joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443c90
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x443e00
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.00443c50
mov rax, qword [rsp + 8]
test rax, rax
je 0x443db0
mov rcx, qword [rax + 0x50]
mov rdx, qword [rsp + 0x20]
mov rbx, rdx
sub rdx, rcx
mov rcx, rdx
shr rdx, 0xc
lea rdx, [rdx + rdx*4]
shl rdx, 2
add rdx, qword [rax + 0x48]
and rcx, 0xfff
shr rcx, 8
mov esi, dword [rdx]
cmp rcx, 0x10
jae 0x443df9
movzx ecx, byte [rdx + rcx + 4]
add ecx, esi
mov rdx, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
cmp ecx, esi
jb 0x443d24
lea rcx, [rsi - 1]
mov edi, ecx
cmp rdi, rsi
jae 0x443df2
shl rdi, 4
mov rdi, qword [rdx + rdi]
cmp rbx, rdi
jb 0x443d40
jmp 0x443d96
dec ecx
mov edi, ecx
cmp rdi, rsi
jae 0x443deb
shl rdi, 4
mov rdi, qword [rdi + rdx]
cmp rdi, rbx
jbe 0x443d5c
test ecx, ecx
ja 0x443d3e
test ecx, ecx
je 0x443dd0
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov ecx, ecx
cmp rcx, rsi
jae 0x443dc2
shl rcx, 4
mov rcx, qword [rdx + rcx + 8]
cmp rcx, rdi
jae 0x443dc2
add rcx, rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, r8d
lea edi, [rcx + 1]
cmp rdi, rsi
jae 0x443dc9
mov r8d, edi
shl rdi, 4
mov rdi, qword [rdx + rdi]
cmp rdi, rbx
jbe 0x443d93
jmp 0x443d60
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.004292d0
ud2
call fcn.004292d0
ud2
lea rax, [0x008b2d09]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.004292d0
ud2
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.00443c90
Function at 0x4445c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x444746
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x444712
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x70]
mov byte [rsp + 0x28], bl
call fcn.00443e10
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x1c]
mov dword [rsp + 0x10], edx
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x70]
mov byte [rsp + 0x28], dl
call fcn.00443e10
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x4446ad
lea rax, [0x0088ae67]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp eax, 0xffffffff
je 0x444680
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x444680
mov rbx, qword [rdx]
mov rdx, qword [rdx + 8]
jae 0x44473f
mov ecx, dword [rsi + rcx*4]
cmp rcx, rdx
jae 0x44473f
mov dword [rsp + 0x3c], eax
lea rax, [rbx + rcx]
mov qword [rsp], rax
call fcn.00442170
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0088ae67]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov dword [rsp + 0x88], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.004445c0
Function at 0x4447d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x444932
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x10], ecx
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.00443e10
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x444852
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.004443d0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x50], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x48], rdx
call fcn.0042b400
lea rax, [0x008a374c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042bdc0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.0042bdc0
call fcn.0042b660
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b660
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b660
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b660
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.0042bbe0
call fcn.0042b6b0
call fcn.0042b490
mov eax, dword [rsp + 0x3c]
jmp 0x444841
call fcn.00451b80
jmp fcn.004447d0

Function at 0x444d00
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x444d79
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, dword [rsp + 0x28]
test eax, eax
jl 0x444d5e
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx]
cmp eax, edx
jge 0x444d5e
mov edx, dword [rcx + 4]
mov dword [rsp + 0x30], edx
add edx, 7
sar edx, 3
imul eax, edx
movsxd rax, eax
lea rax, [rcx + rax + 8]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x008b11c6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00444d00
Function at 0x4451c0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
inc dword [rax + 0x2c8]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
lea rdx, [rcx + 0x138]
test byte [rdx], al
mov rdx, rax
mov qword [rcx + 0x138], rax
lea rax, [rdx + 0xe0]
test byte [rax], al
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xe0], rax
mov dword [rsp], 0
lea rax, fcn.00434a30
mov qword [rsp + 8], rax
call fcn.004295c0
test eax, eax
jne 0x4452f2
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x358]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x358], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x360], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x368], rdx
mov rdx, qword [0x010ee5f0]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00402340
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x370]
mov rdx, qword [rax + 0x378]
mov rax, qword [rax + 0x380]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
nop
call fcn.00429ed0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call fcn.00429ed0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x448790
Capabilities:
Get geographical location
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x30]
cmp rax, qword [rcx + 0x10]
jbe 0x448982
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x50], 0
lea rdi, [rsp + 0x58]
xorps xmm0, xmm0
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004546b5
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x28]
jmp 0x448808
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 0x28]
xorps xmm0, xmm0
test rax, rax
je 0x448917
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x448887
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp], rax
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0xc0]
mov rbx, qword [rdx]
call rbx
movzx eax, byte [rsp + 0x10]
test al, al
jne 0x4487fc
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
call fcn.00443c90
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
test rcx, rcx
je 0x448927
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x48]
mov ebx, dword [rdx]
test ebx, ebx
jne 0x448911
xor ebx, ebx
mov qword [rsp + 0x90], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
mov byte [rsp + 0x18], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.0044a5e0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
jmp 0x448841
lea rbx, [rdx + 0x30]
jmp 0x4488c3
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
call fcn.0042b400
lea rax, [0x008aef31]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x0089858d]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00448790
Function at 0x44ad30
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0xe0]
cmp rax, qword [rcx + 0x10]
jbe 0x44af88
sub rsp, 0x160
mov qword [rsp + 0x158], rbp
lea rbp, [rsp + 0x158]
movzx eax, byte [0x01635edb]
test al, al
je 0x44af7b
mov rax, qword [rsp + 0x180]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x44adb4
mov edx, dword [rcx + 0x108]
test edx, edx
jle 0x44adb4
mov rdx, qword [rax + 0x70]
test rdx, rdx
je 0x44adb4
mov rdx, qword [rcx + 0x110]
test rdx, rdx
je 0x44adb4
mov rdx, qword [rdx]
test rdx, rdx
jne 0x44af12
mov ecx, dword [rax + 0x90]
and ecx, 0xffffefff
cmp ecx, 3
jne 0x44aef5
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax + 0x70]
mov rbx, qword [rsp + 0x188]
and rbx, 0xfffffffffffffffd
mov qword [rsp + 0x168], rcx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x188], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov rsi, qword [rsp + 0x178]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x64
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
call fcn.00448990
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x44ae48
mov rcx, qword [rsp + 0x188]
bt ecx, 0
jae 0x44ae94
cmp rax, 0x64
je 0x44ae6f
mov rax, qword [rsp + 0x180]
mov qword [rsp], rax
call fcn.0044aa00
mov rbp, qword [rsp + 0x158]
add rsp, 0x160
ret
call fcn.0042b400
lea rax, [0x008afe92]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042bdc0
call fcn.0042b490
jmp 0x44ae4e
mov rax, qword [rsp + 0x168]
mov qword [rsp], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0x64
movups xmmword [rsp + 0x38], xmm0
or rcx, 1
mov qword [rsp + 0x48], rcx
call fcn.00448990
mov rax, qword [rsp + 0x50]
jmp 0x44ae48
mov rcx, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x188]
jmp 0x44addd
mov edx, 1
xchg dword [rcx + 0x10c], edx
mov rcx, qword [rax + 0x30]
mov rsi, qword [rcx + 0x110]
test byte [rcx], al
lea rdi, [rsp + 0x58]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454980
mov rbp, qword [rbp]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x110]
mov qword [rcx], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x10c], edx
lea rcx, [rsp + 0x58]
mov qword [rsp], rcx
call fcn.0044bbd0
mov rax, qword [rsp + 0x180]
jmp 0x44adb4
mov rax, qword [rsp + 0x180]
jmp 0x44adb4
call fcn.00451b80
jmp fcn.0044ad30
Function at 0x44afa0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44b080
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004513e0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00451a20
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00451b80
jmp fcn.0044afa0
Function at 0x44b680
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44b8e5
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov ecx, dword [0x00b01150]
mov rax, qword [rax + 0x30]
movzx eax, byte [rax + 0xf9]
test al, al
je 0x44b8db
movzx eax, al
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x90]
test rdx, rdx
je 0x44b8d1
mov rbx, qword [rsp + 0x68]
cmp rbx, rdx
jne 0x44b881
lea rax, [0x016365f8]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [0x010f0058]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x010f0050]
mov qword [rsp + 0x50], rcx
xor edx, edx
jmp 0x44b73e
inc rdx
cmp rdx, rax
jge 0x44b867
mov rbx, qword [rcx + rdx*8]
mov rsi, qword [rsp + 0x68]
cmp rsi, rbx
je 0x44b73b
mov rdi, qword [rsp + 0x48]
mov r8, qword [rdi + 0x30]
mov r8, qword [r8 + 0x90]
cmp rbx, r8
je 0x44b73b
mov r8d, dword [rbx + 0x90]
cmp r8d, 6
je 0x44b73b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp], rbx
call fcn.0044bb10
movzx eax, byte [rsp + 8]
test al, al
je 0x44b7b2
mov eax, dword [rsp + 0x24]
cmp eax, 2
jge 0x44b7b2
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
jmp 0x44b73b
call fcn.0042b400
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0044b3e0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x30]
cmp rcx, rbx
je 0x44b7f7
mov ecx, dword [rax + 0x90]
and ecx, 0xffffefff
cmp ecx, 2
je 0x44b834
mov qword [rsp], 0xffffffffffffffff
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rax
call fcn.0044ac50
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
jmp 0x44b73b
call fcn.0042b400
lea rax, [0x008ba65d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0044aa00
jmp 0x44b81b
lea rax, [0x016365f8]
mov qword [rsp], rax
call fcn.0040e630
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x40], rdx
call fcn.0042b400
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0044b3e0
mov qword [rsp], 0xffffffffffffffff
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
call fcn.0044ac50
jmp 0x44b70f
mov rbx, qword [rsp + 0x68]
jmp 0x44b70f
shr ecx, 2
mov eax, ecx
jmp 0x44b6d4
call fcn.00451b80
jmp fcn.0044b680
Function at 0x44c280
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44c557
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x44c47e
mov rcx, qword [rsp + 0x68]
lea rdx, [0x00b08f00]
jmp 0x44c2c9
mov rdx, qword [rdx + 0x1c0]
test rdx, rdx
je 0x44c304
mov rbx, qword [rdx + 0xc8]
cmp rcx, rbx
jb 0x44c2c2
mov rsi, qword [rdx + 0xd0]
cmp rcx, rsi
jae 0x44c2c2
movsxd rcx, eax
add rcx, rbx
cmp rcx, rsi
ja 0x44c4ac
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x30], rcx
call fcn.0044c1e0
lea rax, [0x007fda60]
mov qword [rsp], rax
mov rax, qword [0x010f0150]
mov qword [rsp + 8], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x10], eax
call fcn.004093c0
mov rax, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x20]
mov byte [rsp + 0x2f], cl
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
call fcn.0044c230
movzx eax, byte [rsp + 0x2f]
test al, al
jne 0x44c46a
call fcn.0042b400
lea rax, [0x008a46bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042bdc0
mov eax, dword [rsp + 0x70]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088e045]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x008a2b4c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x00b08f00]
jmp 0x44c45f
mov qword [rsp + 0x50], rax
mov rcx, qword [rax + 0xc8]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0xd0]
mov qword [rsp + 0x38], rdx
call fcn.0042b400
lea rax, [0x008904fd]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x00891ff4]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1c0]
test rax, rax
jne 0x44c3d9
jmp 0x44c491
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x78], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x008b7cff]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
call fcn.0042ab20
ud2
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rsi
call fcn.0042b400
lea rax, [0x008a46bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042bdc0
mov eax, dword [rsp + 0x70]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089f0f6]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b035]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b1ca7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0044c280
Function at 0x45bd90
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45be67
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, 0xffffffff
mov rdx, qword [rsp + 0x28]
lock xadd dword [rdx], ecx
lea ebx, [rcx - 1]
bt ecx, 0
jae 0x45be3c
bt ebx, 2
jae 0x45bdd9
jmp 0x45be20
mov ebx, dword [rdx]
mov eax, ebx
sar ebx, 3
test ebx, ebx
je 0x45be16
test eax, 7
jne 0x45be16
lea ecx, [rax - 8]
or ecx, 2
lock cmpxchg dword [rdx], ecx
sete cl
test cl, cl
je 0x45bdd7
lea rax, [rdx + 4]
mov qword [rsp], rax
mov byte [rsp + 8], 0
call fcn.0043b290
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [rdx + 4]
mov qword [rsp], rax
mov byte [rsp + 8], 1
call fcn.0043b290
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], ebx
lea rax, [0x008afdc0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042aad0
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x14]
jmp 0x45bdcf
call fcn.00451b80
jmp fcn.0045bd90

Function at 0x45ca40
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45cad3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jge 0x45caac
cmp eax, 0xffffffff
jne 0x45caca
lea rax, [0x008b1daf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042aad0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x20]
lock xadd dword [rcx + 0x14], eax
dec eax
test eax, eax
je 0x45cab6
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [rcx + 8]
mov qword [rsp], rax
mov byte [rsp + 8], 0
call fcn.0043b290
jmp 0x45caac
cmp eax, 0xbfffffff
je 0x45ca7e
jmp 0x45ca97
call fcn.00451b80
jmp fcn.0045ca40
Function at 0x45ccc0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45cdfc
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [rsp + 0x28]
test byte [rax], al
mov rcx, rax
test rax, 7
jne 0x45cd93
mov rax, rcx
mov rdx, qword [rsp + 0x30]
mov rbx, rdx
shl rdx, 0x20
mov rsi, rdx
lock xadd qword [rcx], rdx
add rdx, rsi
mov rsi, rdx
shr rdx, 0x20
test edx, edx
jl 0x45cdde
test esi, esi
je 0x45cd8f
test rbx, rbx
jle 0x45cd8b
cmp edx, ebx
je 0x45cdc0
test edx, edx
jg 0x45cd81
test esi, esi
je 0x45cd81
mov rdx, qword [rcx]
cmp rdx, rsi
jne 0x45cda2
mov qword [rcx], 0
jmp 0x45cd73
mov dword [rsp + 0x14], esi
lea rcx, [rax + 0xc]
mov qword [rsp], rcx
mov byte [rsp + 8], 0
call fcn.0043b290
mov eax, dword [rsp + 0x14]
lea esi, [rax - 1]
mov rax, qword [rsp + 0x28]
test esi, esi
jne 0x45cd51
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
test edx, edx
jmp 0x45cd3a
test edx, edx
jmp 0x45cd3a
lea rdx, [rcx + 4]
mov rax, rcx
mov rcx, rdx
jmp 0x45cd01
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8800]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f87f0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f87e0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.0045ccc0

Function at 0x45ce60
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45cf24
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
test byte [rcx], al
mov rdx, rcx
test rcx, 7
jne 0x45cefa
mov rax, rdx
jmp 0x45cea3
mov rax, rsi
mov rcx, qword [rdx]
mov rbx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x45cef0
lea rcx, [rbx + 1]
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rdx], rcx
sete cl
test cl, cl
je 0x45cea0
mov qword [rsp + 0x10], rdx
lea rax, [rsi + 0xc]
mov qword [rsp], rax
call fcn.0043b1d0
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
test rax, rax
jne 0x45cf06
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rcx, [rdx + 4]
mov rax, rdx
mov rdx, rcx
jmp 0x45cea3
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8810]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.0045ce60