joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ed10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45eff7
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635eb1]
cmp al, 1
jbe 0x45ed4d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x45ed56
call fcn.00429570
ud2
mov byte [0x01635eb1], 1
call fcn.0045cf30
lea rax, [0x0089a4ad]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0045a2a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x010ef580], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x45efe6
mov qword [0x010ef588], rax
lea rax, [0x0089c706]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0045a2a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x010ef570], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x45efd5
mov qword [0x010ef578], rax
lea rax, [0x0088b185]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef540], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x45efc1
mov qword [0x010ef548], rcx
lea rax, [0x008a1500]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef590], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x45efad
mov qword [0x010ef598], rcx
lea rax, [0x008b6ae4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef560], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x45ef99
mov qword [0x010ef568], rcx
lea rax, [0x008a6feb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef5b0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x45ef85
mov qword [0x010ef5b8], rcx
lea rax, [0x008a6fd7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef5a0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x45ef74
mov qword [0x010ef5a8], rcx
lea rax, [0x008aec79]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef550], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x45ef63
mov qword [0x010ef558], rcx
mov byte [0x01635eb1], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010ef558]
mov rax, rcx
call fcn.004544a0
jmp 0x45ef52
lea rdi, [0x010ef5a8]
mov rax, rcx
call fcn.004544a0
jmp 0x45ef17
lea rdi, [0x010ef5b8]
mov rax, rcx
call fcn.004544a0
jmp 0x45eedc
lea rdi, [0x010ef568]
mov rax, rcx
call fcn.004544a0
jmp 0x45ee9d
lea rdi, [0x010ef598]
mov rax, rcx
call fcn.004544a0
jmp 0x45ee5e
lea rdi, [0x010ef548]
mov rax, rcx
call fcn.004544a0
jmp 0x45ee1f
lea rdi, [0x010ef578]
call fcn.004544a0
jmp 0x45ede0
lea rdi, [0x010ef588]
call fcn.004544a0
jmp 0x45eda1
call fcn.00451b80
jmp fcn.0045ed10
Function at 0x46a650
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46a75a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e61]
cmp al, 1
jbe 0x46a68d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x46a696
call fcn.00429570
ud2
mov byte [0x01635e61], 1
call fcn.0045ed10
call fcn.00460de0
call fcn.00466a10
lea rax, [0x008a9c0c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eec90], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x46a749
mov qword [0x010eec98], rcx
lea rax, [0x008ba693]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eeca0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x46a738
mov qword [0x010eeca8], rcx
call fcn.00469870
mov byte [0x01635e61], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010eeca8]
mov rax, rcx
call fcn.004544a0
jmp 0x46a722
lea rdi, [0x010eec98]
mov rax, rcx
call fcn.004544a0
jmp 0x46a6e7
call fcn.00451b80
jmp fcn.0046a650

Function at 0x46f690
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x46f71c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0046f730
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x46f6fe
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8840]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.0046f690
Function at 0x487ad0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x487b40
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x487b22
add rax, 8
mov qword [rsp], rax
call fcn.00445b00
movzx eax, byte [rsp + 8]
mov byte [rsp + 0x28], al
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8880]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.00487ad0

Function at 0x487c90
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x487d4b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x487d2d
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.00487a50
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x38]
lea rdx, [rcx + 8]
mov qword [rsp + 0x20], rdx
mov qword [rsp], rdx
call fcn.00445b00
movzx eax, byte [rsp + 8]
mov byte [rsp + 0x17], al
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00445ab0
movzx eax, byte [rsp + 0x17]
mov byte [rsp + 0x48], al
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8890]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.00487c90
Function at 0x492da0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x492e77
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
test rax, rax
jne 0x492e2f
lea rax, [0x00810ba0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x21
mov eax, dword [0x01636820]
test eax, eax
jne 0x492e21
lea rax, [0x008b1ed8]
mov qword [rdi], rax
lea rax, [0x008f8f20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008b1ed8]
call fcn.004544a0
jmp 0x492e06
mov qword [rsp], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.00425a20
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 8], al
call fcn.00492ef0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00451b80
jmp fcn.00492da0
Function at 0x497540
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4976ac
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635eab]
cmp al, 1
jbe 0x49757d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x497586
call fcn.00429570
ud2
mov byte [0x01635eab], 1
call fcn.0045cf30
call fcn.00478de0
call fcn.0048f3c0
call fcn.0045ed10
call fcn.004910b0
call fcn.004514e0
lea rax, [0x008b1366]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef4f0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x497698
mov qword [0x010ef4f8], rcx
lea rax, [0x008a5796]
mov qword [rsp], rax
mov qword [rsp + 8], 0x12
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef4e0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x497687
mov qword [0x010ef4e8], rcx
lea rax, [0x008b2ce6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef500], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x497676
mov qword [0x010ef508], rcx
call fcn.004935b0
mov byte [0x01635eab], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010ef508]
mov rax, rcx
call fcn.004544a0
jmp 0x497660
lea rdi, [0x010ef4e8]
mov rax, rcx
call fcn.004544a0
jmp 0x497625
lea rdi, [0x010ef4f8]
mov rax, rcx
call fcn.004544a0
jmp 0x4975ea
call fcn.00451b80
jmp fcn.00497540
Function at 0x4a6300
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a640a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx + 0x15c]
sar rdx, 3
jmp 0x4a6377
mov rdx, rax
cmp rdx, 0x57
jae 0x4a6403
lea rax, [rdx + rdx*2]
lea rbx, [0x00b14400]
mov rdi, qword [rbx + rax*8 + 8]
mov r8, rax
shl rax, 3
lea r9, [rsi + rdi + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x4a63a9
lea rax, [rdx + 1]
jmp 0x4a6374
cmp r9, 0xffffffffffffffe0
jle 0x4a63b5
lea rax, [rdx - 1]
jmp 0x4a6374
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx + r8*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
mov qword [rsp], rcx
call fcn.004a5fc0
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.004a6300
Function at 0x4a68c0
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4a6a21
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
shl rax, cl
cmp rcx, 0x40
sbb rdx, rdx
and rax, rdx
mov rdx, qword [rsp + 0x28]
cmp rdx, rax
ja 0x4a6a03
mov rcx, qword [rsp + 0x40]
mov rbx, rcx
shl rcx, 1
cmp rcx, rax
ja 0x4a69e5
lea rcx, [rdx + rbx]
shl rcx, 1
cmp rcx, rax
jb 0x4a69c1
sub rdx, rbx
shl rdx, 1
cmp rdx, rax
jbe 0x4a69b2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
dec rcx
jmp 0x4a6952
add qword [rax + 0x18], 0xffffffffffffffff
dec rcx
test rcx, rcx
jl 0x4a696f
mov rdx, qword [rax + 8]
mov rbx, qword [rax]
cmp rcx, rdx
jae 0x4a69de
movzx edx, byte [rcx + rbx]
cmp dl, 0x39
je 0x4a694a
test rcx, rcx
jge 0x4a699b
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
jbe 0x4a69d7
mov byte [rcx], 0x31
mov qword [rax + 0x18], 1
inc qword [rax + 0x20]
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rdx, qword [rax]
mov rax, qword [rax + 8]
cmp rcx, rax
jae 0x4a69d0
movzx eax, byte [rcx + rdx]
inc eax
mov byte [rdx + rcx], al
jmp 0x4a698c
mov byte [rsp + 0x48], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov byte [rsp + 0x48], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004292d0
ud2
call fcn.004292d0
ud2
call fcn.004292d0
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8760]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8750]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004a68c0
Function at 0x4aea50
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4aecab
sub rsp, 0x80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [rsp + 0xa8]
bt eax, 9
jae 0x4aec8d
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0x4f], dl
mov qword [rsp], rcx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rax
call fcn.004bb220
mov rax, qword [rsp + 0xa8]
and rax, 0x1e0
movzx edx, byte [rsp + 0x4f]
and edx, 0x1f
or rdx, rax
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
lea rsi, [0x00904b80]
cmp rbx, rsi
jne 0x4aec6a
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x70], rax
lea rcx, [0x008c5868]
test byte [rcx], al
mov rcx, qword [0x008c5868]
mov qword [rsp + 0x58], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004b6c60
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
lea rcx, [0x00846de0]
mov qword [rsp], rcx
call fcn.00410220
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
mov ecx, dword [0x01636820]
lea rdi, [rax + 8]
test ecx, ecx
jne 0x4aec55
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xa8]
sar rcx, 0xa
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x28], rcx
mov ecx, dword [0x01636820]
lea rbx, [rax + 0x20]
lea rdi, [rax + 0x18]
test ecx, ecx
jne 0x4aec27
mov rcx, qword [rsp + 0x98]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rax + 0x20], rcx
mov qword [rsp + 0x68], rax
mov rdx, qword [rax + 0x28]
mov rbx, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0x88]
mov qword [rsp], rsi
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
call fcn.004b8790
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa8]
and rax, 0x60
or rax, 0x13
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x78]
add rsp, 0x80
ret
mov rcx, rax
mov rax, qword [rsp + 0x98]
call fcn.004544a0
mov rdi, rbx
mov rax, qword [rsp + 0xa0]
call fcn.004544a0
mov rbx, rax
mov rax, rcx
mov rcx, rbx
jmp 0x4aeba5
mov rcx, rax
mov rax, qword [rsp + 0x60]
call fcn.004544a0
mov rax, rcx
jmp 0x4aeb5e
mov qword [rsp], rbx
lea rax, [0x00880fc0]
mov qword [rsp + 8], rax
lea rax, [0x0086fb00]
mov qword [rsp + 0x10], rax
call fcn.0040d3b0
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8030]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004aea50
Function at 0x4b1030
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b1097
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
jne 0x4b1079
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8230]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b1030

Function at 0x4b1120
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b126c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x12
ja 0x4b11be
cmp rcx, 0x11
jne 0x4b118a
mov rax, qword [rax + 0x30]
test rax, rax
je 0x4b1184
lea rcx, [0x00904b80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4b1170
cmp rcx, 0x12
jne 0x4b124e
mov rax, qword [rax + 0x30]
test rax, rax
je 0x4b11b8
lea rcx, [0x00904b80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4b11a4
cmp rcx, 0x15
jne 0x4b11ee
mov rax, qword [rax + 0x38]
test rax, rax
je 0x4b11e8
lea rcx, [0x00904b80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4b11d4
cmp rcx, 0x16
jne 0x4b121e
mov rax, qword [rax + 0x30]
test rax, rax
je 0x4b1218
lea rcx, [0x00904b80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4b1204
cmp rcx, 0x17
jne 0x4b124e
mov rax, qword [rax + 0x30]
test rax, rax
je 0x4b1248
lea rcx, [0x00904b80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ecx, ecx
jmp 0x4b1234
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f82d0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b1120

Function at 0x4b19c0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b1a27
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4b1a09
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8140]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b19c0
Function at 0x4b1aa0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b1b07
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x4b1ae9
movzx eax, word [rax + 0x30]
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8160]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b1aa0

Function at 0x4b1b10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b1bc3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x4b1ba5
movzx ecx, byte [rax + 0x14]
test cl, 1
je 0x4b1b97
mov ecx, 0x48
movzx edx, word [rax + 0x32]
mov ebx, edx
and edx, 0x7fff
test bx, 0x7fff
jne 0x4b1b7c
xor eax, eax
mov qword [rsp + 0x28], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
add rcx, rax
test byte [rcx], al
movzx eax, word [rax + 0x30]
movzx ecx, ax
add eax, edx
movzx eax, ax
cmp rcx, rax
ja 0x4b1b9e
sub rax, rcx
jmp 0x4b1b6d
mov ecx, 0x38
jmp 0x4b1b58
call fcn.00429340
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8170]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b1b10

Function at 0x4b1bd0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b1cd8
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x13
jne 0x4b1cba
movzx ecx, byte [rax + 0x14]
test cl, 1
je 0x4b1ca2
mov ecx, 0x48
movzx edx, word [rax + 0x32]
mov ebx, edx
and edx, 0x7fff
test bx, 0x7fff
jne 0x4b1c6c
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x28]
cmp rdx, rax
jae 0x4b1cac
mov rax, qword [rcx + rdx*8]
test rax, rax
je 0x4b1c65
lea rcx, [0x00904b80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor ecx, ecx
mov rax, rcx
jmp 0x4b1c51
add rcx, rax
test byte [rcx], al
movzx eax, word [rax + 0x30]
movzx ebx, ax
add eax, edx
movzx eax, ax
cmp rbx, rax
ja 0x4b1cb3
sub rax, rbx
lea rdx, [rbx - 0x100000]
neg rdx
neg rdx
sar rdx, 0x3f
shl rbx, 3
and rbx, rdx
add rcx, rbx
jmp 0x4b1c37
mov ecx, 0x38
jmp 0x4b1c20
call fcn.004292d0
ud2
call fcn.00429340
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8180]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b1bd0
Function at 0x4b7d30
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b7dbe
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
cmp rcx, 8
jne 0x4b7da0
movzx eax, byte [rax + 0x17]
test al, 0x80
jne 0x4b7da0
mov rax, qword [rsp + 0x30]
bt eax, 7
jae 0x4b7d8c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8250]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b7d30

Function at 0x4b82f0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b84ec
sub rsp, 0x80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x4b834b
test rax, 0x60
jne 0x4b8455
bt eax, 8
jae 0x4b83be
mov rbp, qword [rsp + 0x78]
add rsp, 0x80
ret
call fcn.004b8020
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp]
mov qword [rsp + 0x50], rcx
lea rdx, [0x00823da0]
mov qword [rsp], rdx
call fcn.00410220
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x48]
mov qword [rdi + 8], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x4b8395
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
jmp 0x4b839f
mov rax, qword [rsp + 0x50]
call fcn.004544a0
mov qword [rdi + 0x10], 0
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
call fcn.004b8020
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
mov qword [rsp], 0
lea rdx, [0x00895ec7]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
lea rax, [0x008abec7]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x1a
call fcn.00441130
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a320
ud2
call fcn.004b8020
mov rax, qword [rsp + 8]
mov rcx, qword [rsp]
mov qword [rsp], 0
lea rdx, [0x00895ec7]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 9
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
lea rax, [0x008b6e40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x2c
call fcn.00441130
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b82f0