [0x01636820]
test eax, eax
jne 0x56461a
lea rcx, [0x008981d7]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x10], rcx
mov ecx, dword [0x01636820]
lea rdx, [rdi + 0x18]
test ecx, ecx
jne 0x564602
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x18], rax
mov rax, rdi
lea rcx, [0x008f97e0]
jmp 0x564587
mov rax, rdi
mov rdi, rdx
mov rcx, rax
mov rax, qword [rsp + 0x38]
call fcn.004544a0
mov rdi, rcx
jmp 0x5645f6
lea rax, [0x008981d7]
call fcn.004544a0
jmp 0x5645d6
call fcn.00451b80
jmp fcn.00564510
Function at 0x56da80
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x56db34
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e6a]
cmp al, 1
jbe 0x56dabd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x56dac6
call fcn.00429570
ud2
mov byte [0x01635e6a], 1
call fcn.0045ed10
call fcn.0051a5d0
lea rax, [0x008af898]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eed00], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x56db23
mov qword [0x010eed08], rcx
mov byte [0x01635e6a], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eed08]
mov rax, rcx
call fcn.004544a0
jmp 0x56db12
call fcn.00451b80
jmp fcn.0056da80

Function at 0x57eb50
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x57ed2f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e7a]
cmp al, 1
jbe 0x57eb8d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x57eb96
call fcn.00429570
ud2
mov byte [0x01635e7a], 1
call fcn.005061d0
call fcn.004514e0
call fcn.004f7b70
call fcn.004f50f0
call fcn.004fbc70
call fcn.004f1350
call fcn.00506d50
call fcn.0045ed10
call fcn.004cc830
call fcn.00521850
call fcn.0052e8e0
call fcn.0051a5d0
call fcn.00544f50
call fcn.00548250
call fcn.004dfae0
call fcn.0045cf30
call fcn.00478de0
call fcn.0053a6d0
call fcn.0046a650
call fcn.00568a00
call fcn.004eb320
call fcn.004bebd0
call fcn.004acaf0
call fcn.0048f3c0
call fcn.004f0940
call fcn.0056da80
call fcn.004fd9c0
call fcn.00501620
call fcn.0053ec90
call fcn.0056e100
lea rax, [0x008b32c7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eee00], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x57ed1b
mov qword [0x010eee08], rcx
lea rax, [0x008b96bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eee10], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x57ed0a
mov qword [0x010eee18], rcx
lea rax, [0x008bab01]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eedf0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x57ecf9
mov qword [0x010eedf8], rcx
mov byte [0x01635e7a], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eedf8]
mov rax, rcx
call fcn.004544a0
jmp 0x57ece8
lea rdi, [0x010eee18]
mov rax, rcx
call fcn.004544a0
jmp 0x57ecad
lea rdi, [0x010eee08]
mov rax, rcx
call fcn.004544a0
jmp 0x57ec72
call fcn.00451b80
jmp fcn.0057eb50
Function at 0x581b20
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x581bde
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635eff]
cmp al, 1
jbe 0x581b5d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x581b66
call fcn.00429570
ud2
mov byte [0x01635eff], 1
call fcn.004f50f0
call fcn.004e42c0
call fcn.00580020
lea rax, [0x008b8184]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2f
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efc90], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x581bcd
mov qword [0x010efc98], rcx
call fcn.005806b0
mov byte [0x01635eff], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010efc98]
mov rax, rcx
call fcn.004544a0
jmp 0x581bb7
call fcn.00451b80
jmp fcn.00581b20
Function at 0x5d0660
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5d086f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635f04]
cmp al, 1
jbe 0x5d069d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5d06a6
call fcn.00429570
ud2
mov byte [0x01635f04], 1
call fcn.0045ed10
call fcn.0046a650
call fcn.004dfae0
call fcn.0045cf30
lea rax, [0x008a8eac]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0045a2a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x010efcc0], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x5d085e
mov qword [0x010efcc8], rax
lea rax, [0x008a0ae2]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efcd0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d084a
mov qword [0x010efcd8], rcx
lea rax, [0x008aa3dd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efce0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d0836
mov qword [0x010efce8], rcx
lea rax, [0x008b2ddb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efcb0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d0825
mov qword [0x010efcb8], rcx
call fcn.005cf3a0
mov eax, dword [0x01636820]
mov rcx, qword [rsp]
test eax, eax
jne 0x5d0814
mov qword [0x010eebb8], rcx
call fcn.005d0290
mov eax, dword [0x01636820]
mov rcx, qword [rsp]
test eax, eax
jne 0x5d0803
mov qword [0x010eebc0], rcx
call fcn.005cf470
mov byte [0x01635f04], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eebc0]
mov rax, rcx
call fcn.004544a0
jmp 0x5d07ed
lea rdi, [0x010eebb8]
mov rax, rcx
call fcn.004544a0
jmp 0x5d07d3
lea rdi, [0x010efcb8]
mov rax, rcx
call fcn.004544a0
jmp 0x5d07b9
lea rdi, [0x010efce8]
mov rax, rcx
call fcn.004544a0
jmp 0x5d077e
lea rdi, [0x010efcd8]
mov rax, rcx
call fcn.004544a0
jmp 0x5d073f
lea rdi, [0x010efcc8]
call fcn.004544a0
jmp 0x5d0700
call fcn.00451b80
jmp fcn.005d0660
Function at 0x5d0ea0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5d1096
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635f09]
cmp al, 1
jbe 0x5d0edd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5d0ee6
call fcn.00429570
ud2
mov byte [0x01635f09], 1
call fcn.0046a650
call fcn.0045ed10
lea rax, [0x008b31f5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x010efd10], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x5d1085
mov qword [0x010efd18], rax
lea rax, [0x008afe1a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efd20], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d1071
mov qword [0x010efd28], rcx
lea rax, [0x008b7772]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efd00], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d105d
mov qword [0x010efd08], rcx
lea rax, [0x008b6dbf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efd30], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d104c
mov qword [0x010efd38], rcx
lea rax, [0x008b12c6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efd40], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x5d103b
mov qword [0x010efd48], rcx
mov byte [0x01635f09], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010efd48]
mov rax, rcx
call fcn.004544a0
jmp 0x5d102a
lea rdi, [0x010efd38]
mov rax, rcx
call fcn.004544a0
jmp 0x5d0fef
lea rdi, [0x010efd08]
mov rax, rcx
call fcn.004544a0
jmp 0x5d0fb4
lea rdi, [0x010efd28]
mov rax, rcx
call fcn.004544a0
jmp 0x5d0f75
lea rdi, [0x010efd18]
call fcn.004544a0
jmp 0x5d0f36
call fcn.00451b80
jmp fcn.005d0ea0