joyce8/EMBER2024-capa huggingface dataset:
Function at 0x626c20
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x626d01
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635ecb]
cmp al, 1
jbe 0x626c5d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x626c66
call fcn.00429570
ud2
mov byte [0x01635ecb], 1
call fcn.0046a650
call fcn.0054a220
call fcn.0045ed10
call fcn.004a0040
call fcn.004ce820
call fcn.004514e0
call fcn.004acaf0
call fcn.004cc830
call fcn.0045cf30
call fcn.00478de0
lea rax, [0x008b2cc3]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efb60], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x626cf0
mov qword [0x010efb68], rcx
call fcn.00625c60
mov byte [0x01635ecb], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010efb68]
mov rax, rcx
call fcn.004544a0
jmp 0x626cda
call fcn.00451b80
jmp fcn.00626c20
Function at 0x6327c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6328ea
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
jmp 0x632805
add rax, 2
lea ecx, [r9 + 1]
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jge 0x632889
lea r8, [rax + 1]
cmp r8, rdi
jae 0x6328e3
mov r8, qword [rsp + 0x70]
mov r9d, dword [r8 + rax*4 + 4]
cmp rax, rdi
jae 0x6328e3
mov r10d, dword [r8 + rax*4]
dec r10d
cmp ecx, r10d
jg 0x6327fd
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call fcn.00632210
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x6327fd
cmp ecx, 0x10ffff
jle 0x6328b3
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rsi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.00632210
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
jmp 0x632891
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.006327c0
Function at 0x632900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x632b27
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax]
xor ebx, ebx
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
jmp 0x6329be
mov dword [rsp + 0x38], r9d
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r9d
call fcn.00632210
mov eax, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x4c]
lea r9d, [r11 + rax]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x48]
cmp r9d, r10d
jle 0x632958
add rdx, 6
inc rbx
cmp rbx, rcx
jge 0x632a32
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rdx
movzx r9d, word [rdx]
movzx r10d, word [rdx + 2]
movzx r11d, word [rdx + 4]
cmp r11d, 1
je 0x6329ed
mov dword [rsp + 0x4c], r11d
mov dword [rsp + 0x48], r10d
jmp 0x6329b2
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r10d
call fcn.00632210
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
jmp 0x6329b7
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x632a9e
mov dword [rsp + 0x3c], ebx
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], ebx
mov dword [rsp + 0x1c], ebx
call fcn.00632210
mov eax, dword [rsp + 0x3c]
mov r10d, dword [rsp + 0x40]
lea ebx, [r10 + rax]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x44]
cmp ebx, r9d
jle 0x632a43
add rcx, 0xc
inc rdx
cmp rdx, rax
jge 0x632b05
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rcx
mov ebx, dword [rcx]
mov r9d, dword [rcx + 4]
mov r10d, dword [rcx + 8]
cmp r10d, 1
je 0x632ac9
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r10d
jmp 0x632a92
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], ebx
mov dword [rsp + 0x1c], r9d
call fcn.00632210
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x632a97
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
call fcn.00451b80
jmp fcn.00632900
Function at 0x647310
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x64751d
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movzx eax, byte [0x01635ec5]
cmp al, 1
jbe 0x64734d
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
jne 0x647356
call fcn.00429570
ud2
mov byte [0x01635ec5], 1
call fcn.004dfae0
call fcn.00568a00
call fcn.006192d0
call fcn.004eb320
call fcn.004c51b0
call fcn.004cc830
call fcn.0045cf30
call fcn.0048f3c0
lea rax, [0x008b63c4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efac0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x647509
mov qword [0x010efac8], rcx
lea rax, [0x008b6f48]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efad0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6474f5
mov qword [0x010efad8], rcx
lea rax, [0x008b698c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efae0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6474e1
mov qword [0x010efae8], rcx
mov qword [rsp], 0x270f
mov qword [rsp + 8], 0xc
mov qword [rsp + 0x10], 0x1f
mov qword [rsp + 0x18], 0x17
mov qword [rsp + 0x20], 0x3b
mov qword [rsp + 0x28], 0x3b
mov qword [rsp + 0x30], 0
mov rax, qword [0x010e3370]
mov qword [rsp + 0x38], rax
call fcn.0048a340
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov qword [0x010efff0], rax
mov qword [0x010efff8], rcx
mov eax, dword [0x01636820]
test eax, eax
jne 0x6474d0
mov qword [0x010f0000], rdx
mov byte [0x01635ec5], 2
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rdi, [0x010f0000]
mov rax, rdx
call fcn.004544a0
jmp 0x6474bf
lea rdi, [0x010efae8]
mov rax, rcx
call fcn.004544a0
jmp 0x647442
lea rdi, [0x010efad8]
mov rax, rcx
call fcn.004544a0
jmp 0x647403
lea rdi, [0x010efac8]
mov rax, rcx
call fcn.004544a0
jmp 0x6473c4
call fcn.00451b80
jmp fcn.00647310

Function at 0x648030
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x648095
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
lea rax, [0x008b3332]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x24
call fcn.006480a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00451b80
jmp fcn.00648030
Function at 0x648530
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x78]
cmp rax, qword [rcx + 0x10]
jbe 0x64870c
sub rsp, 0xf8
mov qword [rsp + 0xf0], rbp
lea rbp, [rsp + 0xf0]
mov rax, qword [0x008f6ad0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x60]
mov qword [rsp], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x10], rax
call fcn.00441500
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rcx
xor edx, edx
mov rbx, rdx
mov rsi, rbx
xor edi, edi
jmp 0x648632
mov qword [rsp], 0
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.004410b0
mov rax, qword [rsp + 0x48]
lea rdx, [rax + 1]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea rbx, [rax + 1]
mov rcx, rbx
sar rbx, 0x3f
shr rbx, 0x3d
lea rax, [rbx + rax + 1]
sar rax, 3
shl rax, 3
sub rcx, rax
mov rax, qword [rsp + 0xe8]
mov rbx, rcx
mov rcx, qword [rsp + 0x50]
cmp rdx, rcx
jge 0x6486cd
mov r8d, dword [rax + rdx*4]
cmp rbx, 8
jae 0x648705
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rbx
movzx eax, byte [rsp + rbx + 0x58]
xor r8d, eax
movzx eax, r8b
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.004a94b0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
cmp rcx, 1
jne 0x6485bd
mov qword [rsp], 0
lea rdx, [0x0088ae5e]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 1
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
call fcn.004410b0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
jmp 0x6485bd
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
call fcn.00649bd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rcx
mov rbp, qword [rsp + 0xf0]
add rsp, 0xf8
ret
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.00648530
Function at 0x649d40
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x649e78
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635ef5]
cmp al, 1
jbe 0x649d7d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x649d86
call fcn.00429570
ud2
mov byte [0x01635ef5], 1
call fcn.004f02c0
call fcn.004f1350
call fcn.005b3800
call fcn.004e6470
call fcn.004e42c0
call fcn.004dfae0
call fcn.005b5d60
call fcn.0045ed10
call fcn.004cf250
call fcn.004e1470
call fcn.004a1970
call fcn.004ecc10
call fcn.00568a00
call fcn.006192d0
call fcn.004eb320
call fcn.004a0040
call fcn.00626c20
call fcn.004ce820
call fcn.006439c0
call fcn.004514e0
call fcn.004acaf0
call fcn.004cc830
call fcn.0045cf30
call fcn.0048f3c0
call fcn.0046a650
call fcn.005bcc60
call fcn.00647310
call fcn.00460de0
lea rax, [0x00898a82]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.006478e0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010efc08], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x649e6a
mov qword [0x010efc00], rax
call fcn.00647810
mov byte [0x01635ef5], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010efc00]
call fcn.004544a0
jmp 0x649e54
call fcn.00451b80
jmp fcn.00649d40
Function at 0x678d00
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x678ecf
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e7d]
cmp al, 1
jbe 0x678d3d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x678d46
call fcn.00429570
ud2
mov byte [0x01635e7d], 1
call fcn.0054a220
call fcn.004bebd0
call fcn.004dfae0
call fcn.004acaf0
call fcn.0048f3c0
lea rax, [0x008b9dbd]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eeeb0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x678ebb
mov qword [0x010eeeb8], rcx
lea rax, [0x008a8dfc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x16
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eee90], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x678ea7
mov qword [0x010eee98], rcx
lea rax, [0x008b239e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eeea0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x678e93
mov qword [0x010eeea8], rcx
mov rax, qword [0x008f6860]
lea rcx, [0x007c9420]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004b3720
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, qword [rax + 0x48]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [0x010eeec0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x678e82
mov qword [0x010eeec8], rcx
mov byte [0x01635e7d], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eeec8]
mov rax, rcx
call fcn.004544a0
jmp 0x678e71
lea rdi, [0x010eeea8]
mov rax, rcx
call fcn.004544a0
jmp 0x678e1f
lea rdi, [0x010eee98]
mov rax, rcx
call fcn.004544a0
jmp 0x678de4
lea rdi, [0x010eeeb8]
mov rax, rcx
call fcn.004544a0
jmp 0x678da5
call fcn.00451b80
jmp fcn.00678d00
Function at 0x67dc10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x67dddb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x01636830]
mov qword [rsp], rax
call fcn.0045cae0
lea rax, [0x01636830]
mov qword [rsp + 0x10], rax
mov dword [rsp], 8
lea rax, [0x008c5c58]
mov qword [rsp + 8], rax
call fcn.004295c0
test eax, eax
jne 0x67dd2f
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x67ddbd
lea rax, [0x007fe9c0]
mov qword [rsp], rax
mov rcx, qword [0x010ed3e8]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
call fcn.00409d30
movzx eax, byte [rsp + 0x28]
test al, al
jne 0x67dd3f
lea rax, [0x007fe9c0]
mov qword [rsp], rax
mov rax, qword [0x010ed3e8]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
call fcn.0040ab60
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov ecx, dword [0x01636820]
lea rdi, [rax + 8]
test ecx, ecx
jne 0x67dd23
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
nop
call fcn.00429ed0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x70]
call fcn.004544a0
jmp 0x67dd13
nop
call fcn.00429ed0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], 0
lea rax, [0x008b46c4]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x26
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.004410b0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f78f0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.0067dc10
Function at 0x6a6290
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6a6486
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635ea3]
cmp al, 1
jbe 0x6a62cd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x6a62d6
call fcn.00429570
ud2
mov byte [0x01635ea3], 1
call fcn.0046a650
call fcn.0045ed10
lea rax, [0x008b31f5]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x010ef4a0], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x6a6475
mov qword [0x010ef4a8], rax
lea rax, [0x008afe1a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef4b0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6a6461
mov qword [0x010ef4b8], rcx
lea rax, [0x008b7772]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef490], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6a644d
mov qword [0x010ef498], rcx
lea rax, [0x008b6dbf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef4c0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6a643c
mov qword [0x010ef4c8], rcx
lea rax, [0x008b12c6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef4d0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6a642b
mov qword [0x010ef4d8], rcx
mov byte [0x01635ea3], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010ef4d8]
mov rax, rcx
call fcn.004544a0
jmp 0x6a641a
lea rdi, [0x010ef4c8]
mov rax, rcx
call fcn.004544a0
jmp 0x6a63df
lea rdi, [0x010ef498]
mov rax, rcx
call fcn.004544a0
jmp 0x6a63a4
lea rdi, [0x010ef4b8]
mov rax, rcx
call fcn.004544a0
jmp 0x6a6365
lea rdi, [0x010ef4a8]
call fcn.004544a0
jmp 0x6a6326
call fcn.00451b80
jmp fcn.006a6290
Function at 0x6aa0c0
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6aa2a6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e91]
cmp al, 1
jbe 0x6aa0fd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x6aa106
call fcn.00429570
ud2
mov byte [0x01635e91], 1
call fcn.004dfae0
call fcn.00478de0
lea rax, [0x0089bf62]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0046c6e0
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x10]
test eax, eax
jne 0x6aa292
mov qword [0x010ed538], rcx
mov qword [rsp], rcx
lea rax, [0x00898985]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0xb
call fcn.0046c620
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x18]
test eax, eax
jne 0x6aa27e
mov qword [0x010ed540], rcx
mov rax, qword [0x010ed538]
mov qword [rsp], rax
lea rax, [0x008aa5ea]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x18
call fcn.0046c620
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x18]
test eax, eax
jne 0x6aa26a
mov qword [0x010ed548], rcx
mov rax, qword [0x010ed538]
mov qword [rsp], rax
lea rax, [0x008a1e2a]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0xf
call fcn.0046c620
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x18]
test eax, eax
jne 0x6aa259
mov qword [0x010ed550], rcx
mov rax, qword [0x010ed538]
mov qword [rsp], rax
lea rax, [0x0089f68a]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0xe
call fcn.0046c620
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x18]
test eax, eax
jne 0x6aa248
mov qword [0x010ed558], rcx
mov byte [0x01635e91], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010ed558]
mov rax, rcx
call fcn.004544a0
jmp 0x6aa237
lea rdi, [0x010ed550]
mov rax, rcx
call fcn.004544a0
jmp 0x6aa1fc
lea rdi, [0x010ed548]
mov rax, rcx
call fcn.004544a0
jmp 0x6aa1c1
lea rdi, [0x010ed540]
mov rax, rcx
call fcn.004544a0
jmp 0x6aa182
lea rdi, [0x010ed538]
mov rax, rcx
call fcn.004544a0
jmp 0x6aa14a
call fcn.00451b80
jmp fcn.006aa0c0

Function at 0x6acc50
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6accf3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
cmp rax, 0x10
jg 0x6accd5
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x58]
test byte [rcx], al
cmp rax, 0x10
jge 0x6accce
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00454d00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov eax, 0x10
jmp 0x6accac
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7a60]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.006acc50
Function at 0x6acd00
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6acdf9
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x007fd4c0]
mov qword [rsp], rax
mov rcx, qword [0x010ed450]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x10], rcx
call fcn.00409730
movzx eax, byte [rsp + 0x20]
test al, al
jne 0x6acddb
lea rax, [0x007fd4c0]
mov qword [rsp], rax
mov rax, qword [0x010ed450]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
call fcn.0040a4e0
mov rdi, qword [rsp + 0x18]
mov rax, qword [rsp + 0x48]
mov qword [rdi + 8], rax
mov eax, dword [0x01636820]
lea rcx, [rdi + 0x10]
test eax, eax
jne 0x6acdc2
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x40]
call fcn.004544a0
mov rdi, rcx
mov rax, qword [rsp + 0x50]
call fcn.004544a0
jmp 0x6acdae
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7a70]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.006acd00

Function at 0x6ad370
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6ad46d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x60], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jg 0x6ad44f
cmp rcx, 0x10
jg 0x6ad44f
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x78]
test byte [rdx], al
cmp rax, 0x10
jge 0x6ad448
mov qword [rsp], rdx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00454d00
lea rax, [rsp + 0x88]
test byte [rax], al
mov rcx, qword [rsp + 0x50]
cmp rcx, 0x10
jge 0x6ad441
mov qword [rsp], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
call fcn.00454d00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov ecx, 0x10
jmp 0x6ad41f
mov eax, 0x10
jmp 0x6ad3f2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f7a80]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.006ad370