joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422b90
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x422dce
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, rax
mov rdx, qword [0x0110c308]
cmp rax, rdx
jae 0x422d4c
xor eax, eax
test rax, rax
je 0x422dac
mov qword [rsp + 0x20], rax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xd0]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp], rax
call fcn.0041e490
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
lea rdx, [rcx + 0x18]
sub rax, qword [rdx]
mov qword [rsp + 0x18], rax
mov rdx, qword [rsp + 0x50]
movzx ebx, byte [rdx + 0xa]
mov byte [rsp + 0x17], bl
lea rsi, [rcx + 0x88]
mov qword [rsp + 0x30], rsi
mov qword [rsp], rsi
call fcn.0040e440
mov rax, qword [rsp + 0x20]
add rax, 0x90
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x18]
jmp 0x422c5e
mov rax, rbx
mov rbx, qword [rax]
test rbx, rbx
je 0x422c88
movzx esi, word [rbx + 8]
cmp rdx, rsi
jne 0x422c7b
movzx edi, byte [rbx + 0xa]
cmp cl, dil
je 0x422cf3
cmp rdx, rsi
jb 0x422c88
jne 0x422c5b
movzx esi, byte [rbx + 0xa]
cmp cl, sil
jae 0x422c5b
mov rcx, qword [rsp + 0x50]
mov word [rcx + 8], dx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd0]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd0], ebx
cmp edx, 1
jne 0x422ce4
movzx ecx, byte [rax + 0xc0]
test cl, cl
je 0x422ce4
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x58], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd0]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd0], ebx
cmp edx, 1
jne 0x422d3d
movzx ecx, byte [rax + 0xc0]
test cl, cl
je 0x422d3d
mov qword [rax + 0x10], 0xfffffffffffffade
mov byte [rsp + 0x58], 0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [0x0110c310]
cmp rax, rbx
jae 0x422bd0
mov rbx, qword [0x0110c030]
mov rsi, qword [0x0110c028]
mov rdi, rax
sub rax, rdx
shr rax, 0xd
cmp rax, rbx
jae 0x422dc7
mov rax, qword [rsi + rax*8]
test rax, rax
je 0x422d8b
mov rdx, qword [rax + 0x18]
cmp rdi, rdx
jae 0x422d92
xor eax, eax
jmp 0x422bd2
mov rdx, qword [rax + 0x80]
cmp rdi, rdx
jae 0x422d8b
movzx edx, byte [rax + 0x64]
cmp dl, 1
jne 0x422d8b
jmp 0x422bd2
lea rax, [0x008ae9a4]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.00422b90
Function at 0x423360
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x423415
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x0110e618]
mov qword [rsp], rax
call fcn.0040e440
lea rax, [0x0110e5d0]
mov qword [rsp], rax
call fcn.00415d00
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
lea rcx, [0x0110e618]
mov qword [rsp], rcx
call fcn.0040e630
mov rax, qword [rsp + 0x18]
mov byte [rax + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.00422b90
movzx eax, byte [rsp + 0x10]
test al, al
je 0x4233fa
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008b4022]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00423360

Function at 0x4239b0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x423a93
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rax, qword [0x010f03c8]
test rax, rax
je 0x423a29
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 8]
mov qword [0x010f03c8], rcx
mov qword [rsp], rax
mov qword [rsp + 8], 0x10000
call fcn.00454a70
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov qword [rax], 0
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x010f03c0]
mov qword [rsp], rax
call fcn.0040e630
mov qword [rsp], 0x10000
lea rax, [0x0163d158]
mov qword [rsp + 8], rax
call fcn.004144c0
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x423a78
mov qword [rsp + 0x18], rax
lea rax, [0x010f03c0]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [rsp + 0x18]
jmp 0x423a0b
lea rax, [0x008b0598]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004239b0
Function at 0x424c00
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x424d48
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
lea rax, [0x016366e0]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xf9], 2
call fcn.0042b400
lea rax, [0x0089850b]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088aebe]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088aeba]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044b3e0
lea rax, [0x0044fe20]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
call fcn.00451a20
call fcn.0042b400
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 0
lea rax, [0x016366e0]
mov qword [rsp], rax
call fcn.0040e630
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00451b80
jmp fcn.00424c00

Function at 0x424d60
Capabilities:
Get geographical location

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x424e45
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
lea rax, [0x016366e0]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xf9], 2
call fcn.0042b400
lea rax, [0x00898515]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044b680
call fcn.0042b400
lea rax, [0x0089ba8e]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
call fcn.0042b490
call fcn.0042b400
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 0
lea rax, [0x016366e0]
mov qword [rsp], rax
call fcn.0040e630
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00451b80
jmp fcn.00424d60
Function at 0x424e50
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, 0xfffffffffffffade
je 0x424f1a
lea rax, [rsp + 0x370]
sub rax, rsi
cmp rax, 0x1998
jbe 0x424f1a
sub rsp, 0x16a8
mov qword [rsp + 0x16a0], rbp
lea rbp, [rsp + 0x16a0]
lea rdi, [rsp + 0x10]
mov ecx, 0x2d2
xor eax, eax
rep stosq qword [rdi], rax
mov rdx, qword [0x00b01310]
cmp rdx, 0x1690
jne 0x424ece
mov rbp, qword [rsp + 0x16a0]
add rsp, 0x16a8
ret
call fcn.0042b400
mov rax, qword [0x00b01310]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b660
mov qword [rsp], 0x1690
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b354e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00424e50

Function at 0x4251e0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rcx, rax
neg rax
mov rdx, qword [rsp + 0x28]
lock xadd qword [rdx], rax
sub rax, rcx
lea rdx, [rax + rcx]
cmp rdx, rcx
jb 0x425219
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rax
call fcn.0042b400
lea rax, [0x008aeef7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042bdc0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088b7bf]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
mov dword [rsp], 2
call fcn.004282c0
jmp 0x42520f

Function at 0x425290
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x425320
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
movzx edx, byte [0x01635ed7]
test dl, dl
je 0x4252ed
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x425305
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, byte [0x01636825]
test dl, dl
jne 0x4252cb
add rcx, 0x1000
mov qword [rax + 8], rcx
jmp 0x4252d3
lea rax, [0x008b015b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00425290
Function at 0x425730
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x425852
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x010efba0]
mov qword [rsp], rax
call fcn.004269a0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x20], rcx
mov qword [rsp], rcx
call fcn.0040e440
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x42579e
cmp rcx, 1
jne 0x425837
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4257ad
cmp rcx, 1
jne 0x42581c
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], 0
inc qword [rax + 0x20]
mov qword [rax + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0xc0], 0
mov rdx, qword [rsp + 0x20]
mov qword [rsp], rdx
call fcn.0040e630
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 8], rax
call fcn.00426b70
movsxd rax, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x008b4678]
mov qword [rsp], rax
mov qword [rsp + 8], 0x26
call fcn.0042ab20
ud2
lea rax, [0x008b4e9b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x27
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00425730

Function at 0x425860
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x425923
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax + 0x18]
test cl, cl
je 0x425908
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x4258a4
cmp rcx, 1
jne 0x4258ed
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4258b3
cmp rcx, 1
jne 0x4258d2
lea rcx, [0x010efba0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00425930
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x008b5e45]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042ab20
ud2
lea rax, [0x008b6610]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0042ab20
ud2
lea rax, [0x008b300b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00425860
Function at 0x426010
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4261fc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [rsp + 0x48]
test byte [rax], al
lea rcx, [rax + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp], rcx
call fcn.0040e440
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax + 0x18]
test cl, cl
jne 0x4261e1
mov byte [rax + 0x18], 1
inc qword [rax + 0x20]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.004021e0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov dword [rsp + 8], 0x72
mov byte [rsp + 0xc], 0
call fcn.00426540
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov dword [rsp + 8], 0x77
mov byte [rsp + 0xc], 0
call fcn.00426540
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x50]
lea rbx, [rcx + 0x50]
test rdx, rdx
jne 0x426196
mov rdx, qword [rcx + 0xa0]
lea rbx, [rcx + 0xa0]
test rdx, rdx
jne 0x426151
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x42613d
mov rax, qword [rsp + 0x18]
test rax, rax
jne 0x426129
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.00426370
jmp 0x42611f
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.00426370
jmp 0x426115
mov qword [rsp + 0x28], rbx
lea rax, [rcx + 0x80]
mov qword [rsp], rax
call fcn.00445e70
mov eax, dword [0x01636820]
test eax, eax
jne 0x426185
mov rax, qword [rsp + 0x48]
mov qword [rax + 0xa0], 0
jmp 0x4260fd
mov rdi, qword [rsp + 0x28]
xor eax, eax
call fcn.004544a0
jmp 0x4260fd
mov qword [rsp + 0x28], rbx
lea rax, [rcx + 0x30]
mov qword [rsp], rax
call fcn.00445e70
mov eax, dword [0x01636820]
test eax, eax
jne 0x4261ce
mov rax, qword [rsp + 0x48]
mov qword [rax + 0x50], 0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x48]
jmp 0x4260ea
mov rdi, qword [rsp + 0x28]
xor eax, eax
call fcn.004544a0
mov rax, qword [rsp + 0x48]
jmp 0x4261bf
lea rax, [0x008b3986]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00426010
Function at 0x4270f0
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4271fb
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x4271bd
mov ecx, dword [rax + 0x28]
cmp ecx, 0x72
je 0x427133
cmp ecx, 0x77
jne 0x427166
mov edx, dword [rsp + 0x40]
mov dword [rax + 0x2c], edx
mov edx, dword [rsp + 0x44]
mov dword [rax + 0x30], edx
mov rax, qword [rax + 0x20]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 0x10], ecx
call fcn.00426210
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], ecx
call fcn.0042b400
lea rax, [0x008bb7e8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3a
call fcn.0042bdc0
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008aa187]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.0042b400
lea rax, [0x008ba879]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008aa187]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.004270f0
Function at 0x427d30
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x28]
cmp rax, qword [rcx + 0x10]
jbe 0x428017
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
lea rax, [rsp + 0x80]
mov qword [rsp], rax
lea rax, [0x008aa70a]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x18
call fcn.00441420
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.00427210
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x20]
test eax, eax
jne 0x427f97
mov qword [0x010ee5a8], rcx
test rcx, rcx
je 0x427ffc
lea rax, [rsp + 0x60]
mov qword [rsp], rax
lea rax, [0x008aa8a2]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x18
call fcn.00441420
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.00427210
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x20]
test eax, eax
jne 0x427f83
mov qword [0x010ee5c0], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
lea rax, [0x008ac30b]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x1a
call fcn.00441420
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0xb0]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.00427210
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x20]
test eax, eax
jne 0x427f6f
mov qword [0x010ee5c8], rcx
mov rax, qword [0x010ee5c0]
test rax, rax
je 0x427fe1
test rcx, rcx
je 0x427fe1
mov qword [rsp + 0x30], 0
mov rax, qword [0x010ee5c8]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.00428d80
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x427fc6
cmp rax, 0x7fffffff
jg 0x427fab
mov qword [rsp + 0x38], rax
mov rax, qword [0x010ee5c0]
mov qword [rsp], rax
lea rax, [0x016366a0]
mov qword [rsp + 8], rax
call fcn.00428d80
mov qword [rsp], 0x3b9aca00
mov rax, qword [rsp + 0x38]
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], 0
call fcn.00438b00
movsxd rax, dword [rsp + 0x18]
mov qword [0x01636698], rax
mov byte [0x01635ef0], 1
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
lea rdi, [0x010ee5c8]
mov rax, rcx
call fcn.004544a0
jmp 0x427eb6
lea rdi, [0x010ee5c0]
mov rax, rcx
call fcn.004544a0
jmp 0x427e4a
lea rdi, [0x010ee5a8]
mov rax, rcx
call fcn.004544a0
jmp 0x427dd5
lea rax, [0x008bda97]
mov qword [rsp], rax
mov qword [rsp + 8], 0x56
call fcn.0042ab20
ud2
lea rax, [0x008bd6bb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x50
call fcn.0042ab20
ud2
lea rax, [0x008ad190]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.0042ab20
ud2
lea rax, [0x008b8831]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00427d30
Function at 0x428980
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
lea rax, [0x007eb8c0]
mov qword [rsp + 0x50], rax
lea rax, [0x008c5bc0]
mov qword [rsp + 0x58], rax
test byte [rax], al
lea rax, [rsp + 0x58]
test byte [rax], al
mov rax, qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, qword [0x008c5bc0]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0x200000
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x10000
mov qword [rsp + 0x30], 0
call fcn.00428f60
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x428a22
mov rcx, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00428d80
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, dword [0x01635f1c]
test eax, eax
je 0x428a4c
lea rax, [0x01636628]
mov qword [rsp], rax
call fcn.0040e440
lea rax, [0x01636628]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [0x010f0a88]
sub rax, qword [0x010f0a98]
mov qword [rsp + 0x48], rax
call fcn.004554b0
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.0042b400
lea rax, [0x008b7cd1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x008a2b2c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088aeba]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008a469d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042ab20
ud2
Function at 0x4295c0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x90]
cmp rcx, rax
jne 0x4296d4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov ecx, dword [rsp + 0x30]
mov dword [rsp], ecx
call fcn.004299d0
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 0x20]
test rcx, rcx
jne 0x4296b9
mov ecx, dword [0x01636820]
mov rdx, qword [rsp + 0x38]
lea rdi, [rax + 0x18]
test ecx, ecx
jne 0x4296a6
mov qword [rax + 0x18], rdx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x30]
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x30]
test ecx, ecx
jne 0x42965a
call fcn.00454480
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdx, qword [rsp + 0x18]
add rdx, 8
cmp ecx, 8
jne 0x42967e
mov ecx, dword [rax]
test ecx, ecx
jne 0x429678
xor eax, eax
mov rcx, qword [rdx]
mov qword [rax], rcx
jmp 0x42964b
add rax, 0x30
jmp 0x429670
mov ecx, dword [rax]
test ecx, ecx
jne 0x4296a0
xor eax, eax
mov qword [rsp], rax
mov qword [rsp + 8], rdx
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x10], rax
call fcn.00454d00
jmp 0x42964b
add rax, 0x30
jmp 0x429686
mov rcx, rax
mov rax, rdx
call fcn.004544a0
mov rax, rcx
jmp 0x429631
lea rax, [0x008b54ef]
mov qword [rsp], rax
mov qword [rsp + 8], 0x28
call fcn.0042ab20
ud2
lea rax, [0x008a80d0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x15
call fcn.0042ab20
ud2